Virtual account numbers have been around for years, but they’re being used more now in the wake of the massive Equifax hack.
Editor’s note: This article was updated on Sept. 5, 2019 to reflect Bank of America’s discontinuation of virtual credit card numbers.
Pick a number, any number. With a virtual credit card number, you get a randomly generated available credit card number that slashes your fraud risk when you make your payment.
The advantage for consumers? That virtual account number can reduce the damage that a fraudster can do – he or she gets access only to that number, not your credit card account. Issuers offering virtual card numbers let you set the parameters for their use, such as for a one-time use for an online purchase, for use with a particular retailer for any online purchases there or during a specific time period.
The disadvantage for some businesses? While consumers benefit from virtual credit cards, health care providers – doctors, dentists, hospitals and the like – lose money when insurers pay with virtual credit card numbers, which deduct the credit card transaction fees from the reimbursement. At least two states, Connecticut and Georgia, have passed legislation this year allowing medical professionals to refuse to accept payment by virtual credit cards.
The reason more people might want to use virtual credit cards? Recent data breaches, including the massive 2017 hack of around 148 million Equifax customers’ information, may have you wondering how you can protect your credit card and other personal information.
Virtual account numbers, available from card issuers including Citi and Capital One, are a way to safeguard your credit card account when shopping online.
“If you want to take control of your credit card accounts, you have it with virtual numbers,” Tom Poole, Capital One’s senior vice president of digital payments and identity, says. Capital One debuted its virtual numbers feature at SXSW 2018. Cardholders can designate a number for each online retailer they frequent, which would limit exposure to just that one retailer. “These are not burner numbers,” he said.
“With virtual account numbers, Citi is adding a layer of protection and security to online purchases,” says Citi spokeswoman Jennifer Bombardier.
How virtual account numbers reduce online fraud
The need to protect account information online is growing, as fraudsters have shifted their focus away from brick-and-mortar merchants in the wake of EMV chip card technology. Chip cards make it much harder for them to steal info from physical cards.
As a result, card-not-present fraud is now 81 percent more likely than point-of-sale fraud, according to Javelin Strategy & Research’s 2018 Identity Fraud Study. That is the greatest gap Javelin has observed.With Bank of America’s ShopSafe service, Bank of America Visa and Mastercard holders can “generate a temporary credit card number that links directly to your real credit card account.” However, Bank of America announced in September 2019 it planned to discontinue the service.
Citi’s website notes that Citi’s virtual account numbers give users peace of mind because “your actual card number is never revealed to merchants.” Plus, each number can be used with a single merchant, so it will be void if someone tries to use it elsewhere.
Charges made via a virtual account number will appear on your regular credit card statement.
Your liability as a cardholder for fraud whether using a traditional credit card or virtual account number is limited to $50, though most banks waive all liability in most cases.
Virtual account numbers also can be helpful for long-term subscription purchases. Using a virtual account number that expires quickly (or that you can turn off at will) can help prevent automatic renewals.
See related: 8 tips to keep your cards safe while shopping online
The drawbacks of virtual account numbers
Disadvantages of using a virtual account number include a few extra steps to the online checkout process. Users must log into their bank account (or, in some cases, their card app) to generate a new account number every time they want to use a virtual account number to make a purchase.
With virtual account numbers, payment information often can’t be saved at a retailer’s website. (If one-click shopping makes it easy to overspend, not having your payment information stored is actually an advantage.)
Using virtual account numbers to rent a car or to purchase theater seats, which require you to present a physical card at pickup, can also pose challenges. In these cases, you can still make the payment with a virtual card, but be sure to have a driver’s license at the rental car counter or will-call window.
Finally, while virtual account numbers could protect your credit card account from getting hacked from retailers from which you make online purchases (or purchases made via phone), it doesn’t completely eliminate the potential for criminals to get their hands on other personal information, such as your address or the password you use for the website.
They also don’t work at brick-and-mortar stores, where your best bet is still to use an EMV-equipped card for purchases.
“Consumers should understand that while virtual account numbers help create a buffer between hackers and cardholder data, they’re not a silver bullet against all credit card fraud,” says Monica Eaton-Cardone, co-founder and chief operating officer of Chargebacks911.
Eaton-Cardone says that even with virtual account numbers, vendors can apply fraudulent charges or take a payment and never ship the merchandise, both of which are protected by your card issuer. Virtual account numbers wouldn’t have protected many victims of the Equifax hack, either, who had information such as driver’s licenses, Social Security numbers and birth dates stolen.
See related: Corporate cards go virtual, offering added security
Tokenization, other technologies could replace VANs
Virtual account numbers have been available for more than a decade, but consumers have been relatively slow to use them. As a result, some credit card issuers have abandoned the offering.
Discover, for example, discontinued virtual account numbers a few years ago, after a 14-year run, in favor of other security enhancements, such as $0 liability and Freeze It, which allows card members to freeze their account to prevent new activity.
Cary Whaley, first vice president of payments and technology policy at the Independent Community Bankers of America, says that the rise of tokenization, which is what Apple Pay, Samsung Pay and other digital wallets use, may ultimately make virtual account numbers obsolete.
“That technology may be more effective from a consumer standpoint,” Whaley says. “What we’d all like is something that’s convenient and doesn’t change the way we bank but that works behind the scenes.”