What is a virtual card and how does it work?

A virtual card is a digitally generated payment number (16 digits, expiration, CVV) that processes transactions on standard card networks without physical plastic. It's created on demand, configured with spending limits and merchant restrictions, and typically expires after one use or a set time period. Merchants process it identically to a physical credit card.

Are virtual cards safe for business transactions?

Virtual cards are inherently more secure than physical cards because each number is limited to one transaction, one vendor, or a short time window. A compromised number cannot be reused for unauthorized purchases. Navan adds configurable merchant category restrictions and real-time spending caps that decline any charge violating pre-set controls.

What is the difference between a virtual card and a corporate card?

A corporate card is a static, named card issued to an individual employee for ongoing use across many merchants. A virtual card is a temporary, purpose-specific number generated for one transaction or vendor. Corporate cards offer convenience for recurring in-person purchases; virtual cards offer per-transaction security and automatic reconciliation data.

Can virtual cards be used for in-person payments?

Some virtual cards can be added to mobile wallets (Apple Pay, Google Pay) for tap-to-pay at physical terminals. However, hotels and car rental counters that require a physical card for deposits and incidentals typically cannot accept a virtual-only credential. Most organizations pair virtual cards for online bookings with physical cards for in-person travel expenses.

How do virtual cards help with expense reconciliation?

Each virtual card maps to a specific booking, vendor, or cost center at the time of creation. When the charge posts, it arrives pre-categorized with structured data (amount, merchant, purpose) that matches directly to the original request. Navan connects this data to the general ledger in real time, eliminating the manual receipt-matching and categorization step that delays month-end close.

What types of virtual cards do businesses use?

Businesses use three primary types: single-use cards (one transaction, then void), vendor-locked cards (tied to a specific supplier for recurring payments), and time-limited cards (active for a set period like a business trip). Each type serves different payment scenarios, from one-time conference registrations to ongoing software subscriptions and multi-day travel bookings.

What is a Virtual Card? How It Works

Virtual Card

A digitally generated payment credential consisting of a unique card number, expiration date, and security code that processes transactions on standard card networks without physical plastic, typically created for a single transaction, specific vendor, or defined time period.

Victoria Landsmann

•June 23, 2026•

6 minute read

Key Takeaways

A virtual card is a digitally generated payment credential that functions like a physical card but exists only in electronic form, typically created for a single transaction, specific vendor, or defined time period.

Virtual cards generate unique 16-digit numbers, expiration dates, and CVV codes on demand, masking the underlying corporate account from merchants and limiting fraud exposure to one transaction at a time.
B2B virtual card payments reached $5.2 trillion globally in 2025 and are projected to exceed $14.6 trillion by 2029, driven by accounts payable automation and security demands [1].
Navan issues virtual cards at the point of travel booking, locking each card number to a specific trip, traveler, and spending policy so charges reconcile automatically without manual matching.
Finance teams configure per-card controls including merchant category restrictions, expiration dates, and spending caps, giving granular oversight that static physical cards cannot provide [2].
The B2B segment accounts for 70.3% of the global virtual cards market, reflecting a broad shift away from paper checks and wire transfers toward card-rail payments with built-in data [3].

What is a Virtual Card?

A virtual card is a digital-only payment credential consisting of a unique card number, expiration date, and security code that processes transactions on standard card networks (Visa, Mastercard, Amex) without physical plastic. Each virtual card can be generated instantly, configured with specific spending limits, and deactivated after use.

Unlike a static corporate card number that an employee uses across hundreds of merchants over years, a virtual card is typically tied to a single purpose: one vendor payment, one travel booking, or one subscription cycle. This per-transaction granularity is what distinguishes virtual cards from every other payment instrument in corporate finance.

The term covers both single-use cards (generated for one transaction, then automatically voided) and multi-use cards (assigned to a recurring vendor or subscription with preset limits). Both types run on the same card-network rails as physical cards, meaning any merchant that accepts credit cards can process a virtual card payment without new infrastructure.

Transform Your T&E Management with Navan

Make business travel work for everyone.

Get started

How Do Virtual Cards Work?

