You can get a virtual credit card number through your existing credit card issuer, a digital bank, or a third-party service. The fastest route depends on whether you already hold a card with a bank that offers the feature. Capital One, Citi, and American Express all let cardholders generate virtual numbers at no extra cost, and standalone services like Privacy.com and Cloaked let you create virtual cards linked to a debit card or bank account even without a traditional credit card.
What a Virtual Card Number Actually Does
A virtual credit card number is a randomly generated card number tied to your real account but different from the number printed on your physical card. When you use it to pay online, the merchant never sees your actual card details. If that merchant later suffers a data breach, the exposed number is either locked to that one store or already expired, so your real account stays safe.
Most virtual numbers come with controls you don’t get from a physical card. Depending on the provider, you can lock a number to a single merchant, set a spending cap, make it single-use so it dies after one transaction, or pause and delete it whenever you want.
Through Your Current Credit Card Issuer
If you already carry a card from one of the major issuers below, you can generate virtual numbers without signing up for anything new.
- Capital One (Eno): Install the Eno browser extension, then visit any online checkout. Eno will offer to create a merchant-specific virtual number on the spot. Each number is locked to the merchant where you first use it, and you can lock, unlock, or delete numbers at any time from the Eno dashboard. The service is free for all Capital One cardholders. One limitation: you cannot set a custom spending limit on individual virtual numbers.
- Citi: Eligible Citi cardholders, including those with the Citi Double Cash card, can enroll in virtual card numbers directly on Citi’s website. You can create single-use or multi-use numbers and manage them from a dashboard. Each virtual number inherits your physical card’s overall credit limit, and Citi lets you set a daily spend cap or a total spend cap per virtual number.
- American Express: Amex lets you generate a unique card number for every transaction, with a distinct security code each time. You can tailor a virtual number to a specific merchant and set individual spending limits. You need an existing Amex card to use the feature.
To check whether your card supports virtual numbers, log in to your issuer’s website or app and look for a “virtual card” or “virtual account number” option in your card management settings. Not every card from these issuers is eligible, so if you don’t see the option, contact customer service to confirm.
Through a Third-Party Service
If your bank doesn’t offer virtual numbers, or if you want more granular control, standalone services fill the gap. These typically connect to your debit card or bank account and generate virtual Visa or Mastercard numbers you can use anywhere those networks are accepted.
- Privacy.com: One of the most popular options. You link a bank account or debit card, then create virtual cards with per-merchant locks, spending limits, and single-use or recurring settings. A free tier covers basic use, with paid plans adding more cards and features.
- Cloaked: Goes beyond cards to also generate disposable email addresses and phone numbers. You fund a wallet, then assign a specific balance to each virtual card identity. For example, you could load $50 onto a card designated for a streaming service, and it will decline any charge above that amount. Cloaked also includes a password manager and client-side encryption.
- Revolut: Offers physical, virtual, and disposable cards through its app. You can set spending limits and freeze any card instantly. The free plan has some restrictions on foreign currency transactions, and weekend exchange rates carry a small markup. Revolut also includes AI-based scam detection that flags suspicious charges.
Setup for most third-party services takes under ten minutes. You’ll create an account, verify your identity, link a funding source, and start generating numbers immediately.
How Mobile Wallets Handle Virtual Numbers
When you add a card to Apple Pay, Google Pay, or Samsung Pay, your phone doesn’t store or transmit your actual card number. Instead, it creates a device-specific token, essentially a virtual stand-in. Every transaction uses a one-time dynamic security code, so even if a payment terminal is compromised, the intercepted data is worthless.
This means the last four digits shown on your mobile wallet receipt may not match the digits on your physical card. If you ever need to reference the number your wallet used (for a refund, for instance), you can find it in your wallet app’s card details. On an iPhone, open Wallet, select the card, tap the three-dot menu, and choose “Card Number” to see the masked number Apple uses for transactions.
Mobile wallets protect in-store and in-app purchases automatically, but they don’t give you the merchant-locking or spending-limit features that dedicated virtual card tools offer. If your main goal is controlling online subscriptions or limiting exposure on a specific site, a purpose-built virtual card is more useful.
Where Virtual Cards Can Cause Problems
Virtual numbers work seamlessly for most online purchases, but a few situations trip people up.
Hotels and car rentals are the biggest friction point. These merchants place a hold (a pre-authorization) on your card at check-in, then process the final charge days later at checkout. If you used a single-use virtual number, it may have already expired by checkout, causing the final charge to decline. Hotels that accept virtual card bookings through travel agencies typically keep the guest’s physical card on file for incidentals like minibar charges or parking, but the room charge itself runs against the virtual number. If something goes wrong, the hotel contacts the travel company to resolve it rather than charging you twice.
Refunds can also get confusing. If you return an item purchased with a virtual number you’ve since deleted, the refund still needs somewhere to go. Most issuers and third-party services can process refunds to closed virtual numbers by routing the credit back to your underlying account, but it may take longer than a standard refund. Capital One’s Eno, for example, routes refunds to the original account even after a virtual number is deleted. If a merchant asks you to provide the card number for a return, keep a record of your virtual numbers or check your provider’s dashboard for the history.
Subscription services deserve extra attention. If you use a single-use virtual number for a free trial, the next billing cycle will fail, which is great if your goal was to avoid unwanted charges. But if you actually want to keep the subscription, use a merchant-locked multi-use number instead, and make sure the spending limit is high enough to cover recurring charges plus any price increases.
Choosing the Right Approach
Your best option depends on what you’re trying to accomplish. If you already hold a Capital One, Citi, or Amex card, start with your issuer’s built-in tool. There’s no extra cost, no new account to manage, and your rewards and purchase protections still apply because the charge flows through your real credit card account.
If your issuer doesn’t support virtual numbers, or if you want features like per-card spending caps and disposable identities, a third-party service like Privacy.com or Cloaked gives you more control. Keep in mind that these services typically link to a debit card or bank account, so the charge won’t earn credit card rewards unless the service explicitly supports credit card funding (most don’t, to avoid cash-advance fees).
For everyday contactless payments at physical stores, your phone’s mobile wallet already provides tokenized security without any extra setup. The real value of a dedicated virtual card number is for online shopping, free trials, and any situation where you want to limit how much a merchant can charge or cut off access to your payment method on your terms.