A virtual credit card is a unique 16-digit number tied to your real credit card account. You use it once, or set it to expire after a single merchant or a small dollar amount, then it stops working.
If the merchant gets hacked, the leaked virtual number is useless. Your real card never touched the transaction.
Here is how virtual cards actually work, the providers that offer them for free, and when they make sense. (Developers building payment integrations don't need real virtual cards at all, our dummy credit card numbers for testing 2026 developer guide lists the sandbox test numbers for Stripe, Adyen, Braintree, and Square.)
How a Virtual Credit Card Actually Works
A virtual card is generated by your card issuer or a third-party app. It has its own card number, expiration date, and CVV, but it routes the charge to your real underlying account.
The key feature is that you can set rules for the virtual number:
- Single-use: works for one transaction, then expires.
- Merchant-locked: only works at one specific merchant.
- Spending limit: cannot exceed a dollar cap you set.
- Time-limited: expires after a date you choose.
When the rule fails, the transaction is declined automatically. No fraud, no dispute paperwork, no scrambling to cancel your real card.
Free Virtual Card Providers in 2026
Three categories of provider offer virtual cards.
Bank-issued virtual cards (free for cardholders).
- Capital One Eno. Browser extension generates a virtual number on demand at checkout. Free for any Capital One cardholder.
- Citi Virtual Account Numbers (VAN). Free for cardholders and generated from your online Citi account — our step-by-step Citibank virtual credit card setup guide walks through generating one and which cards qualify.
- Bank of America ShopSafe. Free for cardholders.
- American Express. Generates virtual numbers through Amex Online and Apple/Google Pay tokenization.
Third-party virtual card services (free or low cost).
- Privacy.com. Free tier (12 cards/month) and paid tiers ($10/mo to $25/mo) with higher limits and category-locked cards. Funds via debit or bank account, not credit cards.
- Apple Pay and Google Pay tokenization. Every tap-to-pay or web checkout uses a tokenized number, which is functionally a virtual card.
Built-in to digital banking apps.
- Chime, Current, Cash App. Generate virtual debit numbers for in-app spending.
- Most fintech apps. Issue virtual numbers as the default for new accounts.
Most users do not need to pay for a third-party service. The bank-issued virtual card from your existing credit card account is free and built into the app or browser extension.
For readers who don't have a traditional credit card or who want a no-credit-check route to virtual numbers, the Current Build Card is one of the simpler options. Virtual numbers live inside the Current app, there's no deposit and no credit check at signup, and the account reports to all three bureaus while you spend.
Current Build Card
Current Build Card
$0 annual fee. No minimum deposit required. No credit check required. 1 point per dollar on eligible categories. Reports to Experian, TransUnion, Equifax.
Fee
$0
APR
0%
Minimum Deposit Amount
$0
Credit Check
No
Cashback
1 point/dollar on eligible categories (with qualifying payroll deposit)
Benefit
No credit check, no deposit minimum
When Virtual Cards Make the Most Sense
Three scenarios where virtual cards pay off the most.
1. Free trials with auto-renewal. Set a virtual card with a $0.01 limit so the trial works but the renewal charge fails. You then choose whether to convert to a real subscription. For the underlying credit cards that pair best with this approach, see our roundup of the best credit cards for free trials and virtual-card alternatives.
2. Sketchy or one-off online merchants. A small website you found through Google ads, a foreign retailer with mixed reviews, or any merchant where you would not want them to retain your card on file.
3. Subscription services where cancellation is hard. Use a merchant-locked virtual card. If the company makes it hard to cancel, you can simply pause the virtual card and the charges stop.
If the prompt is asking for a card just to verify your identity rather than to bill you, our guide to picking a credit card for online verification breaks down which virtual and prepaid options reliably pass the $1 auth and which get rejected.
If you have fair credit and want a real unsecured card to back virtual numbers, the Aspire Cash Back Rewards Mastercard prequalifies up to a $1,000 limit with no deposit and works in Apple Pay and Google Pay. Tap-to-pay tokenization gives you virtual-card-style protection on the merchant side, and you also pick up cash back on eligible categories.
Aspire® Cash Back Rewards Mastercard
Aspire® Cash Back Rewards Mastercard
Aspire® Cash Back Rewards Mastercard. Prequalify* For Up To $1000 Credit Limit. No security deposit. Packed with great benefits, it’s designed to give you more flexibility—and purchasing power—along with up to 3% cash back rewards!** Good anywhere Mastercard is accepted, it’s the go-to card for any lifestyle.
