What are virtual cards and how do they work?
Virtual cards are a swift and safe way for your customers to make purchases—while generating revenue for your business. Learn how to launch them.
Physical cards have a physical problem: they take time. Time to design, time to produce, time to ship. Virtual cards skip all of that. They're issued via API, usable in seconds, and they come with controls you can program directly onto each card. If you're curious what's actually going on under the hood and whether virtual cards make sense for your customers, we'll cover it all.
TLDR:
- Virtual cards are tokenized card numbers issued via API, usable for purchases online, by phone, or in person via mobile wallet.
- Each card supports programmable spend controls: merchant restrictions, spending caps, and single-use invalidation after first authorization.
- Your business earns interchange revenue on every purchase your end users make with a virtual card.
- Going direct requires negotiating with a bank, processor, and network separately, which takes weeks to months to stand up.
- Unit issues virtual cards via a single API call, with the bank, processor, and network relationships already in place.
Virtual cards are expected to continue to surge in popularity. For tech companies and their customers, they provide clear benefits:
- Speed. Virtual cards can be created instantly, and customers can use them to make payments within moments.
- Cost. There are minimal costs associated with generating virtual cards, so it’s easier for you and your customers to create as many as needed.
- Programmability. Virtual cards are highly programmable. You and/or your customers can set rules to govern how funds are spent.
- Security. You and your customers can create restrictions for how their virtual cards are used, including one-time-use cards. This can be a safeguard against security breaches.
- Design flexibility. Virtual cards don’t require designs, which can expedite your speed to market.
- Revenue. Virtual cards generate interchange revenue whenever your customers make card purchases.
That said, virtual cards are not the right fit for every situation. Here are a few limitations to keep in mind before launching a program.
- Not universally accepted: Some in-person terminals cannot process virtual card numbers without a connected mobile wallet, which can limit usability for certain end-user scenarios.
- Recurring billing risk: If a virtual card expires or is cancelled, subscriptions or recurring charges tied to that number may fail and require manual updates.
- Reconciliation complexity: Issuing large volumes of virtual cards can create accounting overhead without integrated spend tracking tools in place.
If you're curious about whether virtual cards are a good fit for your business and how they work, this guide is for you. In it, we’ll answer the following questions:
- What is a virtual card?
- What are some common use cases for virtual cards?
- How do companies make money from virtual cards?
- Are virtual cards right for my business?
- How do you launch virtual cards?
Mesh lets businesses create unlimited virtual cards with features like spend limits and merchant-specific restrictions.
What are virtual cards and how do they work?
A virtual card is a unique sequence of numbers that allows a customer (either a business or a consumer) to make purchases via credit- or debit-card networks, much as they would with a physical card.
To help customers understand the concept, these numbers are often displayed on a digital image of a debit or credit card. But there’s no actual, physical card associated with a virtual card. It’s just a sequence of numbers.
Virtual cards can be used to make purchases online, in-person, or over the phone. Cardholders can also type their virtual card numbers into a form or speak them aloud to a customer-service representative.
Virtual card numbers are typically generated according to the same rules that govern physical card numbers. Like physical cards, virtual cards come with an expiration date, the name of the card network (e.g., Visa or Mastercard), a Card Verification Value (CVV) code, and the customer’s name.
Each 16-digit virtual card number is validated using the Luhn algorithm, the same check-digit formula used for physical cards. The first six digits form the Bank Identification Number (BIN), assigned by the card network to identify the issuing institution. The remaining digits are randomly generated and mapped to the cardholder's underlying account through a token, so the actual account number is never exposed to merchants. A unique CVV and expiration date are assigned at the moment of generation. For single-use virtual cards, the number is cryptographically invalidated after first authorization, so a stolen number cannot be reused.
How a virtual card transaction works
- The cardholder enters or transmits the virtual card number, CVV, and expiry at checkout. This can happen online, over the phone, or via a mobile wallet at a contactless terminal.
- The merchant's payment processor sends an authorization request to the card network (Visa or Mastercard), including the card details and transaction amount.
- The card network routes the request to the issuing bank, which validates the token and checks any spend controls set on that card, such as merchant restrictions or spending caps.
- The issuing bank approves or declines the request and returns the decision through the network in seconds. The merchant receives the result at checkout.
