1. What is a virtual card?
A virtual card is a 16-digit bank card number (plus expiry date and CVV) generated on demand. It is valid once, up to a set limit, or for a limited period.
Generation process
Step 1: open your bank's app. Step 2: go to the "Virtual card" section. Step 3: choose the settings. Step 4: the number is generated instantly. Step 5: use it on the shopping site. Step 6: the amount is debited from your account automatically. Once used, the number is no longer valid.
Difference from a classic bank card
A classic card has one permanent number. If a site is hacked and the number is stolen, your card is compromised. A virtual card has a disposable number that expires quickly, so that risk disappears.
When to use a virtual card?
(1) Purchases on international sites without 3D Secure. (2) Recurring subscriptions. (3) A first purchase from an unknown merchant. (4) Purchases on sites you are unsure about. (5) Exact-amount purchases, to stay on budget.
2. Comparison of 5 Moroccan banks in 2026
In 2026, 5 banks actively offer virtual cards.
Attijariwafa Bank: Wafa Pay e-card and Simple Pay
Available since 2018 in the Wafa Pay app, free and unlimited. Unit limit of MAD 50,000, adjustable validity, 3D Secure compatible. Since May 2026, Attijariwafa Bank has also offered Simple Pay, the virtual card built into its Simple neobank app (successor to L'bankalik), available from the free Go tier.
Bank of Africa BMCE: BMCE e-card
Built into the BMCE Direct app since 2020 and free for BMCE customers. Unit limit of MAD 30,000. Distinctive feature: it is linked to a temporary account.
CIH Bank: CIH Virtual
Launched in 2022 in the CIH Mobile app, free for CIH customers. Limit of MAD 40,000. Distinctive feature: a "supplier card" option.
Société Générale Morocco: SG e-shopping
A more traditional service, available in SG's online Personal Space and free for SG customers. Limit of MAD 25,000.
Banque Populaire: La Virtuelle & L'Instant (new, June 2026)
Launched on June 4, 2026 in the Pocket Bank app. "La Virtuelle" is a Moroccan virtual card that also works at physical card terminals via Apple Pay/Google Pay, in addition to online use. "L'Instant" is a free single-use card that expires automatically after 1 hour if unused, the strictest anti-fraud protection on the Moroccan market to date.
3. The 3D Secure standard in 2026
3D Secure is the international banking security protocol that adds a strong authentication step to online payments.
How 3D Secure works
Step 1: you enter your card details on the shopping site. Step 2: the site contacts the issuing bank. Step 3: the bank sends an SMS code to your phone. Step 4: you confirm. Step 5: the transaction goes through.
Sites supporting 3D Secure in Morocco 2026
All CMI-approved Moroccan online merchants have supported 3D Secure since 2023, as do most major international sites.
Problem cases (non-3DS sites)
Some international sites still refuse 3D Secure. On those, always pay with a virtual card.
4. Practical security: 7 golden rules for 2026
These 7 habits protect your banking data online.
Rule 1: always check the URL before paying
Before entering your card, check (a) the HTTPS protocol, (b) the exact URL and (c) that the SSL certificate is valid.
Rule 2: always refuse to save your card
When a site offers to "Save card for future purchases", say no.
Rule 3: prefer a virtual card for international purchases
Use a virtual card for any purchase outside Morocco and the EU.
Rule 4: turn on real-time payment notifications
All Moroccan banks send instant SMS or push notifications for every card transaction.
Rule 5: never give your national ID or banking password online
No legitimate merchant will ask for your national ID or banking password. A site that does is a phishing site.
Rule 6: check your recurring subscriptions once a month
On your monthly statement, find every recurring debit and cancel the unused ones.
Rule 7: change your online banking password regularly
Change your banking app or website password at least every 6 months, and use a strong password.
5. Limits of virtual cards in 2026
Virtual cards are safer, but they have a few practical limits.
Not usable for in-store payments
A virtual card exists only in digital form, so you cannot use it at a physical POS terminal.
Generation time for urgent purchases
Generation takes 30-60 seconds, a nuisance for a very urgent purchase.
Some merchants reject virtual cards
A few merchants detect and refuse virtual cards, typically for long-term subscriptions.
No purchase insurance
The "new purchase" protection on Gold/Platinum cards generally does not apply to payments made with a virtual card.