Virtual card issuance is the creation of payment cards that exist only as data: a card number, expiry date and security code delivered through an API or an app, with no plastic. The card still runs on a network such as Visa or Mastercard, and a bank still issues it. What changes is speed and control, from single-use supplier payments to cards added straight to a mobile wallet.
How virtual card issuance works
A virtual card program is set up once and then used many times. The setup covers the issuing bank, the card network, the BIN range (the first digits of the card number, which identify the issuer) and the processor. After that, each new card is an API call.
Lithic’s API shows the pattern. A request to create a card with the type VIRTUAL returns a card that works for card-not-present payments and can be added to Apple Pay or Google Pay if the program is enabled for digital wallets. Lithic returns the full card number and security code in production only to clients that have verified PCI compliance. PCI DSS is the card industry’s data security standard.
When the card is used, the merchant’s acquirer sends the authorization through the network to the issuer processor, which approves or declines it under the program’s rules. Some processors move money only at that moment. Marqeta’s annual report describes its Just-in-Time Funding: the card keeps a zero balance until a transaction is approved, and funds then move from a named funding source.
Who does what in a virtual card program
| Role | What it does | Example in public documents |
|---|---|---|
| Issuing bank (BIN sponsor) | Holds the network membership and BIN, approves the program, carries the regulatory duties | Sutton Bank settled 64% of Marqeta’s 2025 processing volume; Patriot Bank issues Lithic’s prepaid incentive card |
| Card network | Sets the rules, routes authorizations, settles funds, runs tokenization | Visa, Mastercard; Marqeta names Visa, Mastercard and PULSE |
| Issuer processor | Keeps the ledger, makes authorization decisions, exposes the API | Marqeta, Lithic, Highnote, Thredd |
| Program manager | Designs the program, manages compliance with bank and network rules | Marqeta Program Management, Lithic Program Management |
| Brand (your company) | Owns the product and the end-user relationship | A spend-management app, a marketplace, a SaaS platform |
Some platforms bundle several roles. Unit and Synctera sell accounts, payments and cards on top of partner banks. Thredd is a processor for debit, credit, prepaid and virtual cards. The card issuing guides cover the layer in more depth.
Card types and spend controls
The main advantage of a virtual card is that each number can carry its own limits. Lithic’s API lists these card types:
VIRTUAL: works at any merchant and can be added to a digital wallet.SINGLE_USE: closes after the first successful authorization.MERCHANT_LOCKED: locks to the first merchant that successfully authorizes it.PHYSICAL: manufactured and mailed, and usable online and in stores.
Spend limits can apply per transaction, per month, per year or for the card’s lifetime. Authorization rules can allow or block merchant category codes (MCCs, the network codes that describe a merchant’s business) and countries.
Controls have gaps. Lithic notes that merchants may still submit “force post” charges, a clearing without a prior authorization, which it cannot decline. These may be subject to chargeback.
Tokenization is a separate layer
A virtual card number and a network token are different things. Visa’s developer documentation describes the Visa Token Service as replacing the 16-digit primary account number (PAN) with a unique token of the same length and format. With the issuer’s approval, Visa shares the token with a wallet or merchant. A token can be limited to one device, one e-commerce merchant or a number of purchases.
So a program can issue a virtual card and then tokenize it into Apple Pay. Marqeta lists tokenization and digital wallet provisioning on its issuing page. Unit says customers can add its cards to Apple Wallet, Google Wallet and Samsung Pay. Synctera’s cards page lists digital wallet tokens through its API.
Virtual cards for business payables
Business-to-business payments are a large use case. Visa’s B2B Virtual Account Payment Method is a set of APIs for requesting virtual accounts with authorization controls, setting up pools of single-use accounts and paying suppliers. It supports supplier-initiated payments, where the supplier charges the card, and buyer-initiated payments, where funds go straight to the supplier’s merchant account.
Visa states that a third party cannot use these APIs without an issuer. Its partner page adds that a fintech needs a BIN sponsor that supports commercial payments, or a direct Visa license. Visa’s Supplier Matching Service checks a buyer’s supplier list against Visa’s database of merchants that accept commercial cards. For the wider model, see b2b embedded finance.
US rules that follow the card
Form factor does not change the law. Regulation E covers electronic fund transfers from consumer accounts, meaning accounts “established primarily for personal, family, or household purposes.” It defines an access device as “a card, code, or other means of access,” so a virtual card on a consumer account qualifies.
- Liability limits. A consumer who reports a lost or stolen access device within two business days is liable for no more than $50. Later reports can raise that to $500. Transfers reported more than 60 days after the statement showing them can leave the consumer liable for more.
- Prepaid accounts. The CFPB’s Prepaid Rule took effect April 1, 2019. It adds tailored disclosures, liability and error-resolution rights, and periodic statement rules for prepaid accounts.
- Business cards. A card on an account held for business purposes falls outside Regulation E’s account definition. Network rules and the cardholder agreement then do most of the work.
Regulation II also reaches virtual cards. Its definition of a debit card includes any “payment code or device” and general-use prepaid cards. Since July 1, 2023, the Federal Reserve’s rule has required issuers to enable at least two unaffiliated networks for card-not-present debit transactions too. The interchange cap is covered in our debit card issuing guide. None of this is legal advice.
Questions to ask a provider
- Is the program program-managed, or processing only with our own bank?
- Which bank issues the cards, and does it sponsor commercial as well as consumer BINs?
- Which card types are available: single-use, merchant-locked, multi-use?
- Is funding prefunded, or decided at authorization time?
- Can we display card numbers without holding PCI scope ourselves?
- Is the program enabled for wallet tokenization, and on which networks?
- Which countries and currencies are supported?
- Is pricing published? Marqeta and Lithic do not publish issuing prices.
Choosing the bank behind the program is its own decision. See how to choose a sponsor bank and the profiles of Sutton Bank and Patriot Bank. Processor profiles: Marqeta, Lithic, Highnote.
