Pick a payment method that keeps your card verification value out of the merchant's hands. In practice that means a tokenized wallet, a virtual card locked to one merchant, or a single-use card number, rather than typing the three digits from your plastic into yet another checkout form. Any option that still depends on a static code stored on the merchant side gives an attacker a reusable key if that store is breached.
What to look for before you commit
- Tokenization. The provider swaps your card number for a token that works only in a defined context. Ask whether the token is scoped to one merchant, one device, or one transaction.
- Dynamic CVV. Some cards rotate the verification code every few minutes or generate a fresh one per purchase. This is the strongest control available to a consumer today.
- Merchant lock. A virtual card that authorizes at a single merchant cannot be drained elsewhere if the number leaks.
- Spend ceilings. Per-charge and monthly caps limit your exposure to the amount you set, not the amount on your credit line.
- Instant freeze. You want a control that kills the number in seconds from a phone, not a support ticket queue.
- Dispute rights. Confirm the virtual card carries the same chargeback protection as your underlying account. Some prepaid products do not.
- Provider compliance. The issuer should be PCI DSS compliant and the checkout should run in a validated payment environment.
Parameter bands worth comparing
Most products cluster into a few bands, and the differences matter more than the marketing copy suggests.
- Card lifespan: single use, merchant locked and open ended, or a fixed term of 12 to 24 months. Short lifespans cut risk but break subscriptions.
- CVV refresh: static, per transaction, or timed rotation somewhere between 5 and 60 minutes.
- Spend caps: fixed per charge, monthly ceiling, or no cap at all. Set at least one.
- Freeze latency: instant in app versus next business day.
- Dispute window: 60 days is the card network floor in most markets, and longer terms are better.
Pitfalls that cost people money
- Merchants that ask you to email or chat your CVV. No legitimate processor needs this, and PCI DSS forbids retaining the value after authorization.
- Checkout pages that post the card form to a third-party domain you do not recognize.
- Virtual cards that fail on hotel and rental car holds because the authorization exceeds the cap you set.
- Products that cannot handle recurring billing, which produces silent declines and lost reservations.
- Free virtual card apps funded by data collection. Read what transaction data they retain.
FAQ
Should I let a browser save my card and CVV?
Let the browser or wallet store a token wherever possible. A card saved in a password manager beats retyping it on every site, but a tokenized wallet beats both.
Is a virtual card as safe as my main card?
It is safer for online use because the number is not tied to your primary account. The tradeoff is that some merchants reject virtual card BIN ranges.
What if a merchant asks for the CVV again by email?
Decline. Enter it only inside a checkout session on the merchant's own domain, and report the request.
Does a dynamic CVV break subscriptions?
Usually not. The merchant stores a token after the first authorization, so the rotating code is only needed at setup.