Controlled payment number

A controlled payment number (a trademark of Orbiscom), also called by generic names substitute credit card number, one-time use credit card, and virtual credit card number) is an alias for a credit card number. It is generated through the use of either a Web application or a specialized client program, interacting with the card issuer's computer, and is linked to the actual credit card number.

Typically, a controlled payment number has a limit, and an expiration date between two and twelve months from the issue date, both chosen by the account owner, and while it can usually be set up to allow multiple transactions, it can only be used with a single merchant. This "alias" number is indistinguishable from an ordinary credit card number, and the user's actual credit card number is never revealed to the merchant. Consequently if it is compromised a fraudulent user can usually not steal money.

The system was developed by Orbiscom, a Dublin-based payment processing company which was acquired by Mastercard in January 2009 and in parallel by Cyota Inc. It is used by a number of credit card issuers. In the USA, these include Bank of America (which inherited its system, "ShopSafe," when it acquired MBNA), Citibank ("Virtual Account Numbers"), Discover Card's Secure Online Account Numbers and NetSpend's "virtual accounts". Examples from other countries are MBnet, which can create a payment number linked to virtually any credit or debit card emitted in Portugal.

Discontinued programs

In the UK, Ivobank offered a similar "virtual card" until it went bankrupt in 2009, and Cahoot withdrew their Webcard in October 2009.

American Express's "Private Payments" was available from late 2000 to 2004.

Paypal discontinued their virtual credit card service on September 22, 2010.

UK-based Neteller offered Net+, a "virtual debit card" with card details generated uniquely for each transaction, from 2008 to 2012; it was discontinued on 29 February 2012, citing lack of use by customers.