How to Get a Virtual Credit Card Number in 2026

What a virtual credit card is (and what it isn’t)

A virtual credit card is a stand-in card number, expiration date and security code. You type it at an online checkout instead of your real card. The charge still goes to your real card or bank account.

It isn’t a new loan or a new credit line. Capital One says its virtual cards are “generally meant for online use only” and can’t go into a digital wallet to tap in stores. They also expire, and you can lock or delete one without touching your main card.

The point is damage control. If a store you paid with a virtual number gets breached, you delete that number. Your real card keeps working everywhere else.

Virtual cards come in three kinds, and most services offer more than one:

• General-use. One stand-in number for any website. Capital One gives each account one of these.
• Merchant-locked. The number works only at one store. Privacy.com locks a card to the first merchant that charges it, so a thief can’t use it elsewhere.
• Single-use. The card closes after one charge. Privacy.com offers these on its free plan, and Capital One lets some merchant cards expire after one use.

A virtual card also isn’t a virtual gift card. Capital One’s FAQ draws the line: a gift card is prepaid money, while a virtual card spends against your credit line.

Step 1: Get one free from your card issuer

Start with the card you already have. Several big issuers make virtual numbers at no extra cost.

Capital One. In the Capital One app, pick your card and tap “Get your virtual card.” From there you can make cards locked to one merchant, and manage them all in “Virtual card manager.” Its FAQ says you keep earning rewards on them.

Citi. Citi calls them Virtual Account Numbers. Its public page didn’t load for me on 10/23/2026, so this part comes from AwardWallet’s guide (08/25/2026). You open “Virtual Account Numbers” in your online account, set a spending limit and get a number. Citi doesn’t publish which cards qualify.

Chase and Bank of America. Chase’s own guide says plainly: “Chase does not offer virtual credit cards.” Bank of America’s ShopSafe page showed “Page Not Available” on 10/23/2026.

Use Chrome or Apple Pay if your bank doesn’t

Chrome and Android. Google can swap your card for a virtual number when Chrome fills in a checkout form. Go to chrome://settings/payments, find your saved card, then click More and “Turn on virtual card.” Google says it works only for “select banks or networks.” Amex’s terms say its version works in Chrome and select Android apps.

Apple Pay. On iPhone, iPad and Mac, Apple Pay already does this at sites and apps that accept it. Apple’s privacy page says it sends a Device Account Number and a one-time code, not your card number.

If the option isn’t there: Privacy.com’s free plan

Privacy.com makes virtual cards that draw on your checking account. Its Personal plan was $0 on 10/23/2026, with up to 12 new cards a month. You can lock a card to one merchant, make it single-use or set a spending limit. Paid plans ran from $5 a month (billed $60 a year) for 24 cards.

There’s a catch. Privacy.com is for U.S. adults with a U.S. checking account and a phone number that gets texts. It also asks for an identification number, “for most users, this is an SSN.” It doesn’t accept a credit card as the funding source. I didn’t open an account. Privacy.com has no affiliate program, so this site earns nothing from it.

Set it up for subscriptions and free trials

This is where virtual cards earn their keep. The setup is the same idea at every service I checked:

1. Make a separate merchant-locked card for each subscription. Name it after the service.
2. For a free trial, set a low spending limit or use a single-use card. A surprise renewal then gets declined instead of charged.
3. To quit a service that’s hard to cancel, lock or delete its card. Capital One lets you lock or delete a virtual card without affecting your account. Privacy.com lets you pause or close cards.
4. Still cancel the subscription itself. A declined charge isn’t the same as canceling, so close the account with the company too.

Step 2: Know where a virtual card stops helping

A virtual number solves one problem well. It keeps your real card number out of a store’s database. It doesn’t do much else.

• It’s tied to one issuer. A Capital One virtual number works only for that Capital One card. Chrome’s version needs an eligible card and doesn’t work where merchants opted out.
• It hides the number, not you. The store still gets your name, email, phone and shipping address. For the email part, see the best email alias services.
• Your bank still sees the store. Privacy.com says charges show on your bank statement as “Privacy.com” or “PWP*” plus the merchant’s name.
• Debit protection is weaker. That matters for any card that pulls straight from checking.

The FTC’s summary of federal law shows the gap. If only your card number is stolen, you aren’t responsible for charges you didn’t authorize on a credit card. On a debit card, that holds only if you report within 60 days after your statement is sent.

Privacy.com says its cards have been “technically charge cards” since 2021, funded from checking. Read its dispute terms before you rely on it for big purchases.

Step 3: Cloaked Pay, the paid option, and why it isn’t a sign-up yet

Cloaked is a privacy subscription that bundles data broker removal, email and phone aliases and a password manager. Its pricing page also lists “Virtual Cards (new)” in its comparison table. Individual was $9.99 a month, “Billed at $119.99 per year,” on 10/23/2026.

Its help center tells a different story. On 10/23/2026 it said access to Cloaked Pay “is currently limited.” You subscribe first, then join a waitlist in the Cloaked app.

If you get in, here’s how Cloaked’s help center describes it. The cards are Mastercard numbers that pass charges to your own card or bank account. You can cap each card per transaction, per month or for its lifetime. Cloaked says it adds no per-transaction or refund fees, and that the cards don’t touch your credit score.

The identity check is heavier than at your bank. Cloaked asks for your legal name, date of birth, U.S. address, phone, email and SSN. Without a valid SSN, “you won’t be eligible to use Cloaked Pay.”

Two more lines matter before you pay. Cloaked won’t give a partial refund if you only wanted Cloaked Pay. And once you cancel, its help center says Cloaked Pay is disabled along with the VPN.

Don't buy Cloaked only for virtual cards. A waitlist means you could pay for the year and still not get them. It makes sense if you want the rest of the bundle too.

See plansAffiliate link · how it works →

If you want the rest of the bundle, my Cloaked review covers its checkout and data removal. The Cloaked pricing breakdown shows what the checkout charged on 10/16/2026.

If you’d rather use another service

• For aliases instead of cards: Proton Pass and Cloaked both make email aliases. Compare them in the best email alias services.
• For a private inbox: see the best secure email providers.
• For other bundles: the Cloaked alternatives page covers services without the card feature.

Which option fits your situation

Is it worth paying? See what’s actually free

For most people, no. If your bank, Chrome or Apple Pay covers your cards, you already have virtual numbers for free. Privacy.com’s $0 plan fills most of the gap. Paying makes sense only for a bundle you’d buy anyway, and Cloaked’s cards weren’t open to everyone on 10/23/2026.

See also

• Best email alias services
• Cloaked review
• Cloaked pricing
• Cloaked alternatives
• Best secure email providers
• How to remove your personal information from the internet

What we checked

• Card issuers on 10/23/2026: Capital One's virtual cards page and its FAQ, Chase's guide, Amex's Google Pay terms. Citi's page didn't load, so I used AwardWallet's guide from 08/25/2026
• Google Pay Help on Chrome virtual cards and Apple's Apple Pay privacy page (published 04/27/2026)
• Privacy.com: pricing page and five help center articles on eligibility, sign-up, funding, card type and statements
• FTC: Lost or Stolen Credit, ATM, and Debit Cards (January 2022)
• Cloaked: pricing page and seven Cloaked Pay help articles on 10/23/2026, plus two screens from my Cloaked run on 10/16/2026. I didn't open any account, so this is a desk review
• Where the run stopped: desk review only: issuer, Google, Apple, Privacy.com and Cloaked pages on 10/23/2026; no bank, Privacy.com or Cloaked Pay account opened (each needs an SSN or a U.S. checking account, and Cloaked Pay has a waitlist)

FAQ