The card is tokenised
A token is a stand-in value for your card. It works only inside our payment path. Your real card number never rests on our systems.
Your card number never lives here
Money and phone numbers are sensitive. We treat them that way. VirtualPhone runs to PCI-DSS Level 1, the strictest tier of the card industry security standard.
Cards are tokenised at the moment you pay. Payments are encrypted end to end. Personal data is handled under GDPR rules.
Three things protect every top-up
Security is not one badge. It is the shape of the payment path. Ours has three parts, and each one removes a place where data could sit.
-
-
The payment is encrypted
Every payment travels over an encrypted link. Encryption scrambles the data so only the two ends can read it. Nothing moves in the clear.
-
The operator link is direct
We connect straight to networks instead of passing your order down a reseller chain. Fewer hands touch it. Fewer places can leak it.
The full technical detail sits on our encryption and data handling page .
What we never hold
The safest data is data nobody keeps. So the list of what we do not store matters more than the list of what we protect.
Four things stay off our systems. This is not a policy we can quietly change on a Friday. It is how the payment path is built.
Read the full privacy policy- Raw card numbers
- Tokens only. The full number stays with the card networks.
- Your card security code
- It is used once at payment, then it is gone.
- Sold contact details
- Your email and phone are never sold or rented on.
- Silent data sharing
- We share only what a payment or a top-up needs to work.
Where your data goes, step by step
One top-up, followed end to end. Four steps, and none of them park your card details anywhere.
-
You enter the number
You pick a country, an operator and a value. Nothing has been charged yet at this point.
-
The card is swapped for a token
Payment details go straight to our certified payment path. We receive a token back, not a card number.
-
The top-up is sent direct
The order goes over our own operator link. The average delivery is 5-7 seconds.
-
You get a signed receipt
The receipt shows the value, the cost and the rate. A failed recharge is refunded, not kept.
Curious which networks we reach without a middleman? See the operators we connect to directly.
Security questions, answered
Five things people ask before they trust us with a card.
Do you store my card details?
No. We hold a token, not a card number. A token cannot be used anywhere outside our own payment path.
What does PCI-DSS Level 1 actually cover?
It is the card industry's audited security standard. Level 1 is the strictest tier. It covers how card data moves, where it rests and who may touch it.
Is my personal data covered by GDPR?
Yes. GDPR is the EU data protection law. You can ask us what we hold about you, and you can ask us to erase it.
What happens if a recharge fails?
You are not charged for it. The money goes back to the card or wallet you paid with.
Can I use a foreign card?
Yes. Our checks are built for cross-border payments. A card issued abroad is normal here, not a red flag.
Safe to send. Fast to land.
Pick a country, enter a number, pay once. The card stays protected and the credit arrives in seconds.