What is a virtual card?
A card number that works once, or only at one shop, and then stops being worth stealing.
A single real card issues disposable numbers, each locked to one merchant, so a leak anywhere goes nowhere.
What it changes
An ordinary card number is a bearer credential. Anyone holding it can attempt a charge, which is why a breach at one retailer creates fraud everywhere.
A virtual card narrows that. Lock it to one merchant and a leaked number is useless anywhere else. Give it a spend cap and the maximum loss is capped. Set an expiry and it dies on schedule.
Note the family resemblance to tokenization: both replace a valuable secret with a restricted substitute. Tokenization is invisible and done by the network. A virtual card is deliberate and done by you.
The four things it is genuinely good at
Free trials. A single-use card that expires cannot be charged next year for something you cancelled in your head but not in their system.
Subscription control. One card per service means cancelling is a deletion rather than a phone call.
Untrusted merchants. A small site with unclear security gets a number that only works there.
Business expenses. One card per vendor or per employee, each capped, is the reason this is now standard in corporate spend management.
What it does not do
It does not protect you from a merchant charging you correctly for something you regret. It does not make a scam site legitimate. It does not help if you hand over the details yourself to someone who asked convincingly.
And it does not remove your fraud protection on the real card, which existed anyway. The virtual card reduces how often you need to use it.
One practical friction worth knowing: anything requiring the physical card to match, like a hotel check-in or car hire, will not accept a virtual number.
A prepaid key cut for one door, that stops working on Sunday. Losing it is annoying rather than serious.
One card per problem
The instinct with cards is to hold as few as possible. Here it should invert: create one for each thing you are trying to contain. Every place a number has been stored is a place it can leak from, and a card per purpose shrinks that radius until a breach is a footnote.
In practice that is a small standing set. One for subscriptions you intend to keep, capped near the monthly total so a surprise renewal at ten times the price simply declines. One per free trial, single use, expiring before the trial does. One for unfamiliar shops, capped at the order value. One for travel, funded deliberately.
The same logic scales into companies, which is why corporate spend management is built on it. A card per vendor makes reconciliation trivial, because the card is the category. A card per employee with a cap enforces the policy at the terminal rather than in an expense report three weeks later.
Where you meet it
Every free trial you have been nervous about, every bank app with a "create card" button you have not pressed, and every company card that arrived with a limit already attached.