The lifecycle of a virtual card follows five stages:

Generation: A finance administrator or automated system creates a new card number through the corporate card platform. The number is linked to a funding source (corporate credit line, prepaid balance, or bank account).
Configuration: Controls are applied: spending cap, merchant category code (MCC) restrictions, expiration date, and vendor lock. A card issued for a $450 hotel stay in Chicago can be configured to work only at lodging merchants, only for $450, and only for 48 hours.
Distribution: The card details are shared with the intended recipient or loaded directly into a payment system. For travel, this often means the card number populates automatically into the booking confirmation.
Transaction: The merchant processes the virtual card like any other credit card. The card network validates the transaction against the configured controls. Charges that exceed the cap or hit a restricted merchant category are declined instantly.
Closure: After the transaction completes (or the expiration passes), the card number becomes inactive. A compromised number is worthless to a fraudster because it no longer authorizes payments.

This lifecycle eliminates the persistent exposure problem that physical cards create. A 2025 J.P. Morgan analysis noted that single-use virtual cards prevent post-transaction fraud entirely because the credentials expire the moment the authorized payment clears [2].

Virtual Cards vs. Physical Corporate Cards

The practical differences matter most for finance teams evaluating payment controls:

Attribute	Virtual Card	Physical Corporate Card
Number persistence	Single-use or short-lived	Static number used for years
Fraud exposure	Limited to one transaction or vendor	Entire credit line if number is stolen
Issuance speed	Instant (seconds)	5-10 business days for physical delivery
Spending controls	Per-card limits, MCC locks, vendor locks	Per-cardholder limits only
Reconciliation data	Pre-coded to cost center, trip, or project	Requires manual categorization
In-person use	Limited (some support mobile wallets)	Full in-person acceptance

Physical cards remain essential for in-person purchases: hotel check-ins requiring a card present, car rental deposits, and point-of-sale transactions. Virtual cards dominate in digital and B2B payment scenarios where the card number is entered manually or transmitted electronically.

The most effective corporate payment programs use both. Physical cards handle the employee's in-person spending during travel, while virtual cards manage the automated credit card reconciliation behind bookings, vendor payments, and subscriptions.

Why Finance Teams Use Virtual Cards for Business Travel

Travel is the category where virtual cards deliver the most measurable value, for three reasons:

Per-booking fraud containment. A corporate traveler who books 40 trips per year exposes a static card number to 40 different merchants (airlines, hotels, ground transport). If any merchant suffers a data breach, the card is compromised across all future bookings. Virtual cards isolate each booking to its own number. When that hotel reservation completes, the number dies. The 2025 Juniper Research report identified fraud reduction as the primary adoption driver in travel expense management, with virtual cards eliminating the need for card replacement cycles after vendor breaches [1].

Automatic reconciliation. Because each virtual card maps to one booking or one vendor, the transaction data arrives pre-categorized. The $389 charge on card ending 4821 matches the San Francisco hotel reservation for March 12. No receipt hunting, no manual matching, no ambiguous charges. Finance teams using integrated platforms report closing travel expense reconciliation cycles 40% faster than teams relying on shared physical cards [4]. This is why virtual credit cards for corporate travel have become the default payment method for managed booking programs.

Policy enforcement before the spend. Physical cards enforce policy reactively: the employee charges the card, then a reviewer flags violations days later. Virtual cards enforce policy proactively. A card generated for a $200/night hotel stay simply won't process a $350 charge. The policy is built into the payment instrument itself, not layered on top of it after the money moves.

Best Practices for Managing Virtual Card Programs

Organizations that extract the most value from virtual cards follow four principles:

1. Issue one card per booking, not one card per employee. The point of virtual cards is per-transaction control. Issuing a single virtual card to cover "all of Q3 travel" recreates the same exposure as a physical card. The benefits of virtual cards only materialize when each card has a narrow, defined purpose.

2. Set expiration windows tight. A virtual card for a two-night hotel stay doesn't need to remain active for 30 days. Configure expiration to 24-48 hours after the expected checkout. This eliminates the window for unauthorized post-stay charges that hotels occasionally apply (minibar disputes, damage claims filed late).

