How virtual cards can protect your payments against fraud

When was the last time you wrote a check? If you’re like most people, it’s probably been a while – maybe even long enough that you’re not sure where your checkbook is. While digital payments have become second nature in our personal lives, the business world tells a different story. A surprising number of companies still rely on paper checks to handle payments, even as more efficient options continue to grow.

Top-performing AP departments, however, are shifting towards a strategic mix of payment methods to optimize working capital, and checks might always have a place in that mix. But as check fraud schemes become increasingly sophisticated, the need for more secure payment alternatives has grown.

Consider these indicators:

According to the 2025 AFP® Payments Fraud and Control Survey Report published by the Association for Finance Professionals:

• In 2024, attempted payments fraud remained a persistent threat, with 79% of organizations reporting they were targeted – a minor decline from 80% in 2023.
• According to 63% of respondents, checks remain the payment form that is most susceptible to fraud.
• According to 20% of respondents that were the victim of fraud, their organizations were unable to get back the money they had lost to fraud.
• In 2024, 63% of respondents reported incidents of business email compromise (BEC), with paper checks remaining a common target. These schemes are evolving in complexity, presenting a growing risk to organizations.

Fraud involving virtual credit cards is far less common due to built-in security features, making them significantly safer than checks. These unique, cardless account numbers are assigned to specific suppliers or individuals, for a set amount and date range. Strong control features make them an ideal defense against payment fraud.

While no payment method is 100% immune to fraud, virtual cards are significantly more secure than checks. Five features help prevent theft and protect your payments against loss.

Five-point virtual payment protection

Unique account number

Virtual card numbers are coded for a specific supplier or individual and a set amount. They can’t be processed without the correct supplier or individual credentials, and they can’t be charged for an unauthorized amount.

Automatic deactivation

Once a payment is processed, a virtual account number automatically becomes inactive and can’t be used again. This reduces the risk of digital payments fraud as well as accidental duplicate charges.

MCC controls

Organizations can designate allowable merchant category codes (MCC) for their program. Digital payments fraud prevention can be enhanced by blocking MCC that your organization wouldn’t likely be making payments to.

Account number expiration

Virtual credit cards can be coded with expiration dates to ensure that payments are made and processed in a timely manner. If a payment isn’t processed within the allowable timeframe, the account number expires and can’t be charged, reducing the risk of digital payments fraud. Shortening the active window further limits exposure to fraud.

Liability waiver

Virtual cards carry liability protection – a significant advantage that organizations often overlook or aren’t aware of. In the unlikely event that virtual credit card fraud occurs, the loss is covered by the paying organization’s commercial card association. Visa® and Mastercard® offer similar liability waiver protections. If a virtual account number is processed for an unauthorized charge, organizations have the same chargeback rights as “card – not - present” commercial card transactions. That means that if virtual card fraud is reported according to contract terms, the paying organization won’t be liable for the loss.

Mount a strong defense

The best defense against fraud is to prevent it from happening in the first place. If your organization doesn’t conduct regular reviews of its payment security policies and practices, make that the first priority. Plans should address scams initiated by individuals – such as phone calls and letters – as well as automated, electronic cybercrimes like business email compromise, phishing and hacking. Are procedures in place? Do employees have the tools and training they need to put them into practice?

Review current payment methods

Consider the security features of your organization’s payment methods. If your AP department relies heavily on check payments, the addition of virtual cards could reduce your exposure to fraud. And your card association’s liability waiver can provide an additional layer of protection against loss.