In March 2025, a user on Apple's support forums described getting their "third BofA visa in less than a week," and the same subscription charge kept reappearing on the new number almost immediately. Another commenter explained why: "simply issuing you a new card number is not likely going to prevent the charges," because the merchant was billing through the bank's own card-updater service, not through Apple Pay at all. That thread is one of the better field tests I've seen for a pitch that gets repeated constantly — get a virtual card, lock it to one merchant, and you've built a kill switch for any subscription. Sometimes it works exactly as advertised. Sometimes it does nothing at all, and the thread doesn't tell you upfront which one you're getting.
Quick answer
A merchant-locked or single-use virtual card (Privacy.com, Capital One Eno) will decline a subscription's next charge — but only if that merchant isn't enrolled in Visa's Account Updater, Mastercard's Automatic Billing Updater, or network tokenization, any of which can push your new card details to the merchant without you knowing. A hard spend limit is the safer bet: it holds even while the underlying card number keeps getting refreshed.
How the merchant lock actually works
Privacy.com's "Merchant-Locked Cards" aren't locked to a merchant the moment you create them — the lock happens on first use. Whichever merchant processes the card's first transaction becomes the only merchant who can ever charge that number again; anyone else who gets hold of the digits gets an automatic decline. Its "Single-Use Cards" go one step further and close themselves entirely after one successful charge, so a second attempt from the same merchant also bounces. Both card types let you set a per-transaction, monthly, annual, or total spend limit, which Privacy.com markets specifically for managing subscription fees, and either can be paused or closed on its own without touching your linked bank account or any other card.
Capital One's Eno browser assistant runs a smaller version of the same idea: it generates a unique number per site at checkout, and Capital One explicitly recommends starting a subscription on one of these numbers, then switching it off the moment you don't want it renewing — no call, no dispute, just a dead card number. The catch is availability and scale: Privacy.com is U.S.-residents-only (citizenship, SSN, U.S. bank account, the works) and caps free accounts at 12 new cards a month, while Capital One caps Eno at 20 a day.
Not every "virtual card" plays this role, though, and mixing them up is the most common mistake. Revolut's disposable cards generate a brand-new number after every transaction specifically so a vendor "can't use the same details to charge you again" — which means they explicitly can't be used for subscriptions at all; you want Revolut's regular (non-disposable) virtual card instead. Monzo doesn't offer a per-card spend-limit toggle — the only workaround is funding the card from a Pot with just the amount you want to allow. Wise's virtual cards are reusable and can be frozen and unfrozen between purchases rather than being single-use. And Chase, notably, doesn't issue its own virtual card numbers at all; what you get there is wallet-based or Click to Pay, not an issuer-generated single-merchant number.
Where the lock stops working
The Bilt Mastercard is the clearest documented failure case: Bilt itself states that locking the physical card does not stop the linked virtual card number from working, and that recurring bills "may still go through despite the card being locked." Same account, same underlying authorization — the lock is cosmetic for that specific threat model.
The bigger reason a killed card doesn't kill a charge is infrastructure most people never see. Visa's Account Updater and Mastercard's Automatic Billing Updater push a cardholder's new number and expiration date to enrolled merchants automatically whenever a card is renewed, reissued, or replaced after a loss — with no notification to the cardholder — as long as both the issuing bank and the merchant's processor participate. Separately, network tokenization means the merchant was never storing your raw card number to begin with; Visa and Mastercard hand out a token in its place, and that token survives the card being replaced entirely. It's also not just an inconvenience: a 2021 case involved a member of the (then-bankrupt) Boston Sports Club who requested a new card number specifically to stop being billed, only for the gym to transfer her membership to a different location and resume charging via the updater service anyway. Getting a new card number is a bet on whether the merchant's processor is wired into that network, and there's no reliable way to check in advance — you find out you lost only once the charge already went through.
What actually holds up
Spend limits are the lever I'd actually bet on, precisely because they don't depend on a merchant losing your number — the card stays live, but a price hike past your ceiling gets declined at the point of sale instead of showing up on a statement you check next month. Merchant-locking depends on someone else's infrastructure behaving correctly; a spend limit doesn't. That's the mechanism worth using even when full merchant-locking isn't available on your card.
Canceling a card and hoping for the best is, I'd bet, how most of those disputes get filed — and the CFPB backs the bet up better than a hunch usually deserves. The CFPB's 2026 Consumer Credit Card Market Report found that a canceled recurring transaction was the single most common reason for a credit-card dispute in 2024 — 40% of all general-purpose card disputes, $9.8 billion in disputed charges. A hard decline at checkout doesn't generate a dispute; a merchant billing you after you thought the card was dead does. Network tokenization is part of why merchants have gotten more persistent about this: Visa has associated it with up to a 30% drop in fraud and a real bump in authorization rates for enrolled merchants, which is a fraud-prevention win for them and a "why did this still go through" moment for you.
Even a working decline doesn't mean the service disappears immediately — most subscription platforms build in a grace period after a failed renewal (Google Play supports up to 30 days) during which you keep access before anything actually lapses. My take: if you'd rather track renewal dates and cancel deliberately than rely on a card to do the cutting for you, that's closer to what Subnesio's reminders are built for than any virtual-card workaround — see the pricing page for how the reminder side works, or read up on setting a hard cap on recurring spend if a spend ceiling is the piece you actually need.
A merchant-locked card is a good decline mechanism, not a cancel button — confuse the two and you're the guy on his third reissued card this week, still getting billed.
