topic Re: Citi has completely nerfed their virtual account numbers in Credit Cards

Citi has completely nerfed their virtual account numbers

crystal626 — Sun, 24 Aug 2025 22:16:23 GMT

You can no longer set your own daily custom amount, they have limits you can pick that start at $25, and you can no longer set a custom expiration date anymore, all of them are three years.

This makes the feature significantly less useful. I always preferred Citi over Capital One for the custom expiration dates and dollar limits. Guess I have to use a new card for virtual card numbers now.

Re: Citi has completely nerfed their virtual account numbers

Lou-natic — Sun, 24 Aug 2025 22:34:40 GMT

@crystal626 wrote:
You can no longer set your own daily custom amount, they have limits you can pick that start at $25, and you can no longer set a custom expiration date anymore, all of them are three years.

This makes the feature significantly less useful. I always preferred Citi over Capital One for the custom expiration dates and dollar limits. Guess I have to use a new card for virtual card numbers now.

If they don't have a "close after first use" feature then that sucks. I use privacy for burner cards but it's not a "real" credit card as it's tied to my bank account. Still useful but no rewards obviously.

Re: Citi has completely nerfed their virtual account numbers

crystal626 — Sun, 24 Aug 2025 23:44:22 GMT

Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.

Re: Citi has completely nerfed their virtual account numbers

smcj — Mon, 25 Aug 2025 01:17:00 GMT

@Lou-natic wrote:
@crystal626 wrote:
You can no longer set your own daily custom amount, they have limits you can pick that start at $25, and you can no longer set a custom expiration date anymore, all of them are three years.

This makes the feature significantly less useful. I always preferred Citi over Capital One for the custom expiration dates and dollar limits. Guess I have to use a new card for virtual card numbers now.
If they don't have a "close after first use" feature then that sucks. I use privacy for burner cards but it's not a "real" credit card as it's tied to my bank account. Still useful but no rewards obviously.

They don't have a "close after first use" feature, but if you watch the UI carefully (because you're bored or tired or basically not a normal customer who would legitimately say "eff this noise" right out of the gate), you'll spot something that says every time you tell it to let you view a virtual card number, it will change the CVV.

Which isn't the same as "close after first use," it's more like "render useless in a nonintuitive circumstance when just trying to use the thing," but it will certainly stop the party you gave the card number to from using it again.

Wait, no, well, ok, that's true if the merchant actually asked you for the CVV vs just running on card number and expiration date, which nobody does, except for oops at least one I found while redoing all my dead-from-this-Citi-redux project, I mean...

Hey, nobody has mentioned yet that not only are there specific amounts you have to choose from for a limit (or no limit at all), but:

(1) You can't change the limit AT ALL after you've set it for a given virtual card, and...

(2) They are $25 increments up until $100, and then it jumps to $300, and then your only option is no limit at all. So much for keeping your merchants who charge $110, or $120, or $130, or some other not-near-$300 in line (annual subscriptions for example)...

Yeah, it's pretty bad. SMH.

Re: Citi has completely nerfed their virtual account numbers

smcj — Mon, 25 Aug 2025 01:17:32 GMT

@crystal626 wrote:
Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.

I'd like to know more about this.

Re: Citi has completely nerfed their virtual account numbers

crystal626 — Mon, 25 Aug 2025 01:34:54 GMT

@smcj wrote:
@crystal626 wrote:
Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.
I'd like to know more about this.

I would too. Presumably it's saying that merchants who mark the card as for recurring payments will be able to hit you for any amount but we will have to wait and see what people experience for themselves I guess.

Re: Citi has completely nerfed their virtual account numbers

smcj — Mon, 25 Aug 2025 01:52:26 GMT

@crystal626 wrote:
@smcj wrote:
@crystal626 wrote:
Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.
I'd like to know more about this.
I would too. Presumably it's saying that merchants who mark the card as for recurring payments will be able to hit you for any amount but we will have to wait and see what people experience for themselves I guess.

Is this somewhere in T&C? Other detailed reference? Would love to take a look.

Re: Citi has completely nerfed their virtual account numbers

ElvisCaprice — Mon, 25 Aug 2025 08:24:58 GMT

Guess I was never aware of this feature in the first place, for Citi. Not sure why I would ever use it or bother too. Especially since I only use the Citi CCC physically or in Google wallet for purchases.

