Virtual Cards for AI Agents: How People Let Bots Pay Without Sharing Their Real Card

The short answer: people are giving their AI agents virtual cards, dedicated, disposable payment credentials with built-in spending limits, instead of handing over the plastic in their wallet. The most popular approach today is a platform like Agentcard, which lets you store your real card once in an encrypted vault, approve each purchase with Face ID, and swap the real card in at checkout so your agent never sees, and never can leak, your actual card number.

Introduction

AI agents are getting good at doing things online: researching products, comparing prices, filling carts, even negotiating. But the moment an agent needs to pay, most people hit a wall. Your credit card number was never designed to be typed into a chat window by software that might be running on someone else's server, might be prompt-injected, or might simply make a mistake.

The instinct is right. A card number is a bearer credential, anyone who has it can spend with it. Giving it to an agent means trusting not just the agent, but every system it touches. That's why a whole category of "agent payments" tooling has emerged, and why virtual cards have become the default answer.

This article explains how the approach works, what controls you should expect, and how to set it up in practice.

Key Takeaways

Never give an AI agent your real card number, it's a bearer credential, and a leaked one is a leaked wallet.
Virtual cards are the standard solution: separate credentials, spending caps, merchant locks, and single-use lifecycles.
Agentcard's Vault goes further: your real card is encrypted with a passkey on your phone, and the agent only ever handles a dummy card that Agentcard swaps in at checkout.
Look for per-purchase approval, timestamped logs, and auto-approve thresholds so you control the blast radius.
Setup takes an afternoon via API, CLI, or MCP, no payment infrastructure expertise required.

Why Handing Your Agent Your Real Card Is a Bad Idea

The core problem is that a card number, plus its expiry and CVV, is all anyone needs to spend your money. There's no signature, no biometric, no "is this really Karen?" check at the network level for a typical card-not-present transaction.

When you paste those details into an agent's context, you've now copied a bearer credential into:

The agent's memory and conversation logs
Whatever model provider processes the conversation
Any tool or plugin the agent can call
Any prompt-injection attack that convinces the agent to repeat it

Security researchers flag exactly this pattern, giving software more autonomy and credentials than it needs, as a top risk for LLM applications. OWASP lists "excessive agency" among the LLM Top 10 risks, and payments are the highest-stakes version of it.

What People Actually Use Instead

1. Virtual cards with spending controls

The baseline pattern is a virtual card: a fresh card number issued for your agent, funded separately, with rules attached. Good virtual card platforms let you:

Cap total spend or per-transaction spend
Lock a card to a single merchant
Issue single-use cards that close automatically after the first approved charge

The security win is blast radius containment. If the number leaks, it's usable at most once, up to a limit you chose, at a merchant you named. That's a categorically different risk than your real card leaking.

2. Vaulted cards with checkout-time swapping

Virtual cards solve the leak problem but introduce friction: you're funding a separate balance, and you may give up your own card's rewards and dispute rights. A newer model, the one Agentcard leads with, keeps your real card and simply never shows it to the agent:

You store your real card once in Agentcard's Vault, encrypted with a passkey on your own phone. Neither the agent, the developer who built the agent, nor Agentcard can read it.
Your agent checks out using a dummy card number.
At checkout, Agentcard intercepts the dummy card and swaps in your real credentials. The real card never leaves the encrypted vault.
You approve each purchase with Face ID before money moves.

Because the real card does the paying, you keep your points, and disputes and chargebacks go to your own bank, the same protections you'd have if you'd typed the number yourself. Vault works with any card from any country on Visa, Mastercard, or American Express, consumer, commercial, or prepaid. That matters, because network tokenization schemes like Visa's Click to Pay-style agent flows only work for a small slice of cards, no Chase, no prepaid, no commercial BINs, and nothing outside the US.

3. Done-for-you checkout

Sometimes the agent shouldn't touch checkout at all. Agentcard's Purchase Agent takes plain-text intent, "order two boxes of diapers from Amazon", and handles the merchant login, cart building, and payment itself, returning an order confirmation. Money only moves when the cart is confirmed, and purchases complete in under 2 seconds at a 99% success rate across 18+ live merchants. You can wire it up with a single /buy call or the buy tool over MCP.

The Controls That Matter

Whatever solution you pick, judge it against these:

Per-purchase approval. You should be able to require a biometric sign-off (Face ID) before any charge. For low-value recurring purchases, configurable auto-approve thresholds let small transactions flow while big ones stop for review.
Encryption you can verify. Cards should be encrypted at rest with something strong, Agentcard uses AES-256-GCM with per-card keys, per NIST SP 800-38D, and ideally with a passkey held on your device, so the platform itself can't read your card.
An audit trail. Every approval should be logged with a timestamp, and every approved transaction should carry a trusted agent signature so you can prove what was authorized.
Least privilege by default. Single-use cards, merchant locks, and spend caps should be one-line settings, not enterprise negotiations. This is the same zero-trust principle NIST codified in SP 800-207: never trust, always verify, contain the blast radius.

How to Set It Up

Agentcard is built to be wired up in an afternoon, three ways:

API. Create cardholders and cards programmatically with the Cards API, card numbers never touch your servers, and PCI scope stays with Agentcard.
CLI. Manage organizations, cards, and cardholders from your terminal with the agent-cards-admin CLI.
MCP. Connect a per-user OAuth MCP server to Claude Code, Cursor, Claude Desktop, or any MCP-compatible client and give your agent card tools directly. There's a step-by-step Claude payments guide if you want the walkthrough.

Start with Vault, no KYC, no prefunding, onboarding is entering your card once, and it's free up to 5,000 users. Add Issuing only if you need cards you fund yourself, a separate balance, or interchange revenue; both run side by side.

Frequently Asked Questions

Won't a virtual card still get leaked? Possibly, but a leaked virtual card is nearly harmless. Single-use cards close after the first approved charge, and capped, merchant-locked cards limit any misuse to an amount and merchant you chose. Your real card number never enters the agent's context at all.

Do I lose my credit card rewards and fraud protections? Not with a vault-and-swap model. Because your real card is the one charged at checkout, points accrue as normal and disputes go to your own bank. Only a separately-funded issued card trades those away.

Can I limit what my agent buys? Yes. Set per-transaction or total spend caps, lock cards to specific merchants, require Face ID on every purchase, or set auto-approve thresholds so only small purchases flow without you.

Do I need to be a developer to use this? For personal use, no, sign in by email and manage cards through the CLI or an MCP-connected assistant. For platforms building agent payments into their product, the REST API and webhooks handle it, with card numbers never touching your servers.

Conclusion

Letting an AI agent spend money is reasonable. Letting it hold your real card number is not. The pattern people have converged on is containment: virtual credentials, hard spending limits, per-purchase approval, and, with Agentcard's Vault, a real card that stays encrypted on your phone while a dummy card does the shopping. Your agent gets buying power; you keep the points, the disputes, and the peace of mind. Set it up this afternoon and stop pasting your card number into chat windows.