Virtual bank cards are becoming increasingly popular across South Africa as consumers shift toward digital payments, but cybersecurity experts are warning that the technology is not foolproof against fraud.
The rapid rise of mobile banking and digital wallets has encouraged millions of South Africans to replace physical cards with virtual alternatives that can be generated instantly on banking apps. While these cards offer additional layers of protection, criminals are also adapting their tactics to exploit weaknesses in online payment systems.
According to the latest SpendTrend26 report published by Visa and Discovery Bank, virtual card adoption in South Africa surged sharply in 2025. The report found that 85% of consumers now own a virtual debit or credit card, while 73% actively use them for transactions. That compares to only 45% usage in 2024.
Banks have heavily promoted virtual cards as safer than physical cards because they use rotating CVV or CVC security codes. Unlike the static three-digit code printed on a physical card, the digital version changes every few minutes and can only be accessed through a secure banking application.
The system is designed to reduce the risk of stolen card information being used for unauthorised online purchases. However, experts say there are still several ways cybercriminals can bypass those protections.
Subscription payments create a loophole
One of the biggest concerns involves recurring online payments.
Many subscription platforms, including streaming services and online memberships, only require a CVV during the initial sign-up process. After the card has been saved, future payments can continue automatically without the user re-entering the changing security code.
That means criminals who manage to obtain full virtual card details through phishing scams, fake banking calls, or social engineering attacks may still be able to load those cards onto certain platforms and continue making transactions until the account is blocked.
Security analysts say this highlights an important misunderstanding among consumers who assume rotating CVVs automatically prevent all fraud.
The growing popularity of digital wallets such as Apple Wallet, Google Wallet, and Samsung Wallet has also introduced new security considerations.
These services generally require biometric verification or a PIN before payments can be approved, making them safer than traditional tap-and-go card payments commonly used in South Africa.
However, some wallets include transit payment features designed for faster use in public transport systems. These functions may temporarily bypass authentication requirements to allow seamless entry and exit payments.
Researchers exposed weaknesses in transit payment systems
In 2021, cybersecurity researchers demonstrated that specially modified devices could trick certain Visa payment systems into believing they were processing legitimate transit transactions.
The exploit recently gained renewed public attention after being showcased by popular YouTube creators Veritasium and MKBHD.
Although Visa has stated that the attack is highly complex and unlikely to affect ordinary users, experts say it illustrates how even advanced payment technologies can contain vulnerabilities.
The company noted that such attacks require close-range access, sophisticated hardware, and highly specific technical steps, making widespread abuse difficult.
Despite those concerns, digital banking specialists still believe virtual cards remain safer overall than physical bank cards.
Physical cards can be compromised through theft, card-skimming devices, or even quick photographs taken by dishonest cashiers or waiters. Virtual cards, by comparison, only exist inside secure banking applications.
Consumers are also increasingly encouraged to create separate virtual cards for different online platforms. If one retailer or service experiences a data breach, users can simply cancel the affected virtual card without disrupting all of their banking services.
Cybersecurity experts continue to advise South Africans to avoid suspicious links, verify banking communications carefully, and regularly monitor transaction notifications for unusual activity.
Source: Adapted from South African banking and cybersecurity reporting.