Virtual Card Numbers: Single-Use Credentials for B2B and Beyond
Tokenization usually enters the payment-security conversation from the merchant side: replace the stored card number with a token so a breach yields nothing useful. Virtual card numbers are tokenization approached from the opposite direction, the issuer and buyer side. Instead of protecting a card number after it is given out, a virtual card number is a fresh, disposable card number generated for a specific use, often locked to one merchant, one amount, and a short validity window. If it leaks, it is already spent or already dead. VCNs have quietly become core infrastructure in corporate accounts payable and travel, and a sharp consumer privacy tool, by moving the control from guarding the number to limiting what any number can do.
Quick answer: A virtual card number is a surrogate card number generated from a real account, usually with built-in controls: a spending limit, a single merchant lock, and a short expiry. Because each VCN is restricted and often single-use, a stolen one has little or no exploitable value. VCNs are widely used in B2B accounts payable to control and reconcile supplier payments, and by consumers to limit exposure when paying unfamiliar or subscription merchants.
How do virtual card numbers differ from the tokens merchants use?
Both are surrogates for a real card, but they live on opposite ends of the transaction and solve different problems. The merchant-side tokens we cover elsewhere protect a card already in the merchant’s possession, so a breach of the merchant yields tokens, not PANs. A virtual card number is issued before the card is ever handed over, carrying spend controls baked in, so the merchant receives a number that was never worth much to steal in the first place.
| Dimension | Merchant token | Virtual card number |
|---|---|---|
| Who creates it | Merchant or their provider | Issuer or buyer’s platform |
| Purpose | Avoid storing the real PAN | Limit what any shared number can do |
| Controls | Usually none intrinsic; it just maps to the PAN | Amount, merchant, and time limits built in |
| On leak | Useless outside the merchant’s systems | Already spent, expired, or merchant-locked |
| Typical setting | Card-on-file, recurring billing | AP automation, one-off and risky purchases |
They are complementary, not competing: a merchant can store a VCN as a token, and a sophisticated payments program uses both ideas at once.
Why has B2B accounts payable adopted VCNs so heavily?
Corporate card spending has a control and reconciliation problem that VCNs solve almost perfectly:
- Spend control: finance issues a VCN for an exact amount to a specific supplier, so it cannot be over-charged or reused. A compromised supplier cannot run further charges on it.
- Reconciliation: because each VCN maps to a purchase order, invoice, or project, matching payments to records becomes near-automatic, removing the guesswork of shared corporate cards.
- Blast-radius limitation: the shift from a handful of widely shared corporate cards to thousands of single-purpose numbers means a leaked credential exposes one transaction, not the whole account. This is the same breach-containment logic our data protection comparison applies to stored data, expressed as issuance rather than storage.
- Fraud and misuse reduction: locked merchant and amount fields neutralize most of the misuse a stolen corporate number would otherwise enable, complementing the controls in our fraud metrics guide.
The result is that VCNs sit at the heart of modern AP automation platforms, where they double as a payment method and a control framework.
Where do VCNs help consumers?
Consumer-facing virtual cards, offered by some banks and fintech apps, apply the same idea to personal risk management:
- Subscription control: a per-merchant virtual card can be paused or killed to stop a subscription the merchant makes hard to cancel, sidestepping the retention tricks around the stored-credential billing we cover this month.
- Exposure limiting on unfamiliar sites: paying an untrusted or first-time merchant with a low-limit single-use number means a checkout compromise, including the skimming attacks that capture card data at entry, yields a number that is already useless.
- Privacy: using different numbers per merchant reduces cross-merchant tracking and limits the damage when one merchant is breached and its data reaches the resale markets.
What are the limits and failure modes?
VCNs are not a universal answer, and their constraints are the flip side of their controls:
- Card-present and recurring friction: a single-use number is poorly suited to in-store use or to legitimate recurring billing, where a stable credential is the point. Recurring VCNs exist but must be configured as such, or renewals fail the way mis-flagged stored credentials do.
- Refund and dispute complications: refunds to an expired or single-use VCN need handling, and matching a dispute to the right short-lived number requires good records, feeding back into the dispute process.
- Acceptance edge cases: some merchants’ pre-authorization or incremental-charge flows (hotels, fuel, car rental) clash with tight amount locks, declining legitimately.
- They protect the number, not the account: VCNs limit what a leaked number does; they do not defend the issuing platform or the login that generates them, which still needs the authentication rigor of our account takeover guide.
Frequently asked questions
Are virtual card numbers the same as tokenization?
They are a form of it, from the issuing side. Merchant tokens protect a stored card; virtual card numbers are disposable, control-bearing numbers issued before the card is shared. Both replace a real PAN with something less valuable to steal.
Can a stolen virtual card number be used by criminals?
Usually not meaningfully: single-use VCNs are spent or expired, and multi-use ones are commonly locked to one merchant and a spending cap, so a thief gains little. That containment is the entire point.
Why do finance teams prefer VCNs for supplier payments?
Exact-amount, single-supplier numbers give precise spend control, automatic reconciliation against purchase orders or invoices, and tiny blast radius if a supplier is breached. They turn a payment method into a control and bookkeeping system at once.
Can I use a virtual card for subscriptions?
Yes, and it adds a useful kill switch: pause or delete the card to end a subscription. Configure it as a recurring-capable virtual card rather than strictly single-use, or renewals will decline like any mis-handled stored credential.
Do virtual cards work in physical stores?
Often only when provisioned into a mobile wallet; a bare virtual number suits online and keyed payments best. Tight amount and merchant locks can also clash with pre-authorization flows at hotels, fuel pumps, and rental counters.
Virtual card numbers flip the central tokenization question from how do we guard this number to how little can this number do if it leaks. By pushing the control to issuance and baking in amount, merchant, and time limits, they make the stolen number a dead end, which is why both corporate finance and privacy-minded consumers increasingly reach for them.