If there were a unique credit-card number for every transaction paid for with a card, much of the effort and cost companies must bear to secure sensitive customer data would simply vanish.

That obviously can’t be accomplished with plastic cards, but for electronic transactions, virtual card technology that generates single-use numbers has been available in the United States for at least six years.

It is something of a puzzle that while many accounts payable departments in recent years have reduced or eliminated the use of paper checks in favor of wire transfers and other forms of electronic payment, relatively few have adopted virtual cards.

A number of large financial institutions offer the capability, which recently has begun trickling down to some mid-size and regional banks.

Another prominent player is CSI globalVCard, a six-year-old subsidiary of payment systems provider CSI Enterprises that issues virtual MasterCards for use with AP. Virtual-card technology was developed initially by Orbiscom, an Irish company that MasterCard purchased in 2009.

According to a study of 3,123 AP managers by RPMG Research, 18% of companies used virtual cards for making payments in 2013. On average those companies used such cards for 55% of payments. (Those figures were cited in an article by PaymentSource, a business-to-business publication for the payments industry. RPMG did not provide CFO with a copy of its survey report but confirmed that the numbers reported in the article were accurate.)

Using virtual cards for AP is “a good idea with a good value proposition,” mainly because the payer doesn’t have to worry about whether the vendor adequately secures the card number, says Avivah Litan, an analyst on data security and payment systems for Gartner. However, she adds, “I get a lot of calls from clients, and this never comes up.”

Litan is more skeptical about the merits of receiving payments made with virtual cards, because unless a vast majority of received payments are made with them, the receiving company will not face a lesser burden in complying with payment card industry (PCI) compliance standards for customer data protection. “If companies could get 100% [of payments through virtual cards], it would be great and they’d love it,” Litan says.

But according to Jeff Smith, CFO of Fortessa Tableware Solutions and a customer of CSI globalVCard, the technology offers clear benefits for both AP and accounts receivable.

“The big question everybody asks is, ‘If you receive a credit-card payment you have to pay a fee, so why would you do that?’ But we were already accepting credit cards as a payment vehicle before we started accepting the CSI globalVCard two years ago,” says Smith. “What we’ve found is that with the virtual card there is less chasing of paper. There is no check to receive or take to the bank, and you don’t have to worry about the payment getting lost, mishandled, or misplaced.”

While that is also true of wire transfers, there are fees for receiving wires as well. Wires are less expensive than credit-card transactions, but other factors more than make up for that, Smith says.

For one, a virtual card is usually authorized for the exact amount that’s due for a specific payment. With a traditional card that might have an available balance of many times that charge, there’s nothing stopping the vendor from overcharging. “That’s an error that would get corrected down the road, but the virtual card prevents the error in the first place,” Smith says.

Perhaps more importantly, because of the security benefit of paying with virtual cards, accepting them is a service for customers that want to pay that way.

Another advantage of paying with a virtual card rather than a wire transfer is that with the latter, a separate wire has to be generated for each transaction. “But I can upload a batch of payments to the CSI portal straight from our accounting software and transmit one amount of money that CSI disburses per my instructions,” says Smith. “All the payments are made with one action on my part.

When the company gets a statement from CSI globalVCard, each transaction is listed separately and shows the unique card number that was generated. That makes reconciling payments a snap, Smith says. “We can go on the online platform, look at account activity, and see which payments have been made,” he says.

Smith says Fortessa uses the virtual card to pay every vendor that will accept it. It can’t, for example, pay for its rent or utilities with the card, but most vendors that accept MasterCard accept the CSI virtual card.

CSI helps Fortessa spot missed opportunities, Smith adds. “I notify them of all the vendors I’m paying by check, and they run those against their database to find any that are getting paid through the CSI virtual card [by other companies],” he says.

As with most credit cards, virtual ones offer rebates based on usage volume. Smith views that as the accounting department, “traditionally thought of as an overhead department,” getting to position itself as a revenue generator.

CSI globalVCard also offers a mobile version of its virtual card. There are a couple of primary uses for that service. One applies mostly to smaller companies, for which those that are authorized to pay bills may also be executives that travel frequently. The other use for the mobile service is to issue virtual cards to business travelers in the exact amount of an upcoming hotel stay, for example. CSI has applied for a patent on enabling virtual-card usage by mobile devices.

Smith says Fortessa is not currently using the mobile services but is evaluating them as a way to thwart the theft of card numbers from its business travelers. “Our sales folks are all over the country, and unauthorized activity often appears on their cards,” he says. “Banks have become good at protecting us from responsibility for those charges, but that doesn’t mean we don’t have to cancel the card and get a new one shipped to us, while that person is without a card for a few days.”

A new service introduced this year, called SpendSecure, gives companies strong control over how employees use plastic cards. While researching customer needs before building out the service, a particular use case arose again and again, says Jason Kolbenheyer, managing director of the CSI globalVCard’s mobile division.

“Companies told us that even though they didn’t want everyone to have a [plastic] card, they wanted people to be able to spend [when appropriate],” Kolbenheyer says. “With SpendSecure everybody can have plastic cards, but they’re totally controlled. You can block them, set them up so they can’t be used until authorized, or whatever, and you can do all this from mobile devices.”

Barrie VanBrackle, co-chair of the global payments practice group at Manatt, Phelps & Phillips, says she wouldn’t be surprised if the usage of virtual cards takes off.

“Usage is not high now,” she says, “but that doesn’t mean there won’t be explosive growth. It’s a good product. The employer can instantly review purchases, set parameters for what the card can be used for, and save on paper. It certainly makes sense.”