A virtual card number is a stand-in for your real card number. You use it at checkout instead of the number printed on your card, and you can lock or delete it without replacing the card. If a store gets breached or a subscription won't let go, the damage stops at that one number. To get one, look for "virtual card" in your card issuer's app or website, or turn on virtual cards in Google Wallet or Chrome if your card supports it.
This guide covers what these numbers are, where to get them as of November 2026, how to set one up for subscriptions and one-off purchases, and what actually protects you under U.S. law when something goes wrong.
Key takeaways
- A virtual card number hides your real card number from the merchant. If it leaks, you delete it instead of replacing your card.
- Most virtual numbers come from credit card issuers, so they carry credit card protections: under federal law, you owe $0 when only your card number is stolen and misused.
- Debit cards have weaker rules: miss the reporting deadlines and you could lose up to $500, or more, and the money is gone from your account while the bank investigates.
- Apple Pay and Google Pay already hide your card number in stores and apps. Virtual numbers fill the gap on websites where you type card details.
- Use one number per merchant for subscriptions so you can cancel by deleting the number.
What is a virtual card number?
A virtual card number is a separate 16-digit number, with its own expiration date and security code, that your bank links to your existing card account. Charges made with it show up on your normal statement. The merchant never sees the number on your plastic card.
Issuers build them in a few different ways:
- Merchant-locked numbers. The number works only at the first store that charges it. If that store's database leaks, the number is useless anywhere else.
- Single-use numbers. The number works for one purchase and then stops.
- Numbers with limits. Some issuers let you set a spending cap or an expiration date when you create the number.
- Wallet-managed numbers. Google's version, for eligible cards, fills a virtual number into checkout forms automatically. Depending on the issuer, that is either a separate number for each merchant or one virtual number with a different security code per merchant, according to Google Pay Help.
The point is the same in every case. The number you hand to a website is one you can switch off, while the real one stays out of reach.
Why use one if your card already has fraud protection?
Fraud protection gets your money back after the fact. A virtual number reduces how often you need it, and how much hassle it causes when you do.
When a stolen card number gets used, the usual fix is to cancel the card and wait for a new one. Then you update every subscription, utility, app store and streaming service that had the old number. With a merchant-locked virtual number, a breach at one store means deleting one number. Everything else keeps working.
Card payments are also where most payment-related fraud reports start. In its Consumer Sentinel Network Data Book for 2024, the Federal Trade Commission said credit cards were the payment method people named most often in fraud reports. The FTC's March 2026 testimony to Congress put total reported fraud losses for 2025 at $15.9 billion, up from over $12 billion the year before (FTC).
High report counts for cards don't mean cards are the riskiest way to pay. In the same data, the biggest dollar losses came from bank transfers and cryptocurrency, which are much harder to reverse. Cards show up often partly because people can dispute them, so they notice and report.
Credit, debit, virtual or wallet: what actually protects you?
The table below compares the main ways to pay online. The federal rules come from the FTC and the Consumer Financial Protection Bureau (CFPB); your card network and issuer may offer more on top.
| Payment method | Your liability for fraud (U.S. federal law) | Disputes | What the merchant sees |
|---|---|---|---|
| Credit card | $0 if only the number was stolen; at most $50 if the card itself was lost or stolen and used before you reported it | Written dispute within 60 days of the statement; you don't have to pay the disputed amount while it's investigated | Your real card number |
| Debit card | Number misused, card still in hand: $0 if you report within 60 days of the statement. Card lost or stolen: $0 before any misuse, up to $50 if reported within 2 business days, up to $500 after that, possibly unlimited after 60 days | Bank generally has 10 business days to investigate (20 for new accounts), then usually must provisionally credit you if it needs longer; up to 45 days (90 for some debit purchases) | Your real card number, which is tied to your checking account |
| Virtual card number (on a credit card) | Same as the credit card it is linked to | Same as the linked credit card | A separate number you can lock or delete |
| Apple Pay or Google Pay | Same as the card loaded in the wallet (credit or debit) | Same as the underlying card | A device-specific token, not your card number |
Sources: FTC: lost or stolen credit, ATM and debit cards; CFPB: how to fix mistakes on your credit bill; CFPB: unauthorized transactions from a bank account. As of November 2026.
