Should your browser remember card numbers?

Every modern browser offers to remember your card number. Type it once, and next time the checkout form fills itself with a click. It is genuinely convenient, and browsers have improved how they protect saved cards. It is also one of the first things malware looks for, and it can turn a borrowed laptop or an unlocked computer into an easy way to spend your money. Whether to save a card depends on the card, the device and who else can use it.

How browser card saving works

When you enter a card on a checkout page, the browser offers to store it. If you accept, the number, expiry and name are saved, either only on that device or synced to your browser account across devices. The security code is usually not saved, and many browsers ask you to confirm with your device password, fingerprint or the card's security code before filling a saved card.

Synced cards are stored by the browser company, protected by your browser account. Anyone who can sign in to that account on a new device may be able to see or use the cards, depending on the browser's settings and extra protections.

The risks

• Malware. "Info-stealer" malware commonly targets browser data, including saved passwords, cookies and cards. If your computer is infected, everything the browser stores may be copied.
• Shared devices. Anyone using your browser profile can fill your card at checkout, sometimes without extra confirmation.
• Synced accounts. A compromised browser account can expose cards on every synced device.
• Hidden autofill fields. Badly built or malicious pages have tried to trick autofill into filling fields you cannot see. Browsers have added protections, but it is a reason to stay cautious on unfamiliar sites.

When saving a card is reasonable

The type of card matters most. A prepaid card with a modest balance limits what a thief could ever spend, so the convenience may be worth it. A card connected to your main bank account carries far more risk.

A middle way: copy from My Cards

With BuyVCC cards, you do not need the browser to remember anything. When you need the details, open My Cards, enter a fresh authenticator code, and use the copy buttons. The details hide after a minute. This keeps card numbers out of browser storage entirely, and the authenticator ensures nobody can view them without your phone. It takes about ten seconds longer than autofill.

Password managers versus browsers

Many password managers can also store cards and fill them at checkout. They typically require unlocking the manager first, and some only fill when you explicitly ask. Compared with basic browser autofill, this adds a deliberate step. If you already use a password manager, storing a low-balance prepaid card there is a reasonable choice. Protect the manager itself with a long master password that you use nowhere else, plus its own second sign-in factor.

If you already saved cards

1. Open your browser's settings and find the payment methods or autofill section.
2. Remove cards you no longer use, including expired ones.
3. For cards you keep, turn on any option that requires authentication before filling.
4. Check whether cards are synced across devices, and decide if that is what you want.
5. Repeat on every browser you use, including phone browsers.

When a device is lost or infected

If a laptop or phone with saved cards is lost, or you suspect malware:

• change your browser account password and sign out other sessions from a trusted device;
• remove saved cards from the browser account;
• check the balances and status of affected cards in My Cards;
• contact support with the card endings if you believe a BuyVCC card was exposed.

Because a prepaid card holds a fixed balance and cannot be reloaded, an exposed card's risk is limited to what remains on it. The five limits of a prepaid card explains why that is a feature.

Related habits

• Keep the browser and operating system updated; most attacks use known, patched flaws.
• Review extensions, which can read checkout pages; see browser extensions at checkout.
• Never store card details in screenshots or notes; see never screenshot card details.
• Use a separate browser profile for payments if you have many extensions.

Quick answers

Does the browser save the security code?

Most browsers do not store it, or store it only with extra protection. Check your browser's settings.

Is it safer to save a card on my phone than on my laptop?

Phones are generally harder for malware to infect, but they are easier to lose. A strong screen lock is essential either way.

See how it works and pricing.