Can virtual credit cards shield you against identity theft?
While virtual credit cards are gaining popularity thanks to their added layer of security and ability to protect user data online, they also have limitations
With credit card fraud and data breaches on the rise, consumers have grown wary of sharing personal and financial information online. Following last year’s Optus attack, the industry has welcomed recent changes to Australia’s Telecommunications Regulations, allowing companies to share customer data with financial institutions to prevent fraud. However, more protections are needed across all areas of business, and reducing the impact of identity fraud on consumers will require a significant and collaborative effort between governments and industries.
Latitude Financial is the latest big company to announce a cyberattack that exposed the data of 14 million customers. Following Latitude’s subsequent exit from the Australian market, it’s important to consider what safe digital payment solutions currently exist for online shoppers. For example, some say virtual credit cards offer an added layer of security for online shoppers, and in Australia, they have become increasingly popular. With a focus on protecting users’ data online, we recently asked two UNSW Sydney experts to explore the pros and cons of virtual credit cards and their likely proliferation across the country.
Read more: Could decentralised identities stop cybersecurity breaches?
What is the risk associated with digital payments?
In recent years, virtual credit cards have been increasingly used to prevent identity theft from payment services. Do these developments mean traditional, physical cards might soon be out? Not necessarily, says Arash Shaghaghi, Senior Lecturer in Cyber Security at the School of Computer Science and Engineering (CSE) and UNSW Institute for Cybersecurity (UNSW IFCYBER).
According to Dr Shaghaghi, it’s essential to understand the risks of any digital payment. This is because cyber attackers with access to a user’s credit card details don’t just pose financial threats to a user; they may be able to retrieve a wide range of other sensitive, personally identifiable information about a user, such as a home address, employer, and purchase history. He says hackers may use stolen financial information to open new bank accounts, take out loans, and steal a user’s identity.
“Virtual credit cards are like physical credit cards but offer further protection against criminals that attempt to steal information. A virtual credit card masks the numbers of an actual credit card. A virtual credit card number is linked to your existing account, but the service provider or merchant cannot see your actual card number,” explains Dr Shaghaghi.
“This implies that the actual account is not compromised if the service provider suffers from a data breach, such as in the recent Optus or Medibank cases,” he says.
How do virtual credit cards work?
A virtual credit card generates a card number that is generally (but not always) single-use, explains Dr Shaghaghi.
“Some issuers use one virtual card number for a card with a new CVC for each merchant. Other issuers create separate virtual card numbers for each merchant. So you can create new numbers for your account and use them for different stores, set spending limits, lock a card, or even delete it without worrying about your real account,” he explains.
“Reusing their credit card details may be more difficult if users fall victim to cyber-attacks such as phishing or social engineering and give away their credit card information,” he says.
But what about other forms of digital payment, like, Apple Pay? Do they offer protection? Research has indicated that 46.5 per cent of Australians now have a digital wallet on their smartphone. And of those that use digital wallets, 15.9 per cent use them all the time, while 43.3 per cent use them most of the time.
“If you use a digital wallet such as Apple Pay or Google Pay, you may already use a virtual credit card. Apple Pay uses a device-specific number and unique transaction code when making purchases. Apple Pay does not share card numbers with merchants but a tokenised, virtual credit card number,” explains Dr Shaghaghi.
“However, these digital wallets do not provide the same security and privacy customisation as virtual credit cards (e.g., merchant-specific card numbers, limit controls, etc.) provided by a financial institution,” he says.
A caveat of digital wallets is that they are not supported by all websites. “Hence, virtual credit cards offered by credit card companies may still be a better option or complement digital wallets. In fact, Google Pay and Apple Pay support using virtual credit cards offered by some financial institutions and provide users with merchant-specific virtual credit card numbers,” he says.
To summarise, Dr Shaghaghi says third-party virtual debit card service providers require users to manually top-up funds but still offer options to hide user information by generating merchant-specific card details. “These cards and other disposable debit card options may offer a sound choice for users concerned about using merchants that are reluctant to trust (e.g., lesser-known websites),” he says.