Re: Citi has completely nerfed their virtual account numbers

delaney1 — Mon, 25 Aug 2025 12:50:54 GMT

@crystal626 wrote:
You can no longer set your own daily custom amount, they have limits you can pick that start at $25, and you can no longer set a custom expiration date anymore, all of them are three years.

This makes the feature significantly less useful. I always preferred Citi over Capital One for the custom expiration dates and dollar limits. Guess I have to use a new card for virtual card numbers now.

Would the one time use feature be helpful for you with Capital One? I have never used it, because I just keep my Capital one, merchant specific, virtual cards locked until I need to use them, but I have noticed that's an available option.

Re: Citi has completely nerfed their virtual account numbers

crystal626 — Mon, 25 Aug 2025 17:24:52 GMT

@smcj wrote:
@crystal626 wrote:
@smcj wrote:
@crystal626 wrote:
Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.
I'd like to know more about this.
I would too. Presumably it's saying that merchants who mark the card as for recurring payments will be able to hit you for any amount but we will have to wait and see what people experience for themselves I guess.
Is this somewhere in T&C? Other detailed reference? Would love to take a look.

Scroll to the "What is my Virtual Account Number daily spend limit?" section

https://imgur.com/a/t0mw1K0

Re: Citi has completely nerfed their virtual account numbers

crystal626 — Mon, 25 Aug 2025 17:28:05 GMT

@delaney1 wrote:
@crystal626 wrote:
You can no longer set your own daily custom amount, they have limits you can pick that start at $25, and you can no longer set a custom expiration date anymore, all of them are three years.

This makes the feature significantly less useful. I always preferred Citi over Capital One for the custom expiration dates and dollar limits. Guess I have to use a new card for virtual card numbers now.
Would the one time use feature be helpful for you with Capital One? I have never used it, because I just keep my Capital one, merchant specific, virtual cards locked until I need to use them, but I have noticed that's an available option.

Yeah that's an option. Sucks that it would be at 1% though. Don't really want to get rid of my SavorOne since it's a grandfathered card now with the $0 AF but three pulls to get a QS is a no go either. Maybe I'll just use my Verizon VISA. Still 1% but a lower Verizon bill is always welcome.

Re: Citi has completely nerfed their virtual account numbers

smcj — Mon, 25 Aug 2025 20:56:59 GMT

FWIW, re: the FAQ (small print clickable link at the bottom of your virtual CC list) language that reads:

"Only one transaction can occur per combination of the Virtual Account Number, CVV and expiration date. A new CVV will need to be generated for a new transaction, however the same Virtual Account Number and expiration date can be used."

Doesn't seem to apply to recurring transactions (or perhaps more accurately stated, transactions the merchant runs through as recurring). Not that this is a surprise as such, otherwise the virtual CCs would be fully useless for recurring transactions; but figured I would share that I personally have used a "new" virtual CC, turned up after the change, intended for one specific vendor to use for whatever-my-purchases. All transactions are going through, rather than bombing out or requiring manual intervention after the first one.

Separately, I did spot a claim in the comment section of a Doctor Of Credit page about the whole thing where someone claimed they had a purchase go through against a virtual CC that they had deactivated.

My take given all this chatter, especially including all the caveats laid out in the FAQ and that making something a recurring transaction appears to be a pass to bypass restrictions/limits that would otherwise be in play: the Citi virtual CC is good for not having to give your base card number out, and the security that comes with same. But additional security provision beyond that appears to be iffy at best.

Re: Citi has completely nerfed their virtual account numbers

osprey0 — Tue, 26 Aug 2025 16:28:26 GMT

@smcj wrote:

"but figured I would share that I personally have used a "new" virtual CC, turned up after the change, intended for one specific vendor to use for whatever-my-purchases. All transactions are going through, rather than bombing out or requiring manual intervention after the first one."

I'm curious whether @smcj performed multiple transactions with a vendor that doesn't ask for the CVV (e.g., Amazon), which would explain the success, even though each transaction is supposed to change the CVV, unless the transaction is submitted as "recurring".

With the old system, I had some VANs used for a single vendor and some used for multiple vendors. That worked well, minimizing the number of VANs and allowing specific daily limits when transaction amounts were well-known. For some vendors, I would set a daily limit, perform the transaction, and reset the daily limit $1 after the transaction posted.

I spent hours on 8/25 fighting with the new system (perhaps too soon after the update), setting up payment methods and trying to figure out what worked and what didn't. I had multiple attempts both succeed and fail setting up payment methods with the same VAN at multiple vendors. My results didn't make much sense, unless perhaps the $1 test charge used by some vendors using recurring charges caused the CVVs to change.

