What Is a Merchant-Locked Virtual Card?

Merchant-locking is one of the neater security features some virtual cards offer: a card that will only work at a single, pre-chosen merchant and is declined everywhere else. Where it is available, it is a powerful way to neutralise the damage of leaked card details. Here is how it works, when it shines, and a reminder to check whether your provider supports it.

What It Means

When you create a merchant-locked card, you tie it to one specific merchant — say, a particular store or service. From then on, the card approves charges only from that merchant. Any attempt to use it anywhere else is automatically declined, regardless of the correct number, expiry and CVV.

The card is not just limited in amount; it is limited in where it can be spent at all.

Why This Is Powerful

The security payoff shows up in the worst case. Suppose the merchant you locked the card to suffers a data breach and your card details are stolen. On an ordinary card, those details are now usable anywhere — the thief takes them straight to a big retailer and starts spending.

On a merchant-locked card, the leaked details are inert. They only work at the one merchant they were locked to, and the thief cannot use them anywhere else. A breach that would be a crisis on a normal card becomes a non-event.

When It Shines

Merchant-locking is especially useful for:

• Recurring subscriptions. Lock a card to the subscription service, and even if that service is breached, the card is useless elsewhere.
• Any card kept on file. Any time you must store a card with a merchant, locking it to that merchant caps the fallout of a leak.
• High-value or long-standing relationships. The longer a card sits in a merchant's database, the more a lock is worth.

How It Relates to Other Controls

Merchant-locking pairs naturally with the other card controls. A merchant-locked card with a spending limit, for instance, is both restricted in where it works and capped in how much can be charged — two independent walls around the same card. And a single-use card takes the isolation idea to its extreme: used once, then gone.

These are complementary tools, and which ones a given service offers varies.

A Note on Availability

Merchant-locking is a valuable but not universal feature, and the way it is set up differs between providers. If the ability to pin a card to one merchant matters for your security setup, confirm the service you choose actually offers it before you rely on it.

Related Reading

The Bottom Line

A merchant-locked card works at exactly one merchant and is declined everywhere else — so if that merchant is breached, the leaked details are worthless to a thief. It is one of the strongest ways to make "keeping a card on file" safe. A genuinely useful control where offered, so check that your provider supports it before counting on it.