Small daily routines that protect your space

An account that holds cards is worth protecting carefully, but protection is rarely dramatic. It is a handful of small routines, each taking a minute, that close the doors most problems walk through: a reused password, a convincing fake email, a phone that breaks without a backup, a card number left on screen in a café.

This guide collects those routines in one place. It is the pillar of the library's section on account safety.

What protects your space already

Before the routines, it helps to know what the account does on its own.

• Every sign-in needs two things: your password plus a code from your authenticator app. A stolen password alone does not open the account.
• Card details stay sealed. The number, expiry date and security code are shown only after a new authenticator code, and they seal themselves again after a short time.
• Sign-ins are recorded. Each one appears in Settings with its time, browser and network, and a sign-in from an unfamiliar device sends you an email.
• People check orders. Every card order is reviewed by someone on our team before a card is issued.

The routines below make sure these protections keep working for you.

Routine 1: one password, used once

A password used on several sites is only as safe as the weakest of them. When one site leaks its passwords, attackers try the same email and password on other sites else. The cure is a unique password for every account, which in practice means a password manager. Password managers and the end of reused passwords explains how to start without changing everything at once.

Routine 2: keep the recovery codes where you can find them

When you paired your authenticator, you received recovery codes. They are your way back in if the phone is lost, stolen or reset. Store them offline (on paper in a drawer, or inside a password manager's secure notes) and not in a screenshot on the same phone. When you switch phones, move the authenticator before you wipe the old one. Changing phones without losing your authenticator has the step-by-step version.

Routine 3: treat requests for codes as a warning

Nobody from VirtualCardOnline will ask for your password, your authenticator code, a recovery code or a card number. Not by email, not over chat, not on the phone. Anyone who asks is trying to break into your account. Messages that pretend to come from a card provider often create urgency ("your card will be blocked today") and link to a page that looks like the real one. Messages that pretend to be your card provider shows the signs to look for.

The habit: never sign in through a link in an unexpected message. Type the address yourself or open a bookmark.

Routine 4: look at the sign-in log

Once a week, or whenever an email says someone signed in from a new device, open Settings and read the sign-in list. Each entry should be you. If one is not:

1. Change the password (this signs out every other session).
2. Create new recovery codes.
3. Check your cards and orders for anything you did not do.
4. Write to support.

What a sign-in log can tell you explains how to read each entry.

Routine 5: unseal details only when you need them

Card details are safest sealed. Unseal them when you are about to pay, on a device you trust, and let them seal again. Avoid typing card details on shared or public computers; if you must pay while travelling, use your own phone on mobile data rather than a hotel lobby computer. Cafés, lobbies and library computers: card details away from home covers the situations to avoid.

Routine 6: check the shop before you pay

A new shop deserves thirty seconds of attention: is the address spelled right, does the site have clear contact details and terms, are prices and reviews believable? Unfamiliar shops: checks before you type card details lists the checks.

Routine 7: give each card one job

A card used for one purpose, with only the balance that purpose needs, limits what can go wrong. If its details ever leak, the damage stops at that balance, and the unusual charge is easy to spot because the card only ever pays one kind of thing. One card, one purpose: splitting spending across cards explains the method.

Routine 8: keep the devices you sign in on in order

The phone with your authenticator and the computer you pay from are part of your security. A few habits keep them trustworthy:

• Update the system and the browser when updates arrive; most fix security problems.
• Lock the screen with a PIN, a password or biometrics, so a borrowed or lost device does not open your accounts.
• Install apps only from the official stores, and remove the ones you no longer use.
• Sign out on devices that are not yours, and do not let a browser you do not own remember your password.

When you sell or give away a phone or a laptop, move the authenticator first, then reset the device to factory settings. A device you no longer hold should not hold your sign-ins.

When something looks wrong

Small, unfamiliar charges are sometimes a test: someone checking whether stolen card details work before trying a large purchase. Tiny charges you do not recognise explains what to do. If you believe a card's details have leaked, act quickly; If card details may have leaked: the first hour lists the steps in order.

In any doubt, write to support from your space. Describe what you saw, when, and which card or order it concerns. Never include the card number itself; the last four digits are enough.

In short

Security is mostly routine: a unique password, safely stored recovery codes, suspicion of anyone asking for codes, a weekly look at the sign-in log, and cards that each do one job. None of it takes long, and together it keeps your space yours.