Virtual cards

The issuer of a virtual card holds the issuing license of the card scheme and carries the final liability for the card, which is why the issuer is also called the BIN sponsor. An issuer processor such as Marqeta converts the authorization message of the network, checks the spend controls of the card and returns an approval or a decline. A company that wants to decide on each payment itself can run its own gateway, and Marqeta gives that gateway three seconds to answer. Thredd works as an issuer processor of the same kind for banks and fintechs that run debit, credit, prepaid and virtual card programs.

Fintechs and spend management companies without a license of their own issue their cards through such a sponsor bank. The corporate and commercial Visa cards of the US company Ramp, for example, are issued by Celtic Bank, Column, Sutton Bank and Lead Bank under a license from Visa USA. Stripe offers card issuing with partner banks in the US, the UK and much of the European Economic Area, where a virtual card can be used as soon as it is created and costs 0.10 euros in the EU. Budgets and approval rules for employee cards sit one layer higher, in spend management.

A virtual card can also live in a mobile wallet on a phone. Stripe lets cardholders add a virtual card to Apple Pay, Google Pay or Samsung Pay, and the wallet then holds a token in place of the card number. The same network tokenization protects card numbers that merchants keep on file, and the card schemes build their payment tokens for AI agents on it.

In accounts payable, the buyer pays an invoice with a card number created for that supplier or for that single invoice. Visa Commercial Pay runs such supplier payments on one platform, matches the payment data for reconciliation and lets the buyer keep the money longer before the card bill is due. In the euro area a supplier invoice is usually paid by SEPA transfer, so B2B payments by card need a supplier that accepts cards and pays the acceptance fees.

Suppliers often receive many virtual card payments a day, each bank with its own process, and Visa called this acceptance manual, time-consuming and costly when it started a pilot of Visa Accounts Receivable Manager in October 2023. The service retrieves the card details, runs authorization and clearing for the supplier and sends reconciliation data back, so the invoice can be closed in the ERP system. On 27 May 2026 Visa announced that issuers on its Commercial Solutions Hub can send virtual card payments for their corporate buyers through this service, with a launch expected in September 2026 in 69 geographies.

In business travel, a travel agency or a booking platform pays hotels and airlines on behalf of the traveler, often with one virtual card per booking. For travel intermediaries, Visa Commercial Pay captures booking and transaction data automatically and reconciles the payments without manual matching. Employees can add their virtual travel cards to a mobile wallet and pay for expenses on the road.

Checkout.com, the payment company from London, has issued physical and virtual Visa cards for its merchants in the UK and Europe since 30 July 2025. Travel businesses pay their hotel and travel partners with these cards from the money that Checkout.com has already collected from their customers, so the card account needs no pre-funding.

When Mastercard presented Agent Pay on 29 April 2025, the company introduced Agentic Tokens, which build on the tokens used for contactless payments, stored cards and Payment Passkeys. Mastercard described the business case with a small textile company whose AI agent sources material from a supplier abroad, negotiates the payment terms and pays with a Mastercard virtual corporate card token. Mastercard named IBM with its watsonx Orchestrate product as a partner for such B2B use cases, and Checkout.com as one of the acquirers that would bring the tokens to merchants.

Visa follows the same approach with Visa Intelligent Commerce, where an agent pays with a tokenized Visa credential inside the limits that the cardholder has set. Agents that pay without any card at all, through stablecoins or account-to-account payments, belong to the wider field of agentic payments.

The US spend management company Ramp gives each agent an identity, an owner, a budget and approved ways to pay, with every payment recorded as the agent works. Its Agent Card hands an agent card credentials for a browser checkout, and the agent follows the spend limit, merchant rules and approval policies of the fund it uses. In March 2026 Ramp said that it would deploy Visa Intelligent Commerce and the Visa Trusted Agent Protocol across its more than 50,000 customers, while Visa itself became a Ramp customer.

The EU caps on interchange fees leave out commercial cards, and the rules on card acceptance draw the same distinction. Under Article 10 of the Interchange Fee Regulation, a card scheme may oblige a merchant to accept all consumer cards of one brand and category, but a merchant that accepts consumer Visa cards may still refuse commercial ones. Article 10 (5) obliges issuers to make every card electronically identifiable as a credit, debit, prepaid or commercial card, so the checkout can tell a virtual corporate card from a consumer card.

The ban on surcharges in Article 62 (4) of the Payment Services Directive covers only payment instruments whose interchange fees are capped, and commercial cards are not among them. Article 62 (5) lets member states limit surcharges further, and any surcharge must stay within the direct costs of the merchant under Article 62 (3). In Germany, section 270a of the Civil Code (in German) voids card fees only for consumer payments under the capped regime, so a supplier may charge a business customer for paying with a virtual corporate card.

The second Payment Services Directive lets a card issuer and a business customer depart from several consumer protections in their card agreement. Under Article 61 (1), they may agree that Articles 72, 74, 76, 77, 80 and 89 do not apply in whole or in part, which includes the evidence on authentication and the liability for unauthorized payments. A company that hands virtual cards to employees or to AI agents therefore finds its share of fraud losses in the card agreement, and the consumer limits may not apply.

Strong customer authentication has its own exemption for company payments in Article 17 of the regulatory technical standards. In June 2019 the European Banking Authority answered a question on lodged and virtual cards and confirmed that payment service providers may apply the exemption to card payments that only payers who are not consumers can use. Only the payment service provider of the payer decides on the exemption, and the supervisor has to find the process at least as secure as authentication under PSD2.

A virtual card is a payment card without plastic, issued as a card number with expiry date and security code for online and mobile wallet payments. Companies often create one card per supplier or per trip, so that each card carries its own limit and its own payment history.

Both kinds of card run on the same card network and carry the same card details, but a virtual card exists only in an app, a browser or a mobile wallet. A virtual card is ready as soon as the issuer creates it, while a plastic card first has to be produced and sent to the cardholder.

A single-use virtual card is a card number that the issuer closes after one payment or after a fixed amount has been spent. Issuing platforms set such rules through spending controls with a limit per authorization and a list of allowed merchant categories, so the number fails at any other merchant or for a higher amount.

Yes, when the issuer supports it, the cardholder adds the virtual card to Apple Pay, Google Pay or Samsung Pay and can then pay at card terminals as well. Stripe supports these wallets for the virtual cards it issues, although the lead times for each wallet vary by region.

A virtual card limits the damage of a leaked card number, because it can be tied to one merchant or one amount and switched off after use. The card details still need protection: under PCI DSS, a company that creates virtual cards for its own users may count as a service provider and must then be compliant with the standard.