Ask a Techspert: How do virtual cards work for online shopping?

As convenient as online shopping can be, there’s probably been a time or two when you’ve had second thoughts about sharing your credit card information online. Maybe a business has a slightly unusual URL or you’re paying for something on a site that you got to via QR code. Everyone wants to protect themselves from anything that could put their credit card safety at risk.

Something that can keep your credit card information safer that you might not be using is a virtual card. Google’s virtual cards use machine learning and advanced technology to make online shopping safer and easier. I wanted to know more about how exactly they work and how I can get one — so I got in touch with Google Pay director of product Rajiv Appana.

Tell me about your area of expertise at Google — if you had to describe your job to someone who doesn’t work in tech, what would you say?

I lead product management for Google Pay, so anything related to online payments falls under my area. Our goal is to make online payments safe, simple and secure.

I was trying to think back to the first time I bought something online. It almost felt sketchy. What do you remember about the early days of online shopping?

A lot of people felt like you — they were worried about putting their credit card number online. Your options those days were to enter your credit card information every time or store your information with different retailers. Since people didn’t feel safe putting their credit card information online, a lot of merchants lost business — people would add items to a cart, go to checkout and then not complete the purchase because they didn’t feel safe putting that information online. It was also cumbersome; no one wanted to type all that information in every time.

Time for one of my favorite inventions ever: autofill.

Yes, if you’re signed in to your Google Account on Chrome or Android and have autofill enabled, you can fill out your payments information with a simple click when you use your credit card online. You don’t have to do it yourself.

That solves the simplicity part of the problem, but we also wanted to address the security part. Whenever your credit card information is provided to a merchant, there is still a risk that this information would potentially be at risk if the site in question were hacked.

Makes sense. What’s the fix?

Virtual cards!

This feels like a silly question, but doesn’t just using my credit card online make it a virtual card?

Not quite. A virtual card replaces your actual credit card number with a unique card number to share with businesses. Even if the virtual card number gets stolen, your money is much safer because it wasn’t your actual credit card number. Virtual cards hide your personal payment details when you check out and help protect you against fraud. And when you set up a new virtual card, we’ll use two-factor authentication and text your phone to make sure it’s you.

Got it. So since my actual card number isn't shared, my information is safe?

When you use a virtual card, not only is your actual card information not shared, but it will also change something else about the card in addition to the number. For example, some cards will change the virtual card number for each merchant you shop at, while others will change the CVC or CID, the three- or four-digit security code, in addition to the virtual card number.

From then on, next time you’re checking out, you can select the virtual card option from autofill and your payment information will automatically be filled for you. Occasionally, you may be asked to verify your identity before the form is filled, because Google and your bank will jointly assess the risk at the time of every transaction and determine if you need to verify your identity based on a number of risk factors.

Sounds easy enough.

That’s the idea.

And this isn’t only handy for online shopping. Remember how you felt “sketchy” the first time you entered your credit card information online?

Oh yes.

Let’s say you’re at a restaurant, and it’s using a QR code for a payment site you haven’t heard of. Using a virtual card on your Android phone takes away a lot of the risk. Google Pay will ask if you want to use your virtual card. If you say yes, Google Pay will use machine learning algorithms and work with your bank to fetch the virtual card information and fill it out for you on the seller’s site.

That’s good to know, because I’ve become a big fan of paying the check with QR codes.

Haven’t we all.

I’m sold! How do I sign up? Do I have to pay for this?

Nope. Our virtual cards are available to anyone with an eligible Capital One or American Express credit card. We’re also working on adding Visa and Mastercard, as well as other major banks. A huge help in this process has been working with innovative partners across the payment ecosystem to bring this to life. We launched with Capital One last year, we are rolling out with American Express now, and we look forward to working with the other networks this year.

For now, if you’re checking out online on a Chrome browser or Android phone and you’re using an eligible Capital One or American Express card, you’ll see an option pop up that asks if you’d like to use a virtual card. If you click yes, you’ll be signed up and ready to use your virtual card the next time you check out with autofill.