Virtual cards: what Google, Experian and Privacy.com say

What a virtual card is, and what it is not

Google Pay Help defines a virtual card as a digital version of your actual card, with a randomly generated number that replaces your actual card number. When you pay online or in an app with Chrome autofill, the merchant receives the virtual number, which Google says helps keep your actual card information safe. The page adds that the number, expiration date and CVV can differ from your physical card, and that the feature is available only for select banks or networks in select countries or regions. Some merchant sites and apps have opted out of accepting virtual cards.

Experian, in an article dated 2 September 2026, describes the same thing from the card side: a digitally generated number linked to your existing credit card account. Transactions made with it appear on your billing statement alongside your regular ones. The security code, expiration date and credit limit may differ, but the two numbers share the same credit limit, rewards program, annual percentage rate and fees, and billing cycle and statement. Google agrees on the point that matters most: a virtual card does not give you several cards with separate credit lines, and your credit line, balance, fees and transaction information stay the same. Experian adds that you need an open, active physical credit card account to create one.

The word covers more than one thing. Experian separates virtual cards from issuers, which you create, manage or delete through your online account or mobile app, from the device-specific numbers that wallets such as Apple Pay or Google Pay create by tokenization. Those wallet numbers, it says, generally cannot be viewed, managed or used outside the device and app where they were created. Google’s page draws a similar line inside its own products: the card it describes for online and in-app payments through Chrome autofill is different from the virtual cards you create on a device for tap to pay after adding a card to the Google Wallet app.

Privacy.com is a third kind. It is a company that sells virtual cards, so we use its pages only for what it says about its own product. Its support page, which shows an update of “2 years ago”, says every virtual card is connected to your bank account and comes with a unique 16-digit number, CVV and expiration, and that Privacy directly debits your funding source as you make transactions. Its controls page, which has no date, says the company never conducts a credit pull and that a mandatory identity verification comes before the cards can be used. The same page says Privacy is available to US citizens or legal residents with a checking account at a US bank or credit union, aged 18 or over.

On liability, Experian’s tip is that most issuers offer “zero liability” fraud protection, and that beyond it your liability is legally limited to $50. That sentence is about credit cards in general, and the article does not tie it to virtual cards in particular.

One card per merchant: three different meanings

The phrase sounds like one feature, and the pages we read use it for three. Google says some card issuers use one virtual card number for your card, with a new CVV for each merchant, while other issuers create separate virtual card numbers for each merchant you shop with. Either way, it says, your physical card number is hidden from merchants. Asked whether a virtual card can be set up for only one merchant, the page answers that some virtual cards support dedicated cards for a merchant, and sends you to the card issuer’s website for more.

Experian words it as an option for the issuer: card issuers may create one-time use or “merchant-specific” virtual cards, or allow spending limits. It adds that some issuers let you limit how long a virtual card is active and where it can be used, and that using one can reduce the number of merchants holding your actual card number on file. Experian does not say which issuers do any of this.

Privacy.com does it by locking. Its controls page says a Privacy Card locks automatically to the first merchant it is used at, and can also be set for one-time use so it closes after a single transaction. The company’s developer documentation gives the same two types as settings: a merchant-locked card is locked to the first merchant that successfully authorizes it, and a single-use card closes shortly after the first transaction. Its support page lists a third type, the category-locked card, which is declined at merchants outside chosen categories; the controls page presents category-locked cards as part of its Plus plan, listed at $5 a month. Those are the seller’s own prices and plan names, and we did not check them anywhere else.

The two business pages we read use the idea mainly for the single-use card, although Mastercard also says controls can designate specific merchants or merchant codes. Mastercard, in an article updated on 12 June 2026 and written for companies, lists five steps from generating a card to deactivating it. The business sets controls such as a budget, a valid time period and approved merchant categories, and after use or expiration the number is deactivated and cannot be used again. Its example is a card issued for a client dinner, which could not be used to buy a new outfit at the nearby shopping mall. J.P. Morgan, also writing for companies, says a card can be authorized for a single transaction up to a preset limit, and that single-use numbers limit the exposure of sensitive data compared with numbers used repeatedly.

Put side by side, the same words describe different mechanisms: a CVV that changes, a number made for each merchant, a card that locks to whichever merchant uses it first, or a number that closes after one purchase. Google presents the first two as the issuer’s choice, Experian says issuers may create one-time use or merchant-specific cards, and Privacy.com describes the last two as settings of its own cards.

Limits, pause and close

For issuers, Experian lists the controls as depending on the card issuer: a spending limit, a cap on the number of transactions, a specified merchant or an expiration date. It says this is useful for teens, employees or other authorized users, and for staying within a budget. It does not say which issuers offer which control.

Privacy.com is more specific about its own cards. Its controls page says you can set a limit on any card so you are not charged for more than you authorize, and that if a transaction attempt goes over the limit, the company will “automatically decline it”. The developer documentation names four limit periods, transaction, monthly, annually and forever, and says requests above the spend limit will be declined. It lists card states that include open, paused and closed, and warns that setting a card to closed is a final action that cannot be undone. The company’s guide to disputes, dated 25 September 2025, adds that when you pause or close a card, Privacy will decline all charges to it, which it says helps avoid accidental charges when cancelling a subscription.

