Mastercard expands virtual card platform with new security and APIs

Mastercard is expanding its virtual card number (VCN) platform with new security controls and a single API to help enterprises manage payments more safely. The updates to Mastercard In Control® aim to give financial institutions and companies greater visibility as they scale their B2B payment programs across borders.

Security upgrades apply at the moment a virtual card number is created. Issuers can now set baseline guardrails, such as spend limits and validity periods, to reduce fraud risk from the start of the payment lifecycle. These “Issuer Enforced Controls” help ensure compliance policies are in place immediately. Mastercard is also enhancing its existing “Clearing Controls” to validate transactions after authorization. This allows corporates to block invalid transactions and manage timing more precisely.

Related: Visa AI assistant helps banks act on insight

Data from the company shows that fraud rates on virtual cards are significantly lower than on traditional cards, often falling below one-fifth of the rate for non-virtual cards when these controls are used. Citi is already live with these capabilities and is expected to be the first issuer to roll them out globally later this year.

To simplify integration, Mastercard is launching a unified Commercial Connect API. This single connection acts as a front door to the company’s growing partner network, addressing a common hurdle where 69% of companies struggle to link payment systems with other business tools. The update lets businesses apply multiple control sets at the real card level without handling sensitive credentials. It also allows virtual card creation and payment initiation in one step.

Since launching its embedded VCN program in March 2025, the network has attracted partners across expense management, ERP systems, and travel platforms. SAP recently enabled a partnership through the program, while Mastercard and HSBC launched a mobile virtual card solution in the UAE. These integrations let users access tokenized virtual card numbers directly in digital wallets, blending the security of virtual cards with the convenience of mobile payments.

Related: Most Americans now use AI for shopping

When a virtual card number is created, it acts as a token that hides the actual account details. This substitution allows businesses to use the same card for different purchases without exposing the underlying financial data. Because the token is often linked to a specific merchant or a set limit, the risk of a breach spreading to the primary account is contained. This technical separation is what enables the granular controls issuers need to manage risk across a corporate program without creating administrative overhead.

The platform is designed to handle high-volume e-commerce flows in real time. It offers a resilient infrastructure that supports smooth, secure transactions at scale. Mastercard’s expanded ecosystem now includes issuers, direct platforms and corporates transacting across 43 countries and 174 currencies, showing its ability to support global expansion while maintaining consistency and oversight.