Speaking with Customer Service and Technical Support multiple times didn't help much, except for verifying which vendors succeeded (I think one failed on the vendor side due to use of Firefox) and which submitted $0 vs. $1 test charges. I was assured that the new VANs worked with multiple vendors, but never told that transactions changed the CVV. I didn't notice that in the FAQ until directed there by posts here and on Reddit.

I'm still trying to figure out the best way to handle a mix of recurring charges (e.g., Netflix), periodic charges done manually (e.g., cable), and periodic charges done automatically, but probably not identified as recurring (e.g., wine clubs). It would help if the VAN transactions were identified regarding whether they were flagged as recurring or non-recurring in the transaction history. Unfortunately, Citi Customer Service assured me that there's no way to post any comments or suggestions regarding any of their "services".

Re: Citi has completely nerfed their virtual account numbers

smcj — Tue, 26 Aug 2025 16:40:54 GMT

@osprey0 wrote:
@smcj wrote:

"but figured I would share that I personally have used a "new" virtual CC, turned up after the change, intended for one specific vendor to use for whatever-my-purchases. All transactions are going through, rather than bombing out or requiring manual intervention after the first one."

I'm curious whether @smcj performed multiple transactions with a vendor that doesn't ask for the CVV (e.g., Amazon), which would explain the success, even though each transaction is supposed to change the CVV, unless the transaction is submitted as "recurring".

With the old system, I had some VANs used for a single vendor and some used for multiple vendors. That worked well, minimizing the number of VANs and allowing specific daily limits when transaction amounts were well-known. For some vendors, I would set a daily limit, perform the transaction, and reset the daily limit $1 after the transaction posted.

I spent hours on 8/25 fighting with the new system (perhaps too soon after the update), setting up payment methods and trying to figure out what worked and what didn't. I had multiple attempts both succeed and fail setting up payment methods with the same VAN at multiple vendors. My results didn't make much sense, unless perhaps the $1 test charge used by some vendors using recurring charges caused the CVVs to change.

Speaking with Customer Service and Technical Support multiple times didn't help much, except for verifying which vendors succeeded (I think one failed on the vendor side due to use of Firefox) and which submitted $0 vs. $1 test charges. I was assured that the new VANs worked with multiple vendors, but never told that transactions changed the CVV. I didn't notice that in the FAQ until directed there by posts here and on Reddit.

I'm still trying to figure out the best way to handle a mix of recurring charges (e.g., Netflix), periodic charges done manually (e.g., cable), and periodic charges done automatically, but probably not identified as recurring (e.g., wine clubs). It would help if the VAN transactions were identified regarding whether they were flagged as recurring or non-recurring in the transaction history. Unfortunately, Citi Customer Service assured me that there's no way to post any comments or suggestions regarding any of their "services".

The recurring transactions I referred to that are going through successfully are with a vendor that asked for the CVV. In fact, on at least one occasion previously, I found that they were real sticklers about having everything "just so" with respect to CC information, to the point where them bumping into the (under old Citi version) daily limit resulted in me having to jump through all sorts of hoops to clean up the mess it created. Based on that, the merchant isn't playing fast and loose with their processing in the general -- which would lead me to believe that they wouldn't do something bizarre like ask for the CVV, validate the CVV, and then not try to use it again for subsequent transactions.

That said, I wondered the same thing. Just because they asked for the CVV and validated using the CVV the first time doesn't tell me what they are doing for subsequent uses. The subsequent uses are automated, behind the scenes, and opaque to anyone except for them.

As other parties post data points (if they bother to) more patterns will become clear. I imagine that will take some time.

Re: Citi has completely nerfed their virtual account numbers

Lou-natic — Wed, 27 Aug 2025 13:25:37 GMT

@smcj wrote:
@osprey0 wrote:
@smcj wrote:

"but figured I would share that I personally have used a "new" virtual CC, turned up after the change, intended for one specific vendor to use for whatever-my-purchases. All transactions are going through, rather than bombing out or requiring manual intervention after the first one."

I'm curious whether @smcj performed multiple transactions with a vendor that doesn't ask for the CVV (e.g., Amazon), which would explain the success, even though each transaction is supposed to change the CVV, unless the transaction is submitted as "recurring".