Read more: Five ways to protect your data and prevent identity theft
The pros and cons of virtual credit cards
Consumers need to be aware of the pros and cons of virtual credit cards before deciding to use them, says UNSW Business School’s Dr Kam-Fung (Henry) Cheung, Lecturer at the School of Information Systems and Technology Management (ISTM).
“Identity theft can significantly impact credit scores, as it can result in fraudulent charges or accounts being opened in the victim’s name. For example, if a fraudster uses a victim’s identity to take out loans, any missed payments or defaults with those accounts will appear on the victim's credit report. This negative information can lower the victim's credit score and make it harder to obtain credit in the future,” explains Dr Cheung.
He agrees that virtual credit cards offer an extra layer of security when making online purchases. They can also help with budgeting by allowing you to load a specific amount of money onto the card. “This feature helps prevent overspending and can be a useful tool for those looking to stick to a budget,” explains Dr Cheung.
In addition, he says the convenience of virtual credit cards is undeniable since they can be easily created when needed and provide a hassle-free way to make online purchases.
But at the same time, there are several cons users need to be aware of. A big one is that not all online merchants accept them, so it’s important to check with the merchant beforehand to ensure you can use a virtual card to make your purchase, says Dr Cheung.
He adds that another important limitation of virtual credit cards is they can only be used for online or over-the-phone transactions; they cannot be used to make in-person purchases or withdraw cash from an ATM.
Finally, a potential issue with virtual credit cards is their validity period. “Since they are only valid for a short time, there may be complications when processing refunds. Merchants may have trouble refunding the full amount if the virtual card has already expired,” explains Dr Cheung.
Will virtual credit cards replace physical ones?
Dr Shaghaghi says virtual credit cards may be less convenient for non-tech-savvy users since some virtual credit card providers require a specific browser extension to provide the user with virtual credit card numbers.
“Depending on a merchant’s payment processing system, customers may face difficulty processing refunds and returns. However, these issues are not major and could be resolved by increasing the usage of virtual credit cards and better support,” he says.
Finally, they may also give users a false sense of security. Dr Shaghaghi explains: “Depending on the settings, reusing a virtual credit number may still be possible for an attacker (although with some limitations)... it may also be possible for an attacker to trick the user and use a virtual credit card number for a fraudulent website. So, it’s essential that users still monitor their accounts and take precautions.”
So while virtual credit cards have the potential to replace physical ones in the future as digital payments become more prevalent and security concerns continue to rise, Dr Shaghaghi says there are still considerable limitations. He adds that some users may still prefer physical credit cards for various reasons, such as the ability to use them for in-person purchases and the familiarity of having a physical card.
“It is difficult to predict when or if virtual credit cards will completely replace physical ones, as it largely depends on the adoption rate of digital payments and the level of trust that consumers have in virtual credit card technology,” reiterates Dr Cheung.
“As technology continues to advance and digital payments become more mainstream, it is possible that virtual credit cards could become more widely adopted and eventually replace physical credit cards as the primary payment method for many users.”
Subscribe to BusinessThink for the latest research, analysis and insights from UNSW Business School
Importantly, Dr Cheung says there is no single “safest” type of digital payment. “Credit cards, mobile payment apps like Apple Pay, and virtual credit cards are generally considered to be more secure digital payment methods,” he says. “However, it’s important to note that no payment method is 100 per cent secure, and users should always take steps to protect their personal and financial information when paying digitally.”
Finally, he says for those wanting to be cautious, there are five easy steps that users can take to protect themselves when paying digitally:
- Use a secure payment method (like a credit card or a reputable mobile app like Apple Pay).
- Always verify the recipient before making a payment.
- Use secure password-protected Wi-Fi or cellular networks, and avoid paying for public Wi-Fi networks.
- Update software and apps with the latest security patches.
- Use a strong password for your payment accounts and use multi-factor authentication whenever possible to provide an extra layer of security.