- The transaction settles within 1-2 business days, with interchange distributed among the card network, the issuing bank, and the program operator.
Virtual cards are not to be mistaken with digital cards, which are a separate type of card from virtual cards. Digital cards are commonly associated with Apple Pay and other mobile wallets.
Virtual cards vs. physical cards
Many programs issue both simultaneously, giving customers the immediacy of a virtual card while a physical card is in transit.
What are some virtual card examples?
At Unit, we’ve helped leading tech companies design and issue virtual cards. Based on our experience, these are a few common use cases and industry examples for virtual cards.
- Manage corporate expenses. (Examples: Shopify, Mesh). Virtual corporate cards can help to set guardrails and increase transparency around business expenses. As examples, your customers could set expiration dates for certain cards, monthly spend limits for vendors, and even merchant-specific limits to restrict purchases to specific purposes.
- Get customers spending in moments. (Examples: Roofstock, Chime). With virtual cards, your customers can start making purchases (and you can start earning interchange) within moments. You can even automatically issue your customers a virtual card while they wait for their physical card to arrive.
- Manage merchant-specific purchases and subscriptions. (Example: Eno by Capital One, Divvy). You can create cards that, once spent with a specific merchant, can only be used with that merchant going forward. For example, if a customer uses this type of card to pay for a Netflix subscription, that card could only be used with Netflix thereafter.
- Pay independent contractors and employees. (Examples: Uber, DoorDash). You can use virtual cards to pay your staff so that they don’t have to wait for their paychecks to arrive. For example, you can set up instant payouts that are added to a virtual debit card, which ensures that your staff is paid promptly.
- Cards for one-time use. (Examples: Privacy, Ironvest). Issue a card that automatically expires after a single payment. This can protect the end-user’s information from data breaches and even make it easier to sign up for free trials.
Are virtual cards safe?
Virtual cards include several security controls that physical cards do not offer.
Number masking. The virtual card number is a token, not your actual account number. Even if a merchant suffers a data breach, the exposed number cannot be used to access the underlying account.
Transaction controls. Issuers can enforce merchant category restrictions, geographic limits, and spending caps at the card level. A card issued for travel expenses, for example, can be blocked from use at non-travel merchants entirely.
Single-use invalidation. One-time-use virtual cards are expired after first authorization. A stolen number from a completed transaction is worthless — it has already been closed and cannot be reused.
These controls make virtual cards measurably safer than physical cards for online transactions. Program operators can configure the restriction level for their specific use case.
How do businesses make money from virtual cards?
As with physical cards, the primary way that companies generate revenue from virtual cards is via interchange fees.
Interchange is generated whenever your customers make card purchases. It’s calculated as a percentage of the overall transaction value, as detailed in our interchange guide linked above.
These revenues are typically shared among the card network, the issuing bank, any platform partners, and your business. That said, the lion’s share of the interchange typically goes to the company whose brand is on the card—i.e., you.
You'll earn interchange whether you're offering virtual cards for business or for consumer use cases. If you're offering virtual charge cards and/or credit cards, you may also generate financing revenue. Learn more in our guide to embedded lending or our guide to revenues in embedded finance.
How do I issue virtual cards?
In general, there are two ways to go about virtual card issuance:
- Work directly with a bank, processor, and network on your own
- Work with a bank, financial infrastructure provider, processor, and network
Which you choose will drastically impact your time-to-market and the resources you need to invest, both up-front and on an ongoing basis.
If you decide to work without an infrastructure partner, you'll need to establish the following:
- Bank partner. You’ll need to find a bank partner and work with them to get your virtual cards program parameters approved. Be ready to negotiate and execute a contract with your partner and build the technical integration between your bank and your card processor.
- Processor: Onboarding accounts, processing transactions, and handling fraud are among some of the main things your processor will manage for you. Importantly for virtual cards, your processor will install your dedicated Bank Identification Number (BIN), work as your data security partner for storing and transferring customer data, and coordinate user authentication.
- Network: Finally, you’ll need to choose a network; most companies work with Mastercard or Visa, depending on what their bank partner prefers. If your bank partner and processor allow for it, you may be able to put together a deal with your network and negotiate your terms (e.g., fee rebates and marketing incentives).
