Recent CitiCard changes to their VAN (Virtual Account Number) program

Credit Cards
1

If you have given a CitiCard VAN to any vendors like Amazon, Netflix, Comcast, Verizon, etc. in the past, be aware Citicard is suddenly not going to honor those “account” numbers. IMO, your services may be shutdown or the vendor may charge you a fee for non-payment.

IMO, CitiBank/CitiCards seem to have made some dramatic changes to their Virtual Account Number (VAN) management.

What are VANs:

For those who may not be aware VANs (virtual account number) are persistent “special purpose” Credit Card Account Numbers that, behind the scenes, are tied to your real credit card account. The VANs could be used for Internet purchases, “one-off” transactions or “one off” vendors you deal with over the phone. If you didn’t want to provide your “real” CCAN, you can create any number of “special purpose” VANs that (inside CitiCard) would link back to your real CCAN. You could ask a service provider to bill HIS charges (monthly or otherwise) to the VAN and not worry about him exposing your REAL CCAN. VANs are a great way to limit the exposure/recovery pain if the account number you shared is compromised or a vendor begins to misbehave and continue to try to place charges based upon the account information information he was given. This is NOT related to the single-use card numbers generated by electronic wallets or the one-time “tap to charge” account numbers generated by merchant terminal processing.

What did CitiBank/CitiCard change?

CitiCard has made a number of changes in their VAN program. The CSRs seek to explain as “enhancements”. They are:

  1. As of 8/24, they invalidated all existing CitiCard VANs that had been issued prior to 8/23/25. It didn’t matter when the VANs were set to expire. Citicard tossed them all. The CSRs report that Citi sent a notification email explaining that all the VANs would be trashed. Maybe you received it. I don’t believe I was copied. If you did receive it, please communicate how this was explained in the email. I heard from one of my service providers when their monthly charge was rejected yesterday.

  2. After CitiCards threw everything out they seem to have implemented the following procedural changes:

a) Previously, you could set any amount as a “daily” limit of what could be charged to the VAN. It could be any value you typed in up to the limit on the underlying card. Now, the daily limit can only be set to one of the 6 options (and no more than $300) that CitiCard puts in the “dropdown” list.

b) Previously you could set the VAN to automatically expire anytime between the current month and 2 years from now. That WAS very secure if you were creating a VAN that you only wanted it to be available for a limited period of time. Now, CitiCard gives the client NO option on the expiration date. CitiCard forces the expiration to be 3 years from the date of creation. Citibank also now automatically renews the VAN for a new 3 years at any expiration. You can no longer have the card expire in a month or two or even automatically be deactivated when it does expire. Yes, if you remember to do so, you can always go back later and manually “deactivate” a VAN. IMO, it would be better if advances in technology made stuff easier.

c) Be very careful where you click. Previously, if you clicked on the little “slashed” eye icon on the line containing the VAN, once you re-validated your identity, it would display the full VAN and its CVV value. In the past, that action didn’t change anything. It simply displayed all the hidden values. In the new environment, it displays the VAN but also generates a new CVV value. If you had shared that set of values with any type of subscription or continuing service, you just blew it up without any warning from CitiCard. Any attempts for a vendor to use the VAN (with the CVV value you gave them before) may be rejected.

There may be more changes that I haven’t encountered yet. I am not sure I handle much more of these improvements.

Please excuse any typos, missing words, or grammar mistakes. As I get older, I find people may not believe English is my only language. :slight_smile:

What do you think? Did anyone get the email “blast” from Citi explaining this?

2

Just a general statement about these “blasts” companies send out. They send us a change of TOS that is the length of War & Peace written in Lawyer speak. Do they really expect us to read it?

3

I’m glad CapitalOne hasn’t changed their VAN, in fact, they recently added to it. You can now generate a VAN that isn’t specifically linked to only one vendor, but you can delete it if it gets compromised. I haven’t used that much, but appreciate the flexibility.

Actually… I might use it for Progressive Insurance, because Progressive home and auto policies are actually issued by different entities, and one VAN for Progressive fails to work for all of them.

4

Wow, that’s a huge change. I used Citicard VAN for years primarily for online purchases (especially Aliexpress and other foreign seller websites). The Virtual CC number with the ability to limit $ amount, frequency, and expiration date was VERY helpful. Citi ticked me off by cancelling the card for lack of use a few years ago. I wish Chase had that feature on their cards, but they don’t. I think only Citi and Capital One do. So I signed up at Privacy.com to use their VAN service. It offers most of what Citi did, and there is no charge for small users. I checked it out and it had good reviews for service and security. It’s met my needs and I’ve been satisfied.