With the old system, I had some VANs used for a single vendor and some used for multiple vendors. That worked well, minimizing the number of VANs and allowing specific daily limits when transaction amounts were well-known. For some vendors, I would set a daily limit, perform the transaction, and reset the daily limit $1 after the transaction posted.

I spent hours on 8/25 fighting with the new system (perhaps too soon after the update), setting up payment methods and trying to figure out what worked and what didn't. I had multiple attempts both succeed and fail setting up payment methods with the same VAN at multiple vendors. My results didn't make much sense, unless perhaps the $1 test charge used by some vendors using recurring charges caused the CVVs to change.

Speaking with Customer Service and Technical Support multiple times didn't help much, except for verifying which vendors succeeded (I think one failed on the vendor side due to use of Firefox) and which submitted $0 vs. $1 test charges. I was assured that the new VANs worked with multiple vendors, but never told that transactions changed the CVV. I didn't notice that in the FAQ until directed there by posts here and on Reddit.

I'm still trying to figure out the best way to handle a mix of recurring charges (e.g., Netflix), periodic charges done manually (e.g., cable), and periodic charges done automatically, but probably not identified as recurring (e.g., wine clubs). It would help if the VAN transactions were identified regarding whether they were flagged as recurring or non-recurring in the transaction history. Unfortunately, Citi Customer Service assured me that there's no way to post any comments or suggestions regarding any of their "services".

The recurring transactions I referred to that are going through successfully are with a vendor that asked for the CVV. In fact, on at least one occasion previously, I found that they were real sticklers about having everything "just so" with respect to CC information, to the point where them bumping into the (under old Citi version) daily limit resulted in me having to jump through all sorts of hoops to clean up the mess it created. Based on that, the merchant isn't playing fast and loose with their processing in the general -- which would lead me to believe that they wouldn't do something bizarre like ask for the CVV, validate the CVV, and then not try to use it again for subsequent transactions.

That said, I wondered the same thing. Just because they asked for the CVV and validated using the CVV the first time doesn't tell me what they are doing for subsequent uses. The subsequent uses are automated, behind the scenes, and opaque to anyone except for them.

As other parties post data points (if they bother to) more patterns will become clear. I imagine that will take some time.

Honestly it sounds like the Citi virtual card system is an utter mess and nothing I would ever want to deal with.

It should be simple...

Cards can either be set to expire after first use or not.

Cards should have completely custom spend limits in any dollar amount you chose.

Card spend limits should be daily, weekly, monthly, yearly or none at all as you choose.

All limits should be able to be changed at any time.

Every virtual card should have a unique number and CVV.

Closed cards should never be subject to payment for any reason.

Spend limited cards should decline every single transaction that tries to go above that limit.

Re: Citi has completely nerfed their virtual account numbers

smcj — Wed, 27 Aug 2025 13:23:59 GMT

@Lou-natic wrote:

Honestly it sounds like the Citi virtual card system is an utter mess

Net: yes

Re: Citi has completely nerfed their virtual account numbers

osprey0 — Sat, 30 Aug 2025 17:03:29 GMT

I've spent days testing the new VANs and trying to understand the implications of the new system on my use of VANs. I finally generated a new set, documented all of them, decided how I would use them with changing CVVs, and updated them at numerous online merchants. The one glaring exception is SiriusXM - see below for detail.

After all of this effort and recognizing that changing CVVs could greatly complicate my use of VANs, I decided to reassess why I use them and where I should potentially simplify things by accepting more risk and using my physical card.

With the old VANs, I used different VANs for recurring transactions at each merchant (e.g., Netflix), set appropriate daily limits, and very seldom needed to make any changes. The daily limits provided almost no security.

I shared a few old VANs across infrequently used merchants. For these I would login to Citi, adjust the daily limit for each transaction, and login again to reset it to $1.00 after the transaction posted. Each transaction required 2 logins, each with a text verification, and the daily limit only provided marginal security.

With the new VANs, I expected that recurring transactions would work similarly to the old VANs. The CVVs would not change for merchants that identified their transactions as recurring.

However, I expected that using new VANs for saved payment methods would be very inconvenient at merchants that don't use recurring transactions. Before each transaction, I would need to login to Citi, get a new CVV, and update the saved payment method at the merchant.

