Usually I can get away with PayPal for online purchases, but sometimes I come across a website that only accepts VISA card.

I refuse to use my VISA card, as my account contains all of my money, and by providing this unknown website with my card details, I'm entirely at their mercy.

What is to stop them from holding onto these details and spooning my account dry a few weeks later? Nothing, as far as I can see.

What are my options?

The only two options I can see are:

  1. create another bank account with a VISA debit card, transfer enough cash for my purchase into it, and use this card.

  2. Use a virtual prepay debit card. Ideally I would load it from PayPal with the amount I require.

I would love to use (2) as I find PayPal very convenient, and transferring between bank accounts very clumsy. But I can't find any provider that allows me to load a custom amount onto a card, and some providers charge an exorbitant amount, as much as 50% of the amount being loaded.

Is there any other way? And if not, is there any way to make (2) practical?

EDIT: I'm very disappointed that someone has seen fit to downvote my question. Why the downvote? Every day millions of people are entering their card details into websites. The security risk is huge. How to go about reducing it? I'm surprised that no bank seems to have invented a system where every time you wish to make a card payment you first login to your online bank account and inform it that you're about to make a payment. And then payments will only go through it the confirmation is there.

  • 2
    When you say "my account contains all my money", I gather you mean you have a VISA debit card linked to a bank account. What about a credit card? Also, what is the problem with solution #1?
    – BrenBarn
    Aug 27, 2014 at 21:18
  • 1
    You don't state if you're in the US or not, but you'll also want to keep in mind that debit cards, even those branded with VISA or MC, have less protections than credit cards do.
    – jadoti
    Aug 27, 2014 at 22:14
  • 6
    You get a real credit card. Or you get a a prepaid credit card. You're utterly and completely wrong if you think there's any safe way, online or off, of using a checking/savings account-linked credit card. But if you do use that card in the offline world where it can be skimmed, then you're putting yourself through a pointless exercise in security theater to not use it online.
    – Todd
    Aug 27, 2014 at 22:30
  • 4
    the skimmer is on the ATM. Aug 28, 2014 at 0:34
  • 3
    "What is to stop them from holding onto these details and spooning my account dry a few weeks later? Nothing, as far as I can see" and "Every day millions of people are entering their card details into websites" - do you think it's possible you may have missed something?
    – AakashM
    Aug 28, 2014 at 10:27

3 Answers 3


With regard to your edit (although I didn't downvote): one way to reduce the security risk is to separate the payment from the ability to drain your account. A considerable part of the security risk is inherent in giving people a number which is directly linked to a bank account where you keep all your money. If you don't want that risk, don't do that. Instead of (or in addition to) trying to reduce the chance of fraud, you can reduce the impact of fraud, even if it occurs, by not paying for things using the details of an account where you have all your money. Trying to protect against fraud while keeping all your money in the account is sort of like carrying around thousands of dollars in cash in your wallet and then worrying about how to defend against robbery. Yes, you can carry a weapon or hire a bodyguard, but it's probably simpler to just not carry that much money in the first place.

You already mentioned one solution with your option #1, which is to just keep a small amount of money in a separate account and use that for online payments. Assuming you can easily transfer money in and out of this account via online banking, this effectively is what you say you want in your edit: you log in to your bank online, but rather than "informing it" you're about to make a payment, you just transfer money in. You'll probably have to keep a small amount of money in the account to keep it open, but if this is an important issue for you, that shouldn't be that big a deal.

Another solution is a credit card. With a credit card, you simply make the payment online. In the US, if the merchant (or someone else stealing the info) makes fraudulent charges, the credit card company assumes the liability and the consumer suffers only the inconvenience of having to get a new card issued. I don't know what the UK laws are regarding credit vs. debit fraud, but some sites I found seem to suggest that credit cards have fraud protection in the UK as well. This is probably worth looking into if you are concerned about fraud.


What is to stop them from holding onto these details and spooning my account dry a few weeks later?

The threat of chargebacks and ultimately prosecution.

What are my options?

  1. Get a credit card.

Credit cards in the UK have stronger legal protections than debit cards, and having the transactions be on a credit card gives a layer of isolation from your main bank account in the event of fraud, without the hassle of manually moving money around.

  1. Virtual card numbers.

Some providers offer virtual card numbers, I don't have any experiance with these myself but it appears Revolout allow one to create virtual cards and set spending limits on them.

They also have an option for "one time use" card numbers, though it's not clear to me if you can impose a spending limit on those.


Have you considered a service that allows you to generate credit card numbers on the fly?

DoNotTrackMe allows you to generate a CC number on the fly, for a specific amount. If the vendor tries to charge more, it will fail. If it gets stolen, it's useless.

I don't know the specific fees off hand, but they have an annual fee for the feature. Still, for the protection, doesn't seem like a bad way to go.

Note: I have no affiliation with DNTM, I'm just a very happy user of their email protection products. The Masked Cards faq is here.

  • donottrackme.com shows up as a blank page for me.
    – BrenBarn
    Aug 27, 2014 at 21:42
  • 1
    @BrenBarn Sorry, the company is abine and is found at abine.com. Updated the answer with a link.
    – jadoti
    Aug 27, 2014 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .