With mobile now firmly established as the primary banking channel for consumers worldwide, expectations are rising and changing. Customers no longer judge their bank app by the breadth of features it offers, but by how easily it helps them manage everyday money. Simplicity, speed, security and control have become core expectations. People want to understand what is happening with their money at a glance, act immediately when something doesn’t look right, and feel confident they can get things done digitally without friction, escalation or unnecessary effort.
As the number of mobile app features increases, consumers are asking for simple, secure ways to stay in control.
This prioritisation comes through clearly in our data. In Australia, security and card locking features rank as the most important elements of the banking app experience. Interestingly, though, digital cards follow closely in second position, with 41% of Australians ranking them, a figure that rises to 50-55% amongst those aged 25-44. And that is just the number of people who say digital cards are essential. A further 35% say it is preferable – highlighting substantial latent demand as awareness and availability increase.
Availability of virtual cards varies significantly by market. Our iSky Radar platform shows that across key markets, just 13% of banks currently offer virtual cards. The number rises to around two in five banks in Indonesia and Thailand, followed by the UK at around one in four. This is not just digital-only banks; incumbent banks also offer virtual cards, often initially as one-off features rather than fully integrated controls. Some banks are treating virtual cards as distributable permissions, enabling customers to issue cards instantly for specific purposes or people. Others are layering in time-bound and conditional rules, so cards expire automatically or pause when a threshold is crossed.
Mobile wallets are widely used in many markets, reaching near-universal use in parts of APAC. However, the use of virtual cards is currently much lower. In Australia, 42% of consumers use a digital card, rising to 71% for under 25’s. At the end of 2023, around a quarter of UK consumers (23%) had ever used a virtual card. Uptake in Canada and Asia is particularly low, with usage at 3% in Canada, 5% in Indonesia, 4% in Singapore and 2% in Malaysia. This gap is not a reflection of limited relevance, but of limited awareness and inconsistent execution. In many markets, virtual cards have not yet been clearly positioned or fully integrated into the everyday banking experience (e.g. as a proposition that may overlap with but is not exclusively linked to virtual wallet usage).
As awareness improves and implementations become more intuitive and better integrated, these figures are likely to rise quickly, driven by the everyday convenience, flexibility and security that virtual cards offer.
We see some great examples of virtual cards through our iSky Radar platform. Global, regional and local banks providing solutions that give customers flexible, situational access to money that can be issued, adjusted or withdrawn instantly, without disrupting their wider account.
Sharing access to money has traditionally been slow and inflexible, requiring physical cards or account transfers. Virtual cards remove this friction. Customers can instantly issue cards to family members or trusted third parties, with predefined limits and controls. Digital-only UK bank Starling provides a great example of this, with its Kite Card, where customers can manage their kids’ pocket money from their Starling account with a free virtual debit card and app designed for 6-15-year-olds.
Customers expect to see every card, every user and every transaction in one place, with instant actions to pause, restrict or revoke access. This visibility ensures confidence even as cards are handed out more freely and frequently for different use cases.
Our research shows that more than half of Australian customers now leave home without their physical card, relying on wallets and in-app credentials. In response, leading apps surface virtual card details on demand, allowing temporary exposure of sensitive information, and supporting custom naming and rules, positioning the app, not the plastic, as the primary card experience.
Cash App demonstrates this well, allowing customers, including children, to personalise virtual cards visually, reinforcing both ownership and engagement.
Virtual cards remove friction from gifting and one-off use cases, allowing money to be issued instantly, used immediately and controlled digitally without physical handover. Recipients can either spend the value as a gift card or deposit it into a new account, with a small incentive encouraging conversion, and a potential referral opportunity.
Virtual cards also enable stronger security models. By separating credentials from the primary account, customers can limit exposure to fraud without needing to cancel or replace their main card. Single-use or disposable cards further reduce risk by regenerating details after each transaction. Physical cards should be void of digits to make them more secure. If there are no digits on a card, there is nothing that can be used in fraud.
