Is a Virtual Account Number the Answer to Data Security?
With the massive number of data breaches over the past few years, the idea of "secure information" has almost become an oxymoron. But where securing data stored online has proven next to impossible, hiding that information from prying eyes might just work. That's the idea—more or less—behind the virtual account number, or VAN.
What Is a Virtual Account Number?
VAN is similar to the tokenization technology implemented with chip cards after the EMV liability shift, but there are also some variations to the program worth noting. The number might be randomly generated at the time of purchase and work only for that specific transaction. Some issuers, on the other hand, allow the cardholder to set a spending cap or time limit on the number, meaning the card might be good for months into the future.
The basic premise, however is the same: an extra layer of security when shopping online or over the phone, as compared to using the same credit card number for all purchases. To date, the system has not garnered mass acceptance, but it may prove to be the most secure way to conduct online business.
How Do Virtual Account Numbers Work?
If using a bank that offers the service, cardholders first have to opt-in. Then, at the time of purchase, the program requires some sort of customer authentication, typically a user name and password. The issuing bank then creates a "proxy" credit card number that functions exactly like a real credit card number when completing card-not-present (CNP) transactions.
In theory, there is no way to trace this randomly generated number to the legitimate cardholder information. Even if a fraudster DOES manage to steal the faux number, the VAN is usually only good for a single transaction.
This all slows down the checkout process a bit, but not significantly. The program will at least fill in most of the other relatively non-secure data (name, address, phone number, etc.).
That is a double-edged sword, though: it's easier at checkout, but it still means customers' personal information is being stored online somewhere, which means it is still at risk. Regardless, using a VAN mitigates the risk of data theft without significantly affecting the user experience.
How Virtual Credit Cards Protect Consumers
Identity theft is an all-encompassing issue, and taking it as a whole can seem overwhelming. Utilizing a bank's VAN program translates into small, easily understood, and highly effective actions a cardholder can take.
To put this another way, consider a customer buying from a new or small online store. There's an accepted risk here: handing over one's card number, billing address, expiration date, and security code carries with it the possibility that the merchant could use the information to buy plane tickets to the Bahamas and just disappear.
Buying from a big online merchant like Apple or Wal-Mart dramatically lessens the odds of that happening, but at that point the cardholder's information is often held in the Cloud or in a massive database—prime targets for hackers. In both instances, the customer's personal data is vulnerable. Using a virtual account number, however, means that only the cardholder and the bank actually have the real number.
It's a great way to protect personal data…but it's not perfect.
The Downside of Virtual Account Numbers
While using virtual card numbers is effective, there are certain situations in which they can be cumbersome or ineffective. For example:
Customers who do a lot of online shopping stand to benefit the most from using VANs, but it's important to remember that the program doesn't affect "card present" transactions. No proxy number is generated for a POS purchase … meaning any time the physical card is swiped, the information is out there where it can be stolen.
For online purchases, refunds are normally credited to the card that was used for the initial transaction. That's fine, except that with VANs, that card number no longer exists. Which is not to say the customer cannot get a refund; only that it could take more effort and more time. This is particularly troublesome from the merchant's perspective, since a complicated return process greatly increases the potential for a chargeback.
There are some instances where even transactions made online or by phone still require a physical credit card. When a cardholder is renting a car, for example, the rental agency will want to see the same credit card used to make the reservation, which is a problem if the card with that number doesn't exist. As of now, there is no universal policy for how a merchant should or will handle this.
This isn't really a negative so much as a lack of positive: while using a VAN lowers the chances of a card being stolen, it offers nothing in the way of extra liability protection.
All credit cards have built-in limits on liability; no matter how many fraudulent charges a thief might make with a stolen card, the cardholder is liable for no more than $50 (often less). Using a VAN doesn't decrease the coverage, but it doesn't increase it, either. VANs may help keep card numbers from being stolen, but if the number IS stolen, the cardholder will be in the same position as not having used the VAN at all.
Going Forward with VANs
Virtual account numbers aren't a silver bullet against ID theft, but they can act as an obstacle between hackers and cardholders' personal data. That said, using virtual credit card numbers:
- Isn't always convenient.
- Only works online.
- Offers no additional liability protection if the card number is stolen.
Still, virtual credit card numbers allow consumers to act positively to protect their financial information. The program has limited availability, but hopefully that will change as the program gains acceptance. For cardholders who shop online frequently, a virtual account number might well be just the ticket to a new degree of consumer data protection.