Minhyeok Jeong
All work
  • Submitted

Virtual BINPreventive Recurring-Payment Control

A subscription card number that can only say yes to the payment you agreed to.

Role
Designed the control model
Ownership
Competition entry
Context
Entry, 21st Financial Competition, Financial Supervisory Service (Korea)
When
2026
Read the paper

Cancelling a subscription doesn't take your card number back.

Signing up takes one click and a stored card. Stopping the payments can mean several menus, confirmation screens and retention offers inside the merchant's own app, and refunds or chargebacks only help once the money has already moved. Virtual BIN hands that control to the card issuer, at the moment of authorisation. Each subscription gets its own virtual card number, and it works only for the merchant, amount, billing frequency and validity period the customer chose.

4 rules
Merchant, amount, frequency and validity, checked by the issuer
At authorisation
Where the control sits, before any money moves
34.0%
Of categorised free-trial complaints cited poor notice of conversion to paid (Korea Consumer Agency)
32.1%
Cited cancellation being restricted or obstructed
Where the control sitsToday the customer can only react after a charge. With Virtual BIN, the issuer checks the customer's own rules before it says yes.

Today

  1. Customer
  2. Merchant
  3. Card network
  4. Issuer

Cancellation and refunds come after the charge

With Virtual BIN

  1. Customer
  2. Merchant
  3. Card network
  4. Issuer

The customer's rules are checked at authorisation

Source: Virtual BIN paper, p.5, authorisation logic and control flow.

How it works

  1. 01

    One credential per subscription

    The issuer generates a virtual card number linked to the customer's real card, and the merchant only ever sees the virtual one. Technically it is a virtual PAN, which an issuer could run through a dedicated BIN range.

  2. 02

    Rules checked at authorisation

    When a merchant asks for payment, the issuer loads the policy attached to that credential before normal authorisation. A KRW 14,900 charge from the right merchant inside the billing window goes through. A much larger amount, a different merchant or a burst of attempts is declined or sent to the customer to confirm.

  3. 03

    Revocation that stays revoked

    The customer can lock the credential from their banking app, and later attempts are declined. The lock survives card updates and re-provisioning, so the merchant's access can't quietly come back.

Source: Virtual BIN paper, pp.3–4, the three core functional stages.

One card, a separate number for each subscriptionEach virtual number carries its own rules, so locking one never touches the others.
Customer's real cardNever shown to merchants
  • StreamingVirtual numberUp to KRW 15,000, monthly, 30-day validity
  • MusicVirtual numberIts own merchant, amount and billing cycle
  • Cloud storageVirtual number, lockedCan be locked from the banking app at any time

Source: Virtual BIN paper, p.3, subscription-specific credentials. The KRW 15,000 example is the paper's; the other two cards are illustrative.

Weeks later, Mastercard moved the same way

I submitted Virtual BIN to the Financial Supervisory Service competition in June 2026. On 23 July 2026, Mastercard announced Issuer Enforced Controls for its virtual card platform, which let issuers set spend limits, transaction caps and validity periods at the moment a virtual card number is created.

It is the same control point Virtual BIN relies on. The difference lies in who it protects, because Mastercard built its controls for corporate cards while Virtual BIN applies the idea to the subscriptions ordinary consumers find hardest to stop.

Read Mastercard's announcement (23 July 2026)(opens in a new tab)

The same control point, a different customer
Virtual BINMastercard logoMastercard Issuer Enforced Controls
Where the rule is setWhen the issuer creates the subscription credentialWhen the virtual card number is created
What it limitsMerchant, amount, billing frequency and validitySpend limits, transaction caps and validity periods
Who it is forConsumers and their subscriptionsCorporate virtual cards
WhenSubmitted June 2026Announced 23 July 2026

The best refund is the one nobody ever has to ask for.

Skills used

Payment-control design, Issuer authorisation, Consumer-protection research