Cards that exist in the virtual space do not need to expire in the same way, reducing replacement, production and mailing costs while supporting sustainability goals.
Revolut offers a single‑use disposable virtual card, with card details changing on every transaction to protect customers from fraud. This approach reduces exposure without adding friction, particularly for online and international spending. In recognition of its broader digital execution, Revolut was awarded Best Consumer iPhone App and Best Business Banking App (non‑Big Four) at RFI Global’s Australian Banking & Finance Awards 2026.
Availability and adoption of virtual cards remains modest in many markets, but that gap in usage vs appeal highlights a significant opportunity rather than a lack of demand.
As modern spending becomes more fragmented across subscriptions, online merchants, family use and one‑off purchases, each with a different risk profile, the limitations of a single, permanent card become increasingly clear. Virtual cards introduce precision, allowing customers to match how they pay with what they are paying for.
For customers, this provides reassurance and flexibility, allowing money to be accessed and shared safely while keeping core account details protected. For banks, virtual cards offer a more efficient model, reducing fraud, cutting the cost of plastic and delivery and supporting sustainability commitments.
As awareness grows and communication improves, virtual cards are well‑positioned to become a foundational element of digital banking in 2026 and beyond, offering providers a powerful way to differentiate their mobile experiences while meeting evolving customer expectations.
To learn more about how banks around the world are implementing virtual cards, and to explore best practices based on thousands of banking app evaluations, get in touch to find out more about RFI Global’s iSky Radar platform.
A virtual card is a digital card created within a banking app that can be used for specific purposes or for use by nominated people. Unlike a physical card, a virtual card can be issued instantly, paused, replaced or removed without disrupting the customer’s main account details. Virtual cards may be used on their own or added to a mobile wallet.
A mobile wallet is a way to pay using an existing card or account through a smartphone or wearable device. A virtual card, by contrast, allows customers to create separate cards within the banking app for different purposes, such as subscriptions, family spending or one‑off purchases. While a virtual card can be added to a wallet, it does not have to be, and its primary value lies in control rather than convenience alone.
Banks are introducing virtual cards to meet growing customer demand for security, flexibility and control in mobile banking. Virtual cards reduce fraud exposure, lower the cost of producing and mailing plastic cards, and support sustainability goals by reducing reliance on physical materials. For banks, virtual cards reduce costs by reducing fraud, customer support needs, and card replacements.
Usage of virtual cards remains relatively low in many markets compared with mobile wallets. By the end of 2023, around 23% of UK consumers had ever used a virtual card, while uptake in parts of Asia was much lower, at 5% in Indonesia, 4% in Singapore and 2% in Malaysia. This gap reflects limited awareness and inconsistent execution rather than a lack of customer relevance, suggesting significant growth potential as understanding and integration improve.
| Cookie | Duration | Description |
|---|---|---|
| __cf_bm | 1 hour | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
| __hssc | 1 hour | HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. |
| __hssrc | session | This cookie is set by Hubspot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session. |
| AWSALBCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category. |
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| CookieLawInfoConsent | 1 year | CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie. |
| elementor | never | The website's WordPress theme uses this cookie. It allows the website owner to implement or change the website's content in real-time. |
| rc::a | never | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| rc::c | session | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
| wpEmojiSettingsSupports | session | WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user's browser can display emojis properly. |
| XSRF-TOKEN | 2 hours | This cookie enhances visitor browsing security by preventing cross-site request forgery. |
| Cookie | Duration | Description |
|---|---|---|
| AWSALB | 7 days | AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| Cookie | Duration | Description |
|---|---|---|
| __hstc | 6 months | Hubspot set this main cookie for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session). |
| _ga | 1 year 1 month 4 days | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. |
| _ga_* | 1 year 1 month 4 days | Google Analytics sets this cookie to store and count page views. |
| hubspotutk | 6 months | HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts. |
| wmc | 1 year 1 month 4 days | Workable sets this cookie to assign a unique visitor ID for statistical purposes. |
| Cookie | Duration | Description |
|---|---|---|
| _cfuvid | session | Description is currently not available. |