Euro Payments FAQ: Cards, Mobile Wallets, Security and Rewards

This page covers the spending side of a euro account:

• What a virtual card is and how it differs from a plastic one
• Why a card's BIN decides whether a hotel or car rental desk accepts it
• How Apple Pay and Google Pay stand in for a card without sharing its number
• What strong customer authentication and 3D Secure are for
• What you can expect back after an unauthorised payment
• Why a payment you were tricked into making is treated differently
• How cashback and balance rewards are calculated in practice, and more.

It closes with the fee questions that follow from all of this: what a currency conversion fee is made of, why published pricing changes, and where to look for terms that are current.

The examples below draw on Blackcat. Its euro accounts and payment cards are issued by Papaya Ltd under an MFSA electronic money licence.

Euro Payment Cards

What is a virtual payment card?

A virtual payment card is a card that exists only as a set of details in an app: number, expiry date, and security code, with no physical card.

It works anywhere those details can be typed or digitally passed, including online shops, subscriptions, and mobile wallets. Because it is issued in software, it is normally available as soon as the account is open.

How is a virtual card different from a plastic card?

The card details and the account behind them are the same; what differs is where you can present them. A plastic card can be inserted, tapped or swiped at a physical terminal and used at an ATM. A virtual card cannot, unless it has been added to a phone wallet. Many people use both, keeping the virtual card online and the plastic one for travel and cash.

What is a card BIN, and why does it matter?

The BIN is the first 6 to 8 digits of a card number, and it tells a merchant which institution issued the card and what type of card it is. Merchants use that information to decide whether to accept the card.

Why are some cards rejected at hotels and car rental companies?

Because these merchants do not take payment at the counter, they place a hold against a guarantee. Their systems are often configured to reject BIN ranges associated with prepaid products, since those cannot reliably support a later charge for damage or a missed return.

Blackcat payment cards are issued on a credit-grade BIN for this reason, which improves acceptance in those situations. No card is accepted everywhere, so it is worth confirming with the merchant in advance.

Can I have more than one card on the same account?

Usually yes. Most providers let you hold a primary card plus additional cards that draw on the same balance, which is useful for separating travel spending from everyday spending or for giving a family member access without opening a second account.

Blackcat supports additional cards alongside the primary one, all sharing the account balance and all visible in the same app.

Can I use a Euro payment card abroad?

Yes, wherever the card network is accepted, which in practice is most of the world. Inside the euro area, you pay in euros with no conversion. Outside it, the amount is converted, and that conversion has a cost attached that varies by provider.

What happens when I pay in a currency other than the euro?

The transaction is converted into euros before it is charged to your account, at a rate set by the card network plus whatever margin your provider applies. You may also be offered conversion by the merchant's terminal, shown as a choice between paying in euros and the local currency.

What is a card authorisation hold?

A hold is an amount reserved against your balance before the final charge is known. Hotels, car rental firms and fuel stations use them because the final amount depends on what happens later. The money is not taken, but it is unavailable to you until the hold is released or replaced by the actual charge.

Apple Pay and Google Pay

What are Apple Pay and Google Pay?

They are mobile wallets: services that let you store a payment card on a phone or watch and use it to pay. Neither is a payment provider in its own right, nor does either hold your money. Your provider still issues the card behind the wallet, and the payment still settles against the same account.

The wallet is the way you present the card, not a separate product. The ECB's SPACE study put mobile apps at 7% of point-of-sale payment value in the euro area in 2024, up from 4% in 2022.

How do Apple Pay and Google Pay work?

When you add a card, the wallet asks the card network to issue a device-specific number that stands in for your real card number. At the till, the phone sends that substitute number together with a one-time code generated for that single transaction.

Your provider recognises the pair, matches it back to your account and authorises the payment.

Is my card number shared with the shop when I pay with my phone?

No. The merchant receives the device-specific token rather than the number printed on your card, and it never sees the security code. That is the main security advantage of paying by phone: a merchant data breach exposes a token tied to one device rather than card details that could be reused anywhere.

Can I add a virtual card to a mobile wallet?

Yes. A virtual card has all the details a wallet needs so that it can be added in the same way as a plastic one. That combination is what lets someone pay in a shop on the day the account opens, before any card has been posted. Blackcat's virtual card can be added to Apple Pay and Google Pay and used at contactless terminals.

Do I need an internet connection to pay with a mobile wallet?

Not at the moment of payment, in most cases. The device stores a small number of pre-generated one-time codes, so a tap works even when the phone is offline.

Once those are used up, the phone needs to reconnect to obtain more. You do need a connection when first adding a card, and after blocking or replacing one.

Can I use a mobile wallet abroad?

Yes, at any contactless terminal that accepts the card network. The same conversion rules apply as for a physical card, since the underlying transaction is identical. Acceptance of the wallet itself varies by country more than card acceptance does, so carrying a plastic card as a fallback is sensible on longer trips.

Can I use Apple Pay or Google Pay for online purchases?

Yes, on sites and apps that offer the wallet at checkout. Paying that way passes the token rather than your card details, and authentication happens on your device instead of through a separate verification screen. It removes the step of typing card numbers into a site, which is one of the more common ways card details are captured.

What happens to my mobile wallet if I block my card?

Blocking the card also blocks the token, so wallet payments stop as well. That is the intended behaviour: one action covers every way the card can be used.

If the card is later replaced, the new card usually needs to be added to the wallet again, although some providers update it automatically.

Payment and Card Security

What is strong customer authentication?

Strong customer authentication is an EU requirement that certain payments be confirmed using at least two independent factors from three categories: something you know, such as a passcode; something you have, such as your phone; and something you are, such as a fingerprint.

It was introduced under the second Payment Services Directive and applies across the EEA. Some low-value or recurring payments are exempt.

What is 3D Secure?

3D Secure is the protocol that applies strong customer authentication to online card payments. When you buy something and are asked to confirm it in your provider's app or with a code, that is 3D Secure running. It gives the issuer a chance to check the payment against what it knows about you and your device before approving it.

Every Blackcat payment card is enrolled in 3D Secure by default.

Why am I asked to confirm a payment in my app?

Because the payment fell within the scope of strong customer authentication, or because it looked unusual enough to warrant a check. Providers score transactions against patterns, and an unfamiliar merchant, country or amount raises the score.

The confirmation step is the point at which you can stop a payment you did not start, which is why it is worth reading rather than approving reflexively.

How common is payment fraud in Europe?

The joint EBA and ECB report on payment fraud puts the total value of fraudulent payment transactions across the EEA at €4.