That's when I started researching how CVVs are used by online merchants for saved payment methods. I could have missed something, but it seems that in this situation:
1. merchants are prohibited from storing CVVs
2. some merchants (e.g., Amazon) don't collect the CVV
3. merchants that collect the CVV only use it for initial card verification (since it's not saved)
4. transactions either accept risk with no CVV or use something like a tokenized payment system

This needs to be tested, but it seems that a shared VAN could be saved at one merchant, updated with a new CVV, saved at another merchant, etc. Each saved VAN is secure, since, even if the CVV were obtained, it would no longer match the VAN CVV, which was changed by Citi.

It's not clear exactly what triggers the CVV to be changed. Citi technical support wasn't much help. My tests were inconclusive regarding whether the CVV was changed by $0 verificatons, $1 verifications, only posted transactions, or verifications by multiple merchants.

Now for SiriusXM (and possibly other merchants).

Using a VAN to set the payment method fails with an obscure error that their very helpful technical support staff cannot diagnose. The failure seems to be caused by their pre-verification failing, without a test charge ever being transmitted to Citi. I suspect that the issue could be caused by the card validity check being used, such as identifying the financial institution based on the BIN (first 6 digits of the VAN). You can find these online and some can't identify the BIN of the new VANs.

Re: Citi has completely nerfed their virtual account numbers

smcj — Sat, 30 Aug 2025 18:45:41 GMT

Good bit of digging there @osprey0 .

I use VANs almost exclusively for recurring transactions (the Netflix scenario, let's call it). With both the old and new systems, I found that the daily limit was enforced -- never ran into an exception there. That was true for recurring transactions as well as one-time. But with the new system disallowing custom daily limit amounts, there is pretty much no meaningful (to me, anyway) limit-provided security if one has to clear a transaction above $100 (since the next limit level above $100 is $300, way too high if I want to clear only $125/you get the idea).

What you found regarding merchant use of CVVs is interesting to say the least -- didn't know that. Thanks for laying out that detail. Also very interesting in re the BIN numbers.

If you are willing to share / if you think it is worthwhile, would be interested in the details of your "what causes a CVV change" testing, even though you indicated the results were inconclusive. Knowing what you tried, what your methodology was, etc., could prove helpful.

Re: Citi has completely nerfed their virtual account numbers

osprey0 — Sat, 30 Aug 2025 18:40:53 GMT

I started testing early on Sunday 8/24. One could argue that it was too soon after the update, but, given the snail's pace of fixes and updates at Citi, I expect that doing so any time in the first few months would yield the same results

I was testing reuse of single VANs, since I had a few old VANs used in that manner. The tests were not done as rigorously as I'd like and not fully documented due some urgency to get this figured out before my first recurring transaction scheduled for 8/26 (which worked).

One test involved using a single VAN with the same CVV successfully for saved payment methods at 4 wineries. Citi verified that all 4 merchants submitted $0 test charges. One winery doesn't collect the CVV, so that really only verifies the ability to use a VAN at multiple merchants. Two others use the same Orderport.net payment system, of which one verified that they do not use orderport's recurring payment capability. I'll be testing this one to verify that repeated charges work without updating the payment method. This test seems to indicate that $0 test charges don't change the CVV. This is my main case of concern, since these merchants do automatic charges for shipments, but it's also convenient to use the same saved payment method for manual charges.

Another test seemed more confusing. I used a single VAN at several merchants, for which Citi verified that they all submitted $1 test charges. Some worked and some failed, but I didn't keep careful enough notes to reach any definitive conclusions. I decided to use separate VANs for these merchants to avoid problems.

For infrequently use of VANs at multiple merchants, I don't save payment methods (a holdover from decades of fraud/risk work at a financial institution). I tend to use a single VAN and will login to update the CVV instead of the daily limit as for the old VANs.

Re: Citi has completely nerfed their virtual account numbers

UncleB — Sat, 30 Aug 2025 19:20:17 GMT

@crystal626 wrote:
@smcj wrote:
@crystal626 wrote:
Apparently there are also situations where the merchant can override whatever limit you set now, making them even more useless. This is Citi bowing down to merchant pressure and I don't like it one bit. Might be time to end my relationship with them altogether.
I'd like to know more about this.
I would too. Presumably it's saying that merchants who mark the card as for recurring payments will be able to hit you for any amount but we will have to wait and see what people experience for themselves I guess.

In my own experience the 'recurring payment' flag was able to force a charge through on a virtual card I had deleted. The purchase was otherwise within the parameters I had originally set (amount, date, ect.).

It wasn't the end of the world - I got refunded by the vendor - but it let me know that Citi virtual cards aren't worth the hassle, at least for my use cases.