Controlled payment number

A controlled payment number, disposable credit card or virtual credit card is an alias for a credit card number, with a limited number of transactions, and an expiration date between two and twelve months from the issue date. This "alias" number is indistinguishable from an ordinary credit card number, and the user's actual credit card number is never revealed to the merchant.

The technology was introduced primarily as an anti-fraud measure, so that a virtual unique credit card number may be generated to settle a specific transaction, on an exact date by an authorized individual. The possibility of a fraud occurring is significantly less than a traditional physical card, which can be lost, stolen or indeed cloned.

The number is generated through the use of either a Web application or a specialized client program, interacting with the card issuer's computer, and is linked to the actual credit card number. While it could usually be set up to allow multiple transactions, it could only be used with a single merchant. Consequently, if it is compromised a fraudulent user can usually not steal money, and the limit reduces how much a fraudulent person can steal.

The term "controlled payment number" is a trademark of Orbiscom. The technology is also called by generic names "substitute credit card number", "one-time use credit card", "disposable credit card" and "virtual credit card number", or "virtual card number" (VCN).

Technologies

Mastercard

January 2009, MasterCard and Cyota Inc. acquired the controlled payment number system developed by Orbiscom, a Dublin-based payment processing company. In the United States, the system is used by the following credit card issuers: Bank of America "ShopSafe" (inherited when it acquired MBNA) (and now discontinued-see below) and Citibank "Virtual Account Numbers". Examples from other countries are MBnet, which can create a payment number linked to virtually any credit or debit card emitted in Portugal.

Orbiscom's patented payment technologies have been integrated with MasterCard's global processing platform, "inControl".

In 2013 Royal Bank of Scotland MasterCard customers became eligible for MasterCard's "enhanced Central Travel Service" (eCTS), which uses VCN technology. This service is intended to provide companies currently paying for travel through multiple accounts with a centralised travel payments system.

In 2015 Etisalat Egypt, National bank of Egypt NBE and MasterCard launched Virtual Card Numbers via Flous service. The service works on any mobile phone. Every time a VCN is requested, a new one will be generated, and the user notified by SMS.

Discontinued programs

On February 7, 2014, the US Discover Card discontinued its Secure Online Account Numbers service, saying that Discover no longer had access to the underlying technology. All existing Secure Online Account Numbers expired on March 16, 2014.

In the UK, Ivobank offered a similar "virtual card" until it went bankrupt in 2009, and Cahoot withdrew their Webcard in October 2009.

American Express's "Private Payments" was available from late 2000 to 2004.

PayPal discontinued their virtual credit card service on September 22, 2010.

UK-based Neteller offered Net+, a "virtual debit card" with card details generated uniquely for each transaction, from 2008 to 2012; it was discontinued on 29 February 2012, citing lack of use by customers.

Bank of America discontinued ShopSafe on September 5, 2019.

Virtual credit card

A virtual credit card (VCC) is a virtual credit card number (VCN) typically used for online purchases, and often for single-use transactions. Virtual credit card numbers are not associated with a physical card, and consequently cannot be used for in-person transactions. Unlike the numbers generated by online credit card number generators, funds must be deposited into an account associated with the VCN prior to usage.

VCNs can be acquired from online VCN providers, banks, and some partners of Visa and MasterCard. Online VCN providers often assess service charges to pay banks, credit card companies, and/or credit networks for the costs of obtaining and servicing VCNs.

A virtual credit card includes three parts:

• Credit card number

Like standard Visa and MasterCard credit cards, the credit card number consists of sixteen digits.

• CSC/CVC/CVV/CVV2

A card security code (CSC) (also termed card verification code (CVC) and card verification value (CVV/CVV2)) is also associated with the virtual credit card; as in standard credit cards, a CVV is used in virtual credit cards to establish card ownership by the buyer and to authorize transactions.

• Date of expiration

Virtual credit cards often expire much sooner than physically issued credit cards, e.g., 60 days. As security is a primary reason for VCC usage, rapid turnover of VCNs prevents funds from being compromised for long periods of time.