What is a virtual card?
A card number that works once, or only at one shop, and then stops being worth stealing.
A single real card issues disposable numbers, each locked to one merchant, so a leak anywhere goes nowhere.
What it changes
An ordinary card number is a bearer credential. Anyone holding it can attempt a charge, which is why a breach at one retailer creates fraud everywhere.
A virtual card narrows that. Lock it to one merchant and a leaked number is useless anywhere else. Give it a spend cap and the maximum loss is capped. Set an expiry and it dies on schedule.
Note the family resemblance to tokenization: both replace a valuable secret with a restricted substitute. Tokenization is invisible and done by the network. A virtual card is deliberate and done by you.
The four things it is genuinely good at
Free trials. A single-use card that expires cannot be charged next year for something you cancelled in your head but not in their system.
Subscription control. One card per service means cancelling is a deletion rather than a phone call.
Untrusted merchants. A small site with unclear security gets a number that only works there.
Business expenses. One card per vendor or per employee, each capped, is the reason this is now standard in corporate spend management.
What it does not do
It does not protect you from a merchant charging you correctly for something you regret. It does not make a scam site legitimate. It does not help if you hand over the details yourself to someone who asked convincingly.
And it does not remove your fraud protection on the real card, which existed anyway. The virtual card reduces how often you need to use it.
One practical friction worth knowing: anything requiring the physical card to match, like a hotel check-in or car hire, will not accept a virtual number.
A prepaid key cut for one door, that stops working on Sunday. Losing it is annoying rather than serious.
Where you meet it
Every free trial you have been nervous about, every bank app with a "create card" button you have not pressed, and every company card that arrived with a limit already attached.