If you’ve ever had a card number stolen from a merchant’s checkout page, you already understand the appeal of a virtual card number: a separate, disposable number for online purchases that isn’t your actual account number. If a merchant gets breached, the number that leaks isn’t the one on the physical card in your wallet.
This guide is a companion to our piece on what to do if someone uses your credit card without permission. Virtual numbers won’t undo fraud that’s already happened, but they meaningfully cut down how often it happens again.
What a Virtual Card Number Actually Is
A virtual card number is a substitute 16-digit number generated by your card issuer and tied to your real account. When you check out online, you use the virtual number instead of the number printed on your physical card. The purchase still bills to your account, still earns rewards, and still falls under the same fraud protections as a normal transaction. The difference is that the merchant never sees your actual card number.
Some issuers let you generate a number that’s locked to a single merchant, so even if that number is somehow intercepted or reused, it won’t work anywhere else. Others let you set spending limits or expiration dates on top of that.
Which Issuers Actually Offer This
Not every card, and not every issuer, supports true virtual card numbers. As of 2026, the landscape looks roughly like this:
Capital One (Eno)
Capital One’s virtual card tool is called Eno. It’s available as a browser extension (Chrome, Firefox, Edge, Safari) and through the Capital One mobile app. Once you register a card with Eno, it can generate a merchant-locked virtual number at checkout with a single click, and you can view, lock, unlock, or delete those numbers from your dashboard. Not every Capital One card is eligible, so it’s worth checking your specific card’s terms.
Citi (Virtual Account Numbers)
Several Citi consumer cards support Virtual Account Numbers, generated from your online Citi account rather than a browser extension. You select the card, generate a number, and optionally set a spending limit and expiration date before using it. Coverage varies by card, and it isn’t available on every Citi product.
American Express
Amex doesn’t offer a traditional virtual card number the way Capital One and Citi do. Instead, it supports Click to Pay, a tokenization system built jointly by Visa, Mastercard, Amex, and Discover that shields your real number at checkout on participating merchant sites. Some Amex cards also offer an instant card number for new accounts, letting you shop online before your physical card arrives, which is a different feature from an ongoing virtual number.
Bank of America (ShopSafe)
Bank of America’s ShopSafe tool generates single-use or multi-use virtual numbers through its website or app, with adjustable spending limits. Numbers expire automatically once their intended use is complete.
Everyone Else (Click to Pay and Digital Wallets)
If your issuer doesn’t offer a dedicated virtual card tool, Click to Pay, Apple Pay, Google Pay, and similar digital wallets all use tokenization to avoid exposing your actual card number to merchants during checkout, even though they’re not marketed as “virtual card numbers” in the traditional sense.
(We’ll expand this into a full issuer-by-issuer comparison table with screenshots and step-by-step setup instructions.)
When a Virtual Card Number Is Actually Worth Using
- New or unfamiliar merchants. If you’re buying from a site you’ve never used before, a merchant-locked virtual number limits your exposure if that checkout page turns out to be poorly secured.
- Free trials and subscriptions. Setting a spending limit or expiration date on a virtual number is a clean way to avoid the classic “forgot to cancel the trial” surprise charge.
- Any purchase where you’re even slightly unsure about a merchant’s security. If the site looks dated, doesn’t use HTTPS properly, or you just have a bad feeling about it, a virtual number contains the damage if something goes wrong.
When It Doesn’t Matter As Much
Virtual numbers protect you from merchant-side breaches and skimming at checkout. They don’t do much for card-present fraud (a stolen physical card), phishing scams where you’re tricked into handing over your real number directly, or account takeover through a compromised login. Real-time purchase alerts and strong account passwords still matter regardless of whether you use a virtual number.
FAQ
Do virtual card numbers earn the same rewards as my regular card? Yes. The transaction still posts to your actual account, so points, miles, or cash back accrue normally.
What happens if I need to return something bought with a virtual number? Keep the receipt and transaction details. Refunds typically route back to the linked account even after the virtual number itself expires, but policies vary by issuer, so check your card’s terms.
Can a merchant charge my virtual number again later, like for a subscription? If the number is merchant-locked and set for repeat use, yes. If it’s single-use or has an expiration date you set, the charge will likely be declined once that number is no longer valid, which is useful for controlling recurring charges you want to cap.
Is a virtual card number the same as a prepaid card? No. A virtual card number is tied directly to your existing credit card account and credit line. A prepaid card is a separate, funded balance.
This article is for general informational purposes and isn’t financial advice. Feature availability varies by issuer and card, and terms may change; check your card’s current benefits guide for details.