Two details matter most. First, with a debit card, the stolen money comes out of your checking account right away, and you wait for the bank to put it back. With a credit card, it's the bank's money in dispute, not yours. Second, the debit card clock is strict. Even when only your number was misused, the FTC says you are protected only if you report within 60 days after your statement is sent, and a lost card reported late can cost you everything taken from the account. Read your statements, or turn on transaction alerts.
That is why most people are better off creating virtual numbers on a credit card. Capital One, for example, says its virtual cards are not available for debit cards (Capital One).
How to get a virtual card number
Where to look depends on who issued your card. Not every card qualifies, so check before you plan around it.
Through your card issuer's app or website
Several large U.S. issuers offer virtual numbers on some of their credit cards. Search your issuer's app or online account for "virtual card" or "virtual account number." If nothing shows up, call the number on the back of your card and ask.
One recent change: Capital One shut down its Eno browser extension, which many people used to create virtual numbers. Capital One said the extension would be unavailable as of September 30, 2026. Existing Eno numbers keep working until they expire, and customers can still create merchant-specific virtual cards in the Capital One app or website, or through Chrome autofill (Capital One).
Through Google Wallet and Chrome
If your card is eligible, Google can fill a virtual number into checkout forms in Chrome on a computer, on Android, and in some Android apps. Google says the feature is limited to select banks and networks in select countries (Google Pay Help).
- In Chrome, type chrome://settings/payments in the address bar.
- Make sure Save and fill payment methods is turned on.
- Find your saved card, or click Add next to Payment methods to save one.
- Click More (three dots) next to the card, then Turn on virtual card. If you don't see that option, your card isn't eligible.
- Read the terms and click Yes. At checkout, Chrome now offers the virtual card when you click into the card number field.
- To use the website instead, sign in at wallet.google.com, open Payment methods, select the card and click Turn on.
One limit to know: Capital One says this Chrome method does not yet work for its cards in Chrome on iPhone or iPad. On those devices, use your issuer's app or Apple Pay instead.
What about Apple Pay?
Apple Pay doesn't give you a number to type, but it does a similar job automatically. When you add a card, your iPhone gets a device-specific Device Account Number. According to Apple, neither Apple nor your device sends your actual card number to the merchant, in stores or online, and each payment carries a one-time security code. Google Pay works on the same tokenization principle in stores. If a website offers an Apple Pay or Google Pay button, using it keeps your real number away from that site.
How to use virtual numbers for subscriptions and one-off shops
A simple system covers most people:
- One merchant-locked number per subscription. Name each number after the service (for example, "streaming" or "gym"). When you want to quit, cancel properly with the company first, then delete or lock the number so any later charge is declined.
- A single-use or low-limit number for small or unfamiliar stores. If you are not sure about a shop, this is where a virtual number earns its keep. Before you buy anywhere new, run through the checks in our passwords, 2FA and account security guide and make sure your card account itself is protected.
- A wallet button where one is offered. Apple Pay or Google Pay at checkout gives you a token without any setup.
- Your real card only where a virtual one causes trouble. See the next section.
Label each number in the issuer's app or your password manager, so a mystery charge tells you where it came from.
What to do if a virtual card doesn't work
Virtual numbers are designed for online checkout, so a few situations trip them up:
- Hotels, car rentals and anything that needs the physical card. These businesses often place holds, adjust the final charge, or ask to see the card at the counter. If the number on the card doesn't match the one you booked with, you may get stuck. Use your real credit card for these.
- Returns at a physical store. A refund usually has to go back to the number you paid with. If you deleted it, ask your issuer how it handles refunds to closed virtual numbers; it can take longer to sort out. Keep the number active until any return window closes.
- Card declined at checkout. Check whether the number is locked to a different merchant, has expired, or has hit its spending limit. Some stores process payments through a parent company or a payment processor, which can make a merchant-locked number look like it belongs to someone else.
