How does a virtual card work?
The issuer creates the card details in software and gives them to the holder in an app, a portal or an API. Stripe’s documentation says a virtual card is generated immediately after it is created and can be added to Apple Pay, Google Pay or Samsung Pay. Visa describes virtual prepaid cards as designed for online, mail-order and telephone spending. Controls are set at issuance: Visa’s B2B Virtual Account Payment Method lets issuers and their partners set up single-use accounts and request accounts with authorization controls.
Why does it matter?
It limits what a leaked card number is worth and gives the payer control. Checkout.com describes online travel agencies creating a virtual card for each booking to pay a hotel or airline, notes that single-use cards cannot be used again, and mentions rules that authorize a card only for certain merchant IDs. As an illustrative example: an agency pays a hotel 600 euros with a single-use card limited to that amount. If the hotel later tries to charge 650 euros to include extras, the issuer declines it, and the extra 50 euros has to be collected another way.
What are the limits?
Controls produce declines that look like any other decline to the merchant, so a payment on a used or restricted card can be hard to diagnose without the issuer’s explanation. Card data still needs protection: Stripe notes that PCI DSS rules apply to how virtual card details are retrieved and displayed. And because virtual cards are often prepaid or commercial products, BIN data may classify them that way.
Where does Omno use it?
Omno does not issue cards. For an Omno merchant, a virtual card is processed like any other card: through the hosted checkout, routed to an eligible PSP, and storable as a saved card in Omno’s PCI DSS compliant environment. Whether a payout to a card is possible depends on the provider.