What Is a Virtual Card? How It Works, Types and When to Use One

A virtual card is a payment card that exists only as a number — a 16-digit card number, expiry date and security code issued inside an app, with no plastic attached. It spends from a real account exactly like a physical card, but you can create it in seconds, freeze it instantly, and delete it without touching anything else you own.

How a virtual card works

When a provider issues you a virtual card, it generates a unique card number on the Visa or Mastercard network, linked to your account balance or credit line. Online, you type the number into a checkout just like a physical card. In stores, most virtual cards can be added to Apple Pay or Google Pay, where the phone presents a tokenised version of the card for contactless payment — the merchant never sees the underlying number at all. Behind the scenes the transaction is authorised, converted if needed, and settled exactly like any card payment.

The difference is control. A physical card number is fixed for years and printed on plastic that can be photographed, skimmed or stolen. A virtual card number costs the provider nothing to replace, so issuers let you create, pause, cap and destroy numbers freely. That single fact generates most of the useful patterns below.

The four types of virtual card

1. Standard virtual cards

A persistent number tied to your account — the digital twin of a physical card. This is what Wise, Revolut, KAST and most providers issue by default, for subscriptions and everyday online spending.

2. Disposable (single-use) cards

The number self-destructs after one transaction and is replaced automatically. Revolut popularised the pattern. If the merchant is breached a week later, the stolen number is already dead. Useless for subscriptions, perfect for one-off purchases from sites you do not fully trust.

3. Merchant-locked cards

Privacy.com's speciality: the number only works at one named merchant. A card created for Netflix declines everywhere else, so it cannot be reused by anyone who steals it — and the merchant cannot charge a different card's worth of surprises to it either.

4. Single-load prepaid cards

You load a fixed amount once; the card cannot be reloaded (Zypto and Laso sell versions of these). They suit a specific planned purchase and are often sold with lighter verification, balanced by strict limits and expiry rules.

Virtual vs physical: what you gain and lose

You gain instant issuance (seconds, not a week in the post), granular control (per-card limits, freezes and merchant locks), and isolation — one compromised number never endangers the rest of your money. You lose ATM access (most virtual cards cannot withdraw cash, and those linked to phone wallets still cannot use most ATMs), some in-person acceptance where a physical card must be presented (hotel deposits and car rentals are the classic friction points), and, on a few providers, a card that exists at all if your phone dies. The practical answer for most people is both: a virtual card for the internet, a physical card for the physical world, drawn on the same account.

Where virtual cards are accepted

Anywhere the card's network is accepted online — which is to say, nearly everywhere. A few categories push back: some merchants reject prepaid BINs (common with crypto-funded and single-load cards), some subscription services demand a card from your own country, and gambling, adult and certain financial services restrict prepaid or foreign-issued cards. If a virtual card is declined, the cause is usually one of those policies, insufficient funds including the provider's conversion buffer, or a 3D Secure challenge that was not completed.

Who issues virtual cards?

Three families dominate our 128-platform dataset. Fintech accounts (Wise, Revolut, Payoneer) issue cards against fiat balances and excel at currency conversion. Crypto platforms (KAST, Coinbase, Binance, MetaMask) issue cards against crypto or stablecoin balances and excel at turning digital assets into spending. Specialists (Privacy.com for security, PSTNET for ad-buying teams, Zypto for high-limit prepaid) optimise one job rather than the whole wallet. Choosing a family first, then a provider, is the fastest route through the comparison table on our homepage.

Frequently asked questions