- Subscription renewed after you deleted the number. The charge should be declined. If one goes through anyway, dispute it with your issuer and keep the cancellation confirmation from the merchant.
If a charge you didn't make shows up
Act fast, whichever card was used. Lock or delete the virtual number in your issuer's app first, so nothing else gets through.
For a credit card, contact the issuer and follow up in writing. The CFPB says you must send a written billing error notice within 60 days after the charge appears on your statement (CFPB). The issuer then has 30 days to acknowledge it and two more billing cycles to finish its investigation. You don't have to pay the disputed amount or related charges in the meantime, but keep paying the rest of your bill (CFPB).
For a debit card, call the bank the same day and confirm in writing. The CFPB says the bank generally has 10 business days to investigate, and if it needs longer, it usually has to put the disputed money back in your account while it finishes (CFPB). Report suspected scams to the FTC at reportfraud.ftc.gov as well. Our family tech safety guide covers how to help a parent or teen do the same.
When a virtual card isn't the right move
Virtual numbers protect against one specific problem: a card number leaking from a merchant. They don't help with these:
- Scams where you approve the payment. If someone convinces you to pay a fake store, a virtual number still sends the money. Your dispute rights are what help there, not the number.
- Account takeovers. If a criminal gets into your bank or card account, they can create virtual numbers too. Protect the account with a strong password, two-factor authentication or a passkey.
- Tracking and data collection. The merchant still gets your name, email address and shipping address. For that side of privacy, see our privacy settings guide.
- Debit-only households. If you don't have a credit card, virtual options are fewer. Phone wallets still hide your debit card number, and transaction alerts help you catch problems inside the 60-day window.
There is also a small upkeep cost. More numbers means more to track, and an expired number can quietly cancel a subscription you meant to keep. Set labels and check expiration dates when you make each one.
Frequently asked questions
Are virtual card numbers safer than my real card?
For online shopping, yes, in one specific way: if a store leaks the number, you delete it instead of replacing your card. The legal protections are the same as the card it is linked to, so a virtual number on a credit card gives you credit card dispute rights. It does not protect you from scams where you willingly approve the payment.
Do virtual card numbers work for subscriptions?
Usually, and they are especially useful there. Use a separate merchant-locked number for each subscription so you can stop future charges by deleting it, after you have canceled with the company. Single-use numbers won't work for recurring charges, so pick a reusable type.
Is Apple Pay or Google Pay safer than typing my card number?
For hiding your card number, yes. Apple says the merchant receives a device-specific number and a one-time code instead of your real card number. Your fraud and dispute rights still depend on whether the card in the wallet is a credit or debit card.
Can I get a virtual number for a debit card?
Sometimes, but it is less common. Capital One, for example, says its virtual cards are not available for debit cards. Phone wallets still tokenize debit cards, which is the easiest alternative.
Does using a virtual card affect my credit score?
No new account is opened. A virtual number is linked to your existing credit card, so purchases count toward that card's balance and are reported the same way as any other purchase on it.
Sources
- FTC: Lost or stolen credit, ATM, and debit cards (accessed October 2026)
- CFPB: Disputing a charge on your credit card bill (accessed October 2026)
- CFPB: How to fix mistakes on your credit bill (guide) (accessed October 2026)
- CFPB: Getting money back after an unauthorized transaction from your bank account (Regulation E rules) (accessed October 2026)
- FTC: Consumer Sentinel Network Data Book 2024 (accessed October 2026)
- FTC: Testimony to the Joint Economic Committee on fraud (March 2026) (accessed October 2026)
- Google Pay Help: Use virtual card numbers to pay online or in apps (accessed October 2026)
- Apple Support: Apple Pay security and privacy overview (accessed October 2026)
- Capital One: Eno browser extension discontinued (accessed October 2026)
Top image: "Working on laptop with credit card in hand at bright home office in the afternoon" by Shixart1985, CC BY 2.0, via Wikimedia Commons (resized). Charts and tables by Thank You Robot.
0 Comments