Virtual Card Numbers: Your Free Defense Against Card Fraud

Last November, Jordan typed his debit card number into a checkout page to buy a $58 space heater from a store he'd never used before. The heater showed up, worked fine, and he forgot about it. Then on a Tuesday in February, a $740 charge from an electronics outlet two states away cleared on that same card, along with a smaller test charge he nearly missed. His bank refunded the money and mailed a replacement, but for nine days he had no working card, and two automatic bills bounced in the gap.

Jordan didn't do anything careless, and that's the uncomfortable part. He didn't click a shady link or read his number to a fake caller. He typed his real card number into an ordinary store, and that store's server got breached months later. A virtual card number would have turned the whole episode into a shrug.

The timing is not in your favor. Americans reported a record $15.9 billion lost to fraud in 2025, up from $12.5 billion the year before, according to the Federal Trade Commission, and credit cards were the payment method named most often in those reports. The Identity Theft Resource Center, meanwhile, counted 3,322 data breaches in 2025, the most it has recorded in a single year. Your card number is stored in dozens of merchant databases right now, and you have no say in how carefully any of them guard it.

What a virtual card number is

A virtual card number is a stand-in for your real card. It's a full 16-digit number, with its own expiration date and security code, that routes charges to your actual account but shows the merchant something disposable. You generate one in your bank's app or a browser extension, paste it into the checkout, and the store never sees the digits printed on your physical card.

Think of it like a hotel keycard. It opens your room for the length of your stay, and once you check out, it's a useless piece of plastic. Drop it in the parking lot and nobody can use it to get into your actual house. A virtual number does the same job for your bank account. If the merchant holding it gets breached, the thieves walk away with a key to a door you already locked.

Most virtual numbers can be capped with a spending limit, paused, or deleted whenever you want. Some lock themselves to the first store that uses them, so even a live, stolen number is worthless anywhere else.

Why the exposure isn't really your fault

The instinct after a fraudulent charge is to assume you slipped up somewhere. Usually you didn't. The weak link is almost never your kitchen table. It's a company's server.

The ITRC found that financial services was the single most breached industry in 2025, with 739 separate compromises, ahead of healthcare and professional services. These are exactly the businesses that keep your card on file for one-click reordering and autopay. You can use strong passwords and a password manager and still land in a breach notification letter because a retailer you bought from once got hit.

A virtual number closes exactly that gap, and it's worth being honest about what it doesn't close. A virtual card protects you when a merchant's database leaks or a checkout page gets skimmed. It does nothing when a convincing caller talks you into reading a number aloud, because at that point you're handing over whatever number you happen to be using. Impostor scams, the fake-bank texts and the "we noticed suspicious activity" calls, still drive the largest slice of fraud dollars. A virtual number is armor against the breach you can't see, not against the scam that talks you into cooperating.

Where to get one in 2026

Fewer banks offer this than a few years ago, and the ones that still do have gotten stingier about it. Discover dropped its virtual numbers in favor of a card-freeze toggle. Chase never rolled out a permanent version. Bank of America's old ShopSafe tool shut down back in 2019. Among the big issuers, the feature has narrowed to essentially two, plus one independent service worth knowing about.

Capital One (Eno)

If you carry a Capital One card, Eno is the smoothest option. You add the Eno browser extension, and when you land on a checkout page it offers to create a virtual number tied to that specific merchant. You can lock, unlock, or delete each number from the app. Because the number is merchant-locked, a thief who lifts it from one store can't spend it anywhere else. It's free, and it's the closest thing to set-and-forget on this list.

Citi

Citi still offers virtual account numbers, but the version live today is a shadow of the one longtime users remember. Citi reworked the system in August 2025, and every number created before the change stopped working. New numbers now carry a minimum daily spending limit of $25 that you cannot lower, an expiration date fixed at three years out, and a security code that changes each time you view it online. Still useful for a one-off purchase at a store you don't trust. Just no longer the flexible tool it once was.

Privacy.com and the debit trade-off

If your bank offers nothing, a service called Privacy.com fills the gap. You link a bank account or debit card, and it generates virtual cards you can lock to a single merchant, cap with a spending limit, or close in one tap. The personal plan is free for up to 12 new cards a month.

There's a real trade-off, though. Privacy pulls funds straight from your bank account, so those charges behave like debit rather than credit. You give up the stronger dispute rights a credit card carries under the Fair Credit Billing Act, and you earn no rewards. For low-trust sites and free trials, that swap is often worth it. For a big-ticket purchase you'd want the muscle to dispute if it went sideways, your real credit card is the safer home.

The second job: shutting off a subscription you can't cancel

There's a use for virtual numbers that has nothing to do with hackers. It's the free trial that quietly rolls into a $19.99 monthly charge, and the subscription with a cancel button buried four menus deep or parked behind a phone call you can only make during business hours.

You might have expected some help here from regulators. The FTC's Click-to-Cancel rule would have forced companies to make quitting as easy as signing up, but a federal appeals court threw it out in July 2025, days before it was set to take effect, on procedural grounds. The FTC restarted the process in January 2026, so a new version may arrive eventually. For now, no federal rule guarantees you a clean exit.

A virtual number is your own homemade version of that rule. Sign up for the trial with a merchant-locked card or one carrying a tight spending limit, and when you want out, close or freeze the number. The next charge simply fails. You still cancel through the company the normal way, but you're no longer at the mercy of a cancellation maze to stop the money from leaving.

One caution here. If a store needs to refund you, the money has to travel back to the number you paid with. Don't delete a virtual card the second a purchase clears if a return might be coming. Wait until you're sure the transaction has settled and no refund is pending.

Where virtual numbers fall short

They're built for typing into a website, and that's about the extent of it. Tap-to-pay and the wallet apps on your phone already swap your real number for a token at the register, so a virtual number adds nothing to a purchase you make in person.

Anywhere your physical card has to match the number on file, a virtual card breaks. Hotels and rental counters that authorize the card you present and then check it again at the desk. Gas pumps. Concert tickets you buy online but collect at will-call with the physical card. In those situations the virtual number and the plastic in your wallet disagree, and the charge gets declined.

And to say it plainly one more time, because it's the most common misunderstanding: a virtual number is not a shield against a scam that convinces you to pay. It protects the number. Your own caution protects the rest. Pair the two and you've covered both halves of the problem.

The Bottom Line

A virtual card number is one of the rare security tools that's free, takes about ten minutes to set up, and then asks nothing of you. Given that your card lands in more breached databases every year, that's a strong return on a small effort. Three moves worth making this week:

1. Check what your own bank offers. If you have a Capital One card, install the Eno extension. If you bank with Citi, look for virtual account numbers in the app or on the website. If your bank offers neither, sign up for the free Privacy.com plan and link an account.

2. Use a fresh number for anything new or sketchy. Before your holiday shopping ramps up, get in the habit of generating a virtual number for first-time stores and flash-sale sites, and set a spending limit close to the purchase price so a stolen number can't run wild.

3. Put every free trial on a disposable number. Sign up with a merchant-locked or limited card, and when the trial ends, close the number so the auto-renewal has nothing to charge. Just let any refunds clear before you delete it.