Standout feature
Up to 3% cashback rewards
Fees
$49 to $175; after that $0 to $49 annually; - $60 to $159 annually billed at $5 to $12.50 per month after the first year.
Pros
No Deposit Required. Prequalify for up to $1000 credit limit
Cons
High APR. 25.74% to 36%, based on your creditworthiness.
Before you start handing virtual numbers to dozens of merchants, it's worth setting up monitoring with Creditship. If one of those merchants gets breached and a charge slips through to your real underlying card, alerts on new accounts or unexpected score drops will surface the problem before it spirals.
Creditship
Creditship
Get free credit monitoring and concrete advice how to improve your credit from Creditship AI.
Standout feature
AI Credit Coach. AI analyzes your credit report in depth and gives you tailored, actionable steps to raise your score.
Fees
Free
Pros
Free credit report access plus monitoring and alerts
Cons
No credit repair feature
When Virtual Cards Are NOT a Good Fit
Virtual cards have limits.
- Hotel and rental car holds. These often need the real card on file at check-in or pickup. A virtual number can fail at the front desk.
- In-person purchases. Virtual cards are designed for online use. For in-store, use Apple Pay or Google Pay tokenization, which serves the same purpose.
- Returns and refunds. A refund on an expired virtual card sometimes routes to the real underlying card and sometimes does not. Verify with the merchant before relying on this.
- Recurring subscriptions you want to keep. Setting a virtual card to expire automatically can cause an unwanted gap in service.
Most of these limits go away with merchant-locked or category-locked cards rather than single-use cards.
How to Use Virtual Cards Without Losing Rewards
A virtual card from your bank-issued credit card earns the same rewards as the underlying real card. A 2% cash back card pays 2% on virtual-card transactions.
Third-party services like Privacy.com fund through debit, not credit, so they do not earn credit card rewards. Trade-off: more security, less rewards. For low-risk merchants you trust (Amazon, Apple, your usual subscriptions), use the real credit card. For sketchy or one-off purchases, use a virtual or third-party card.
Virtual Cards and Credit Building
If you are still building credit, the relevant point is that virtual cards do not change reporting. The underlying real credit card reports to bureaus the same way regardless of how you make the transaction.
For borrowers building or rebuilding, the Self Visa Credit Builder Card offers a path to a real credit card with on-time payment reporting to all three bureaus. Once approved, you can use the card with virtual numbers in Apple Pay or Google Pay for online safety while still building credit. See our Self Credit Builder Card review for the full breakdown.
Privacy.com vs Bank-Issued Virtual Cards
The two main camps split on a few key factors.
Bank-issued (Capital One Eno, Citi VAN, etc.):
- Free for cardholders.
- Earns credit card rewards.
- Generates new numbers per transaction or per merchant.
- Tied to your credit card, so transactions still affect your credit utilization.
Privacy.com:
- Free tier covers most personal users.
- Funds via debit or bank account.
- Fast generation of merchant-locked, category-locked, and single-use cards.
- Does NOT earn credit rewards.
- Useful for separating personal and business spend without opening multiple credit cards.
For most users, the bank-issued tool wins on rewards and the third-party tool wins on flexibility.
What About Mobile Wallet Tokenization?
Apple Pay, Google Pay, and Samsung Pay all use a process called tokenization. When you add your real card, the wallet generates a unique device-specific number that is sent to merchants instead of the real card number.
This is functionally a virtual card. Even if a merchant database is compromised, the tokenized number cannot be used outside the original wallet. Tap-to-pay transactions are among the most secure ways to pay both in-person and online.
Frequently Asked Questions
What is a virtual credit card?
A virtual credit card is a unique 16-digit number tied to your real credit card account. The virtual number can be set to expire after one use, work only at one merchant, or have a spending limit. If the virtual number is leaked, your real card stays safe.
Are virtual credit cards safe?
Yes, in fact safer than using your real card online. The virtual number is single-use or merchant-locked, so even a data breach exposes only the limited virtual number, not your real account. Most major banks generate virtual cards through their app or browser extension at no cost.
Do virtual credit cards earn rewards?
Virtual cards generated by your credit card issuer (Capital One Eno, Citi VAN, etc.) earn the same rewards as the underlying real card. Third-party virtual card services like Privacy.com that fund through debit do not earn credit card rewards.
Can I use a virtual credit card for hotel reservations?
Most hotels require the real card on file at check-in. A virtual card may work for the booking but fail at the front desk. The same is true for rental cars. For travel reservations, use the real card or set a merchant-locked virtual card with a generous limit.
