Mastercard Rolls Out Tighter Payment Controls Across Virtual Card Platform

New Guardrails at Issuance and Settlement

Mastercard has rolled out a set of technical enhancements designed to give banks and corporate clients more precise control over virtual card payments, addressing the security and workflow demands of an increasingly digital payments landscape.

The network introduced Issuer Enforced Controls, which let issuing banks set spending limits, transaction caps, and validity windows when generating a virtual card number. The feature moves risk parameters upstream, embedding constraints at the point of issuance rather than relying solely on post-transaction monitoring.

A second layer, Enhanced Clearing Controls, extends transaction checks beyond the authorization stage. Businesses and payment platforms can now block invalid transactions, apply granular rules, and manage the timing of payment settlement. The dual-layer approach is intended to close gaps that emerge between the moment a card is approved and when funds are actually transferred.

Citi has already deployed both capabilities and is expected to become the first issuer to implement them globally later in 2026, according to Mastercard.

Fraud Rates Below One-Fifth of Physical Cards

Mastercard reported that virtual card fraud rates are less than one-fifth those of non-virtual cards, with even lower rates for cards issued through its Mastercard In Control product. The network did not disclose absolute figures or the time frame used for comparison.

The fraud advantage stems in part from the ephemeral nature of virtual cards, which can be generated for single transactions or limited-duration use cases. Unlike physical cards, virtual credentials can be configured to expire immediately after use or after a predefined spending threshold is reached.

Marc Pettican, Global Head of Corporate Solutions at Mastercard, noted that as payments become more embedded into business workflows, expectations for performance, security, and control have risen. The platform expansion is designed to deliver more unified and scalable experiences for partners implementing virtual card programs.

Single API for Virtual Cards and Embedded Payments

Mastercard has also upgraded its Commercial Connect API, consolidating access to virtual card services and its embedded payments partner network into a single integration point. Businesses can now create virtual cards and initiate payments through the same connection, and apply controls across related transactions and card numbers.

The move reduces the technical overhead for enterprises that previously had to manage separate integrations for card issuance, payment initiation, and partner connectivity. For payment platforms, the unified API simplifies the path to offering white-label virtual card products within their own software environments.

The embedded virtual card program, launched in March 2025, links Mastercard virtual cards with expense management, enterprise resource planning, and accounts payable platforms. Dozens of partners have joined across travel, hospitality, healthcare, and e-commerce sectors.

Regional Deployments and Network Scale

Mastercard has worked with HSBC on a mobile virtual card service in the United Arab Emirates, part of a broader push to localize virtual card offerings in high-growth markets. The UAE deployment reflects demand from corporate treasurers and procurement teams for card products that can be issued and controlled from mobile devices without requiring physical distribution.

Mastercard's virtual card ecosystem now operates across 43 countries and supports 174 currencies. The network's scale gives it an advantage in cross-border B2B payments, where currency coverage and settlement speed are critical to adoption.

The platform updates arrive as competition intensifies among card networks and fintech infrastructure providers for a share of the corporate payments market. Virtual cards have gained traction in sectors where procurement cycles are short, vendor relationships are transient, or spend visibility is a priority, including digital advertising, travel management, and contractor payments.

Mastercard's emphasis on embedded controls and API simplification suggests the network is positioning virtual cards less as a standalone product and more as a set of programmable payment rails that can be integrated into existing enterprise software. That shift aligns with the broader trend toward embedded finance, where financial services are delivered within non-financial applications rather than through dedicated banking interfaces.