Are Virtual Account Numbers the Answer to Data Security?
Virtual account numbers, or VANs, are a type of temporary alias for credit card numbers. They work just like a credit card number during a transaction, but keep the REAL cardholder information locked away, safely hidden from prying eyes. It’s one of the newest techniques banks offer to protect customer data.
How Virtual Account Numbers Work
A virtual account number functions as a substitute for your actual credit card number. It interacts with the merchant while the real account number stays out of sight. From the processing side, VANs are treated exactly as a credit card number.
The difference is that a VAN is only good for a limited number of transactions (usually only one). If hackers steal your actual account number during a transaction, they can make as many purchases as they want until the fraud is discovered. If they hijack your virtual account number, though, all they get is a bunch of digits in a row.
A VAN is similar to the tokenization technology implemented with chip cards after the EMV liability shift. The number might be randomly generated at the time of purchase and work only for that specific transaction. Some programs, on the other hand, allow the cardholder to set a spending cap or time limit on the number. This means the card might be good for months into the future...but only up to a certain dollar amount.
Cardholders typically have to opt-in, and possibly download an app or a browser extension before using the service. When it comes time to make a purchase, the program requires some sort of customer authentication, typically a username and password. The issuing bank then creates a “proxy” credit card number that functions exactly like a real credit card number when completing card-not-present (CNP) transactions.
In theory—and largely in practice—there is no way to trace this randomly generated number to the legitimate cardholder information. Even if a fraudster DOES manage to steal a VAN, it will typically have already expired before the fraudster can use it.
Are Virtual Account Numbers Necessary?
It’s safe to say that using a VAN mitigates the risk of account data theft with no meaningful impact on the user experience. It does not completely eliminate the danger, but it’s a good step.
To demonstrate this, let’s look at a scenario where a customer is buying from an online store. There’s an accepted risk here: handing over one’s card number, billing address, expiration date, and security code carries with it the possibility that the merchant could use the information to buy plane tickets to Tahiti and just disappear.
The smaller or newer a store is, the greater the risk. Buying from a larger and/or more established online merchant like Apple or Wal-Mart dramatically lessens the odds of that happening ... but there’s a tradeoff.
The larger or more global a merchant is, the more likely cardholders’ information is held in cloud storage or in a massive database. Having that much information in one spot makes such databases prime targets for hackers. As you can see, both instances leave the customer’s personal data vulnerable to some extent.
By using a virtual account number, however, the cardholder is ensuring that only the cardholder and the bank have the REAL number. It’s a great way to protect personal data…but it’s not perfect.
The Downside of Virtual Account Numbers
While using virtual card numbers is effective, there are certain situations that can make them cumbersome or less than totally effective. For example:
The Program Only Works Online
Customers who do a lot of online shopping stand to benefit the most from using VANs because the program doesn’t affect “card present” transactions. There’s no proxy number generated for a POS purchase. The only exceptions would be in specific circumstances, like when a business travel manager issues a virtual credit card for traveling associates.
Returns Can Be a Hassle
For online purchases, refunds are normally credited to the card that was used for the initial transaction. That’s fine, except that with VANs, that card number no longer exists. That’s not to say the customer can’t get a refund, but it could take more effort and more time. This is particularly troublesome for merchants, since a complicated return process greatly increases the potential for a chargeback.
Verification Causes Issues
There are some instances where even transactions made online or by phone still require a physical credit card. When a cardholder is renting a car, for example, the rental agency will want to see the same credit card used to make the reservation…and again, a card with that particular number doesn’t exist. As of now, there is no universal policy for how a merchant should handle that, but the process tends to be unwieldy.
The Essential Guide to Global eCommerce
Our new whitepaper takes a close look at eCommerce practices around the world. We carefully examined data on markets from Africa to Asia and beyond, all to assemble a thorough, predictive picture of where eCommerce is headed over the next several years.FREE DOWNLOAD
There’s No Additional Protection
This isn’t really a negative so much as a lack of positive. While using a VAN lowers the chances of a card being stolen, it offers nothing in the way of extra liability protection.
All credit cards have built-in limits on liability: no matter how many fraudulent charges a thief might make with a stolen card, the cardholder is liable for no more than $50 (often less). Using a virtual account number doesn’t decrease coverage, but it doesn’t increase it, either. VANs can help keep card numbers from being stolen. If the number IS stolen, though, the cardholder will be in the same position as not having used the VAN at all.
They’re Not Yet Widely Offered
If there’s a single reason why more people aren’t taking advantage of virtual account numbers, it’s that so few banks are offering them. Only two major banks have VAN programs as of this writing: CapitalOne and Citibank. CapitalOne offers all cardholders the ability to create virtual card numbers through their Eno® application. For their part, Citi offers the service only to holders of select cards.
Bank of America did offer the ShopSafe® program, which allowed users to create virtual credit card numbers through their online account. That program was discontinued, though. Other banks are rumored to be testing VAN programs, but none have been announced to date.
Going Forward with VANs
Virtual account numbers aren’t a silver bullet against ID theft, but they can act as an obstacle between hackers and cardholders’ personal data. Having said that, it’s also worth noting that virtual credit card numbers:
- Aren’t always convenient to use
- Can cause verification issues
- Offer no additional liability protection if the card number is stolen
- Aren’t universally offered
When they are available, however, virtual credit card numbers allow consumers to act positively to protect their financial information. For cardholders who shop online frequently, virtual account numbers offer a new degree of consumer data protection.