Once these partnerships and processes are set up, you’re ready to make virtual cards available for your customers to use.
If you work with a financial infrastructure like Unit, your process will look different. For example, once you're a customer with production access, you just make an API call to issue physical and virtual cards. We've already optimized the relationship between the bank, processor, and network, removing much of the complexity and manual labor you would have had to go through to set up a program. See our guide on choosing a build path on Unit to understand your options.
Are virtual cards right for my business?
It’s a good question, and there’s no one-size-fits-all answer.
As a starting point, we recommend getting to know your customers deeply and thinking about the decision through the lens of their needs and preferences. You can also ask yourself the following questions:
- What are the demographics of our customer base? Will they be comfortable with this technology?
- What kinds of purchases do they typically make? Are cards their preferred payment method?
- Do we want them to be able to use their cards immediately?
- Is the unboxing experience of receiving a physical card important to our brand or our customers?
- Do we rely on physical cards as a part of our marketing strategy? Do our cards need to be visible in stores and restaurants to help get the word out about our company?
Want help thinking through your card strategy? Contact us to book a demo—or just sign up for our sandbox and start building.
The content in this article is provided for general informational and educational purposes only and should not be construed as legal, tax, accounting, or regulatory advice. Unit does not warrant or guarantee the accuracy, completeness, adequacy, or currency of the information provided, and the content may not reflect all considerations relevant to a particular business, product, or use case.
Frequently asked questions
Are virtual cards safe?
For end-customers, virtual cards can be safer than physical cards. Virtual cards can’t be physically lost, and there are many safeguards on phones, devices, and websites to ensure that the person accessing the card is, in fact, the cardholder. Given the low cost and flexibility of programming virtual cards, it can be easier to program virtual cards to expire after one use, limit their use to specific merchants and merchant categories, and enforce spending limits. All of these restrictions can reduce what can be done with card numbers if they’re stolen.
Virtual card programs are held to rigorous data-storage standards. In fact, many adhere to the same Payment Card Industry Data Security Standard (PCI-DSS) requirements that banks and credit unions follow.
How much compliance is required to offer virtual cards?
In general, virtual cards require the same level of compliance as physical cards. That starts with a compliant Know Your Customer (KYC) flow. It’s required when a customer opens an account and to continue monitoring the account thereafter. You’ll work together with your bank and any platform partners to build a great KYC flow. At Unit, we’ve pre-built these KYC flows, streamlining the compliance you would otherwise need to build from scratch.
How can my customers request or generate a virtual card?
You can choose how your customers request or generate their virtual cards. We’ve seen businesses make it an automatic process; that is, as soon as a customer creates a bank account, they are issued a virtual card. Other businesses make it as easy as tapping a button in an app. You have a lot of freedom here to think through how you’ll create the ideal user experience.
Can virtual cards be added to a mobile wallet?
Yes, virtual cards can be added to mobile wallets (like Apple Pay, Google Pay, and more). Virtual and physical cards are both eligible to be tokenized into digital cards that can be added to mobile wallets.
When your customer’s digital card is created, it is "linked" via your issuer’s token vault to its underlying physical or virtual card. Once this process is complete, your customers will have a digital card (which is now linked to their physical or virtual card) in their mobile wallets.
Do I need to get virtual card designs approved by my issuer?
Virtual cards do not require designs. However, if you’d like to create a visual representation of your virtual card, the best practice is to follow the same design guidelines as you would for a physical card. For your visual representation of a virtual card, it’s recommended that you omit displaying physical card features that virtual cards don’t have, like the card chip.
If I want to issue a physical card instead of or in addition to a virtual card, what does that involve?
The process of issuing a physical card is a bit more involved than creating a virtual card. Once you’ve found and partnered with a card printer, you’ll need to design the card, get it approved, test it, manufacture it, and ship it to your customers. That takes a minimum of six weeks for standard cards and 12–20 weeks for custom cards.
Because you’ll be working with physical materials, you may run into additional variables. For example, supply chain issues have created a shortage of credit card chips, which can slow down the card creation process.
Working with a platform can streamline this process considerably. For example, we work with designated printers and have established processes with them that streamline card design and testing. This can help reduce your time to market.