3. Use MCC restrictions as a first-line defense. Merchant category codes classify every card transaction by business type. A virtual card issued for airfare should only work at airline merchants (MCC 3000-3299 and 4511). If someone attempts to use the card number at a retail store, the transaction is declined before it processes.

4. Connect virtual card data to the GL in real time. Virtual cards generate structured transaction data (amount, merchant, date, cost center) at the moment of purchase. Platforms that push this data into the general ledger or ERP immediately eliminate the manual journal entry step that causes month-end close delays.

When Should You Consider Alternatives to Virtual Cards?

Virtual cards work best for digital, card-not-present transactions. Other payment methods fit better in specific scenarios:

In-person travel expenses: Hotels and car rental counters often require a physical card for deposits and incidentals. A P-card or corporate card handles these situations where card-present verification is mandatory.
High-value capital purchases: Transactions exceeding typical card limits ($50,000+) usually require wire transfers or purchase orders with formal procurement approval.
Vendors that don't accept cards: Some international suppliers, particularly in manufacturing and logistics, only process bank transfers. Virtual cards only work within the card-network acceptance ecosystem.
Petty cash and per diem scenarios: Low-value, high-frequency purchases in cash-heavy markets may be simpler to handle through direct reimbursement than through individual virtual card generation.

Corporate Payments Platform: The centralized payment management system that issues, controls, and reconciles both virtual and physical corporate cards for business spending.
Ghost Card: A persistent card number assigned to a department or cost center (rather than an individual) for recurring vendor payments, often used alongside virtual cards in corporate payment programs.
Expense Reconciliation: The process of matching corporate card transactions to receipts, approvals, and accounting codes at month-end, significantly streamlined when virtual cards pre-categorize each charge at issuance.

Sources

[1] Juniper Research, "B2B Spending to Dominate Global Virtual Cards Market," May 2025, https://www.juniperresearch.com/press/b2b-spending-to-dominate-global-virtual-cards-market/

[2] J.P. Morgan, "What is a Virtual Credit Card and How Does It Work?," 2025, https://www.jpmorgan.com/insights/treasury/cards-expense-management/what-is-a-virtual-credit-card-and-how-does-it-work

[3] Grand View Research, "Virtual Cards Market Size, Share And Trends Report, 2030," 2025, https://www.grandviewresearch.com/industry-analysis/virtual-cards-market-report

[4] Forrester Consulting, "The Total Economic Impact of Navan" (commissioned by Navan), November 2025, https://navan.com/resources/reports/forrester-tei

Frequently Asked Questions About Virtual Cards

A virtual card is a digitally generated payment number (16 digits, expiration, CVV) that processes transactions on standard card networks without physical plastic. It's created on demand, configured with spending limits and merchant restrictions, and typically expires after one use or a set time period. Merchants process it identically to a physical credit card.
Virtual cards are inherently more secure than physical cards because each number is limited to one transaction, one vendor, or a short time window. A compromised number cannot be reused for unauthorized purchases. Navan adds configurable merchant category restrictions and real-time spending caps that decline any charge violating pre-set controls.
A corporate card is a static, named card issued to an individual employee for ongoing use across many merchants. A virtual card is a temporary, purpose-specific number generated for one transaction or vendor. Corporate cards offer convenience for recurring in-person purchases; virtual cards offer per-transaction security and automatic reconciliation data.
Some virtual cards can be added to mobile wallets (Apple Pay, Google Pay) for tap-to-pay at physical terminals. However, hotels and car rental counters that require a physical card for deposits and incidentals typically cannot accept a virtual-only credential. Most organizations pair virtual cards for online bookings with physical cards for in-person travel expenses.
Each virtual card maps to a specific booking, vendor, or cost center at the time of creation. When the charge posts, it arrives pre-categorized with structured data (amount, merchant, purpose) that matches directly to the original request. Navan connects this data to the general ledger in real time, eliminating the manual receipt-matching and categorization step that delays month-end close.
Businesses use three primary types: single-use cards (one transaction, then void), vendor-locked cards (tied to a specific supplier for recurring payments), and time-limited cards (active for a set period like a business trip). Each type serves different payment scenarios, from one-time conference registrations to ongoing software subscriptions and multi-day travel bookings.