Short answer: for paying online, a virtual card is safer than the physical card in your wallet, and it is not close. The longer answer is about why, and about the handful of things that still deserve attention.
Why it is safer than your main card
The number is disposable
When a merchant is breached, the attackers get card numbers. A physical card's number is the same everywhere you used it, so one breach means replacing the card and updating every merchant. A virtual card's number belongs to one merchant. Close it, create another, done.
The loss is capped
A prepaid virtual card can only spend its balance. A stolen credit card number can be charged up to the credit line. A stolen debit number reaches your bank account. A stolen virtual card number reaches the $20 you put on it.
You can turn it off yourself
Freezing a bank card means a phone call, a wait, and a replacement in the post. Freezing a virtual card is one tap, reversible, and the other cards keep working.
Your real details never travel
Each merchant gets a card that is only used with them. Your bank account, your main card and your identity are not part of the transaction.
The seven things to check
- Who issues the card. The card should come from a regulated bank or licensed issuer on the Visa or Mastercard network. That is what makes it a real card with network rules behind it.
- How the number is protected. A provider should never show the full card number without a second verification step, and should never store it in plain text. If a dashboard shows full numbers by default, walk away.
- Two-factor authentication on the account. The account is the key to every card in it. Turn 2FA on and keep the recovery codes.
- 3-D Secure support. Many merchants require it, and it stops a stolen number being used at those merchants without your confirmation.
- Transaction visibility. You want to see every authorization as it happens, so an unexpected charge is caught within minutes.
- What happens to unspent money. Reputable providers return the balance of a closed card to your account. Some gift-style cards keep it. Read the terms.
- Fees in writing. Safety includes not being surprised by the bill. Load fees, card fees, foreign transaction fees and any inactivity fees should be listed before you pay.
The risks that remain
Phishing
The most common way any card gets stolen is not a breach, it is a fake page that asks for the details. A virtual card limits the damage but does not stop the theft. Type merchant addresses yourself, and be suspicious of any email that wants card details.
Account takeover
If someone gets into your provider account, they can create cards with your balance. Strong unique password, 2FA, and log out on shared devices.
Merchants that keep the card on file
A card you leave on file can be charged again. That is fine for a subscription you want, and a problem for a merchant you do not trust. Keep such cards loaded only with what the next charge should be, or close them after the purchase.
Disputes
Prepaid cards on the Visa and Mastercard networks have chargeback rights like any other card, but the process runs through the provider, and the timelines are the network's. Keep receipts and raise problems quickly.
Habits that make it safer still
- One card per merchant, always.
- Small balances, reloaded when needed, rather than a big balance sitting on one card.
- Alerts on for every transaction.
- Freeze cards you are not using this month. Unfreeze when you need them.
- Close cards for merchants you are done with, and let the balance flow back.