# What is a single-use virtual card?

> A single-use virtual card is a card number created for one purchase with a spending cap, then closed. Definition with a worked example.

Updated 2026-11-06. Source: https://atta.sh/glossary/single-use-virtual-card

A single-use virtual card is a card number issued for one purchase, with a limit set to the approved amount. After the charge it can't be used again, so it can't be reused by the supplier or by someone who finds the number.

## Example

A request for a $1,150 monitor is approved. A card is issued with a $1,150 limit. The store charges $1,150 and the card closes. If the store tries a second charge of $40 the next day, it's declined.

Compare a shared company card: the number sits in five browsers and three subscriptions, and one leak affects all of them.

## In Atta

With a card issuer configured and the workspace's card program on, `placeOrder` issues one card per order, capped at the reserved total on the issuer's side too. The authorization check has zero tolerance: a charge above the approved amount is declined.

The number and CVC never enter Atta. The person sees them in Stripe's own frame. For a card order, the issuer's events are the only thing that moves the budget; the store's webhook moves the order status.

Cancelling an order cancels the card before the reservation is released, and if the card can't be cancelled the hold stays. A workspace runs on its own connected account, and losing the account stops issuing without touching existing holds.

## Limits worth setting

Besides the amount, a card can be limited by merchant category and by expiry. In Atta the program names the allowed categories, and an unused card is cancelled after the 24 hour abandon window, so a forgotten subscription has nothing to renew on.

## Questions

### Does the agent see the card number?

No. The number and CVC are shown to the person inside Stripe's frame and never pass through the app.