A virtual credit card is a unique 16-digit number tied to your real credit card account. You use it once, or set it to expire after a single merchant or a small dollar amount, then it stops working.
If the merchant gets hacked, the leaked virtual number is useless. Your real card never touched the transaction.
Here is how virtual cards actually work, the providers that offer them for free, and when they make sense.
How a Virtual Credit Card Actually Works
A virtual card is generated by your card issuer or a third-party app. It has its own card number, expiration date, and CVV, but it routes the charge to your real underlying account.
The key feature is that you can set rules for the virtual number:
- Single-use: works for one transaction, then expires.
- Merchant-locked: only works at one specific merchant.
- Spending limit: cannot exceed a dollar cap you set.
- Time-limited: expires after a date you choose.
When the rule fails, the transaction is declined automatically. No fraud, no dispute paperwork, no scrambling to cancel your real card.
Free Virtual Card Providers in 2026
Three categories of provider offer virtual cards.
Bank-issued virtual cards (free for cardholders).
- Capital One Eno. Browser extension generates a virtual number on demand at checkout. Free for any Capital One cardholder.
- Citi Virtual Account Numbers (VAN). Available in the Citi mobile app. Free for cardholders.
- Bank of America ShopSafe. Free for cardholders.
- American Express. Generates virtual numbers through Amex Online and Apple/Google Pay tokenization.
Third-party virtual card services (free or low cost).
- Privacy.com. Free tier (12 cards/month) and paid tiers ($10/mo to $25/mo) with higher limits and category-locked cards. Funds via debit or bank account, not credit cards.
- Apple Pay and Google Pay tokenization. Every tap-to-pay or web checkout uses a tokenized number, which is functionally a virtual card.
Built-in to digital banking apps.
- Chime, Current, Cash App. Generate virtual debit numbers for in-app spending.
- Most fintech apps. Issue virtual numbers as the default for new accounts.
Most users do not need to pay for a third-party service. The bank-issued virtual card from your existing credit card account is free and built into the app or browser extension.
When Virtual Cards Make the Most Sense
Three scenarios where virtual cards pay off the most.
1. Free trials with auto-renewal. Set a virtual card with a $0.01 limit so the trial works but the renewal charge fails. You then choose whether to convert to a real subscription.
2. Sketchy or one-off online merchants. A small website you found through Google ads, a foreign retailer with mixed reviews, or any merchant where you would not want them to retain your card on file.
3. Subscription services where cancellation is hard. Use a merchant-locked virtual card. If the company makes it hard to cancel, you can simply pause the virtual card and the charges stop.
When Virtual Cards Are NOT a Good Fit
Virtual cards have limits.
- Hotel and rental car holds. These often need the real card on file at check-in or pickup. A virtual number can fail at the front desk.
- In-person purchases. Virtual cards are designed for online use. For in-store, use Apple Pay or Google Pay tokenization, which serves the same purpose.
- Returns and refunds. A refund on an expired virtual card sometimes routes to the real underlying card and sometimes does not. Verify with the merchant before relying on this.
- Recurring subscriptions you want to keep. Setting a virtual card to expire automatically can cause an unwanted gap in service.
Most of these limits go away with merchant-locked or category-locked cards rather than single-use cards.
How to Use Virtual Cards Without Losing Rewards
A virtual card from your bank-issued credit card earns the same rewards as the underlying real card. A 2% cash back card pays 2% on virtual-card transactions.
Third-party services like Privacy.com fund through debit, not credit, so they do not earn credit card rewards. Trade-off: more security, less rewards. For low-risk merchants you trust (Amazon, Apple, your usual subscriptions), use the real credit card. For sketchy or one-off purchases, use a virtual or third-party card.
Virtual Cards and Credit Building
If you are still building credit, the relevant point is that virtual cards do not change reporting. The underlying real credit card reports to bureaus the same way regardless of how you make the transaction.
For borrowers building or rebuilding, the Self Visa Credit Builder Card offers a path to a real credit card with on-time payment reporting to all three bureaus. Once approved, you can use the card with virtual numbers in Apple Pay or Google Pay for online safety while still building credit. See our Self Credit Builder Card review for the full breakdown.
Privacy.com vs Bank-Issued Virtual Cards
The two main camps split on a few key factors.
Bank-issued (Capital One Eno, Citi VAN, etc.):
- Free for cardholders.
- Earns credit card rewards.
- Generates new numbers per transaction or per merchant.
- Tied to your credit card, so transactions still affect your credit utilization.
Privacy.com:
- Free tier covers most personal users.
- Funds via debit or bank account.
- Fast generation of merchant-locked, category-locked, and single-use cards.
- Does NOT earn credit rewards.
- Useful for separating personal and business spend without opening multiple credit cards.
For most users, the bank-issued tool wins on rewards and the third-party tool wins on flexibility.
What About Mobile Wallet Tokenization?
Apple Pay, Google Pay, and Samsung Pay all use a process called tokenization. When you add your real card, the wallet generates a unique device-specific number that is sent to merchants instead of the real card number.
This is functionally a virtual card. Even if a merchant database is compromised, the tokenized number cannot be used outside the original wallet. Tap-to-pay transactions are among the most secure ways to pay both in-person and online.
Frequently Asked Questions
What is a virtual credit card?
A virtual credit card is a unique 16-digit number tied to your real credit card account. The virtual number can be set to expire after one use, work only at one merchant, or have a spending limit. If the virtual number is leaked, your real card stays safe.
Are virtual credit cards safe?
Yes, in fact safer than using your real card online. The virtual number is single-use or merchant-locked, so even a data breach exposes only the limited virtual number, not your real account. Most major banks generate virtual cards through their app or browser extension at no cost.
Do virtual credit cards earn rewards?
Virtual cards generated by your credit card issuer (Capital One Eno, Citi VAN, etc.) earn the same rewards as the underlying real card. Third-party virtual card services like Privacy.com that fund through debit do not earn credit card rewards.
Can I use a virtual credit card for hotel reservations?
Most hotels require the real card on file at check-in. A virtual card may work for the booking but fail at the front desk. The same is true for rental cars. For travel reservations, use the real card or set a merchant-locked virtual card with a generous limit.