Google’s page is about a different kind of off switch. In Chrome settings, or on the Google Wallet website, you can turn off a virtual card, and the page says any virtual cards you used before will no longer be active. It then adds a warning: even after a virtual card is turned off, it may still be active outside of Google Pay, and to suspend or cancel it there you contact the card issuer. If you turn the card back on, the page says, the virtual card number can be different. So switching off in Chrome is not the same as closing at the issuer, and closing at Privacy.com is a different act again, since it cannot be reversed.

There is a cost to closing too. Experian lists subscriptions among the disadvantages: if you set an expiration date on, or delete, the virtual card used for a subscription, future payments may be declined, which puts the subscription at risk of cancellation. For recurring payments it suggests choosing a card without an expiration date, or updating your payment information before the card expires. Our free trials page covers what a limit or a pause does and does not stop before a trial charge.

What happens on a refund

Only Google’s page speaks directly about returns. To make a return, or to pick up an item in store, after paying with a virtual card, you may have to find the last 4 digits of the virtual card number, which differ from your physical card. They are on the merchant’s receipt, or on the Google Wallet website: under Transactions, open the transaction and look under the line “Virtual card ending in”. If neither shows them, the page says to go to the card issuer’s website or contact your bank. For a refund on something bought with Google Pay from a site or app that is not Google’s, you contact the merchant’s customer support, and if you receive a refund you can find it on the statement of your linked payment method. For delivery or quality problems it also says to contact the merchant, and for a chargeback issue or unauthorized transaction it says to contact your bank or card issuer.

The CFPB’s two Ask CFPB pages are about credit cards and do not name virtual cards. The page on refunds, last reviewed on 15 May 2024, starts with the seller: reach out to the company that sold you the product or service, explain the problem and ask for a refund or for the charge to be undone. If the seller does not fix it, you can contact your credit card company to see whether you can dispute the charge, which is sometimes called a chargeback. For a billing error, the page says to send a notice to the card company within 60 days of the charge appearing on your statement. It also lists conditions under which you may refuse to pay the rest of a purchase: a good-faith attempt to resolve the issue with the seller, a purchase in your home state or within 100 miles of your home address, a price above $50, payment by credit card, and a balance not yet fully paid.

The CFPB page on disputing a charge, last reviewed on 15 April 2024, says to call the card company right away and to send a written billing error notice within 60 calendar days after the charge appeared on your statement. The company then has 30 days to send a letter confirming it received the dispute, unless it has finished its billing error procedures by then. If you already paid the charge you can still dispute it, but you probably will not get the money back until the card company has decided you were right.

Privacy.com’s guide to disputes, dated 25 September 2025 and citing sources it read in January and February 2025, also starts with the merchant. It says merchants may prefer issuing refunds over chargebacks because they are easier and less costly to process. If you cannot get a refund from the merchant, it says you can dispute the charge directly within the platform in five steps: select the transaction, select the reason, explain why, share supporting evidence such as screenshots, receipts or emails, and sign the application.

Now the gap. The Privacy.com pages we read do not say how a refund reaches a card that is locked to a merchant or closed. Google says a refund appears on the statement of the linked payment method, but that is Google Pay and not Privacy.com. Experian does not mention returns, and the CFPB pages do not mention virtual cards. We therefore cannot say whether a returned item on a locked or closed card is refunded to it, or what the issuer does when the card can no longer take a charge.

Where a virtual card is the wrong tool

Experian lists four disadvantages. Acceptance is limited: some virtual cards cannot be used for in-person transactions, at merchants that opted out, or when you need to verify your identity, and some merchants, such as hotels and rental car companies, require your physical card for the final booking. Its tip is that if a merchant requires you to present the same physical card used for the purchase, you may need to use the physical card. Second, a virtual card may require a specific browser or extension for setup or use, which can mean a laptop or desktop rather than a phone. Third, subscriptions need extra management, as above. Fourth, availability is limited: not every issuer offers virtual cards, and if yours does not, you may have to apply for a card from another issuer. “Features vary” between issuers, the article says, so it advises exploring what is available first.

Google makes two similar points. The feature is available for select banks or networks in select countries or regions, and merchants may opt out. It also answers a question about a lost card: if you lose your physical card, someone with it might be able to create virtual cards, so you should report the missing card to your bank or card issuer as soon as possible.

Privacy.com’s limits are of another kind. It is available to US citizens or legal residents with a US checking account who are 18 or older, and the cards debit that account as you spend, according to its support page. If you live elsewhere or have only a credit card to fund it, the pages we read do not describe another route.

On the plus side, Experian says that if a virtual card number is exposed in a data breach, you can replace or deactivate it without changing the underlying card account, because the merchant never had the physical number. Experian calls a virtual card an additional layer of protection when shopping online.

One note from this site, not from the sources. Sign-ups also ask for an email address, which is a separate question from the card number. Addresses are the subject of our temp mail pages, where SimpleLogin covers aliases that forward to your real mailbox.

What we did not use

We tested no card and opened no account. The statements come from Google Pay Help, Experian, four Privacy.com pages (controls, support, developer documentation and the guide to disputes), two Ask CFPB pages, and the Mastercard and J.P. Morgan articles for companies, all read on 30 October 2026. We did not read the Navan glossary, the Stripe article, the Visa gift card page or the Google Play app listing, and we do not use them here.

Dates matter on this subject. The Privacy.com controls page has no date, the support page shows an update of “2 years ago”, and its prices, plan names and availability are the seller’s own and may have changed. Google says availability depends on bank, network and country. The two CFPB pages date from April and May 2024. The pages we read do not say how many virtual cards you can create in a month today, and we do not repeat a figure we could not confirm.