The problem they address
A normal card number is a long-lived credential. Anyone who has the number, expiry date and security code can usually try to use it, wherever those details are accepted. Every shop that stores your card becomes one more place that could be attacked, and if one of them suffers a data breach, the stolen details may be tried elsewhere.
Stand-in numbers aim to change that. The idea is that the thing a merchant holds is not your real card number, or is a number that works only in limited ways, so a leak costs less.
There are two related techniques, and the terms are sometimes mixed up: virtual card numbers and tokenization.
Virtual card numbers
A virtual card number is a separate, generated card number linked to your real account. You request one from your bank, card issuer or a privacy-focused service, and use it at checkout instead of your main number. Payments made with it are billed to your underlying account, but the merchant never sees the real number.
Depending on the provider, a virtual number can be:
- Single use, valid for one transaction and then dead.
- Merchant-locked, accepted only by the first merchant that uses it or by one you choose.
- Limited by amount, with a spending cap that matches what you expect to pay.
- Time-limited, expiring after a date.
- Easy to cancel, so you can switch one off without affecting your main card.
Not every issuer offers all of these, and availability varies by country and provider. Features that exist at one bank may not exist at another.
Tokenization
Tokenization is the replacement of a sensitive value with a stand-in, called a token, which is useless on its own. A separate, secured system keeps the mapping between token and real value.
In card payments, tokens are used in several places:
- Mobile wallets. When you add a card to a phone, the system issues a token tied to that device, so the shop’s terminal never receives your real number. How this works at the till is covered in the article on mobile wallets.
- Merchants and payment providers. A shop that uses a payment provider often stores only a token for your saved card. The provider holds the real data and can charge it for the merchant, which means the shop’s own systems contain nothing directly valuable to a thief.
- Card-on-file arrangements. Networks may issue tokens to merchants for stored cards, as used in subscription billing, so that a leaked token cannot easily be used somewhere else.
The core principle is the same as with virtual numbers: the value circulating in less-protected places is not the real credential.
Virtual number versus token
The difference is mostly who creates and controls it and what you see.
| Virtual card number | Token | |
|---|---|---|
| Typically created by | You, on request, in your bank or card app | The system, automatically, when you add a card to a wallet or merchant |
| Visible to you | Yes, you copy and paste it | Often invisible |
| Control | You can set limits and cancel | Managed by the network, issuer or provider |
| Main use | Online checkouts | Wallets, saved cards, recurring billing |
Both aim to ensure that a stolen stand-in is much less useful than a stolen real number.
What they do and do not protect
They help against:
- A merchant’s breach. If the shop is compromised, the number taken may be single use, locked to that merchant, or tied to a device.
- Unauthorised charges after a free trial or forgotten subscription, since you can cancel the number or set a cap.
- Overly eager card storage. You can use a stand-in without leaving your main number in yet another database.
They do not help against:
- Being tricked into paying a fake shop. If you approve a payment to a fraudster, a virtual number does not know the difference, although a single-use number at least cannot be reused later. Phishing scams still work on the human.
- Malware on your device that captures what you see or type.
- Merchant dishonesty, such as delivering the wrong item. Dispute rules still depend on the underlying card and your issuer.
- Leaks of other personal data such as your name, address and email, which the shop still receives.
Practical trade-offs
- Refunds. If you return something, the refund goes to the virtual number. If a single-use number has been closed, the refund may fail or be handled manually, so keep the number active until the return is complete, where the provider allows it.
- Subscriptions. A single-use number will not work for repeat charges. For recurring billing, use a merchant-locked number that stays open, and be sure the cap covers the real price.
- Hotels, car rental and deposits. These businesses may place holds or need the same card at pickup. Matching the card to the booking can matter, so a virtual number may cause difficulties.
- Disputes and evidence. Keep receipts, since the number on your statement may look unfamiliar.
- Record keeping. If you create many numbers, keep notes on which is used where. A password manager can store them securely.
- Fraud checks. Occasionally, a bank’s or merchant’s fraud system treats an unfamiliar number cautiously, and extra verification may appear.
Getting started
Check your banking or card app for a feature called something like virtual card, disposable card or temporary card. Try it on a low-risk purchase first, and read how your provider handles refunds. Stand-in numbers are a layer of protection, not a replacement for caution, but they can reduce what is at stake when a shop you barely know holds your details.