5 Things You Should Know About Virtual Credit Cards

When you make a purchase from a big online merchant like Amazon, you can feel pretty confident that the company isn't going to abuse your card number. But when the merchant is very new or has a tiny online presence, that purchase comes with a certain risk. The merchant has your billing address as well as your card number, expiration date, and security code. That's everything an unscrupulous merchant needs to charge a Caribbean vacation on your card.

Yes, it's true that you're not liable for unauthorized charges, but until you get the charges reversed your account may not have enough credit for other, valid purchases. By paying with a virtual credit card number, you can shop safely even when the merchant is iffy.

What Is a Virtual Credit Card? A virtual credit card number is a randomly-generated card number associated with your actual credit card. Depending on the issuer, you may be able to set a maximum charge for the virtual number, further protecting your transaction. And typically you can set it to expire in anywhere up to a year from its creation date. To the online merchant, it looks no different from any other credit card. The charges appear on your regular bill, but the merchant doesn't have your actual credit card number.

Where Can I Get a Virtual Credit Card? Bank of America offers the ShopSafe service to any Visa or MasterCard holder who also uses online banking. With ShopSafe you can set a maximum credit limit and configure the card's expiration. Citibank's similar Virtual Account Number service also lets you set a credit limit and expiry date, and it includes an optional Windows-specific application that can automatically fill in credit card details. MasterCard owns has its own virtual credit card service, but the issuer can choose whether or not to actually offer the service. Check with the issuer of your credit card to see whether this service is available.

Where Can't I Get One? A number of other credit issuers have provided virtual credit cards in the past, but no longer. Discover halted such a service earlier this year when MasterCard bought the company supplying their technology. American Express offered "Private Payment" from 2000 to 2004. PayPal's Virtual Debit Card system, which had the added bonus of letting you easily pay with PayPal even on sites that don't support it, ended in 2010.

My Bank Doesn't Offer Virtual Credit Cards. Now What? Boston-based Abine offers a product called MaskMe. The basic free edition creates disposable email addresses to foil spammers, and includes basic password management. For $5 per month you can upgrade to Premium, which gets you the ability to generate virtual credit card numbers even when your card issuer doesn't have native support. A similar service called Shop Shield seems to have fallen by the wayside when the company re-invented itself to offer business-oriented password management. If you manage to get your hands on an Apple Watch or iPhone 6, you'll have the option to use Apple Pay at stores that support it. While not precisely the same as a virtual credit card, Apple Pay serves the same purpose, letting you pay without giving the merchant a credit card number.

Are There Any Downsides to Virtual Credit Cards? The biggest negative for virtual credit card numbers is that they only work online. You can't use a virtual credit card in a situation where you'd swipe a physical card. Also, returns can be problematic if the virtual card you used has expired; you might have to take store credit. And, of course, a crooked merchant can take your payment without shipping your purchase. Even though you used a virtual card number, you'd have to dispute that charge. Still, virtual credit card numbers can serve as a nice buffer between your actual credit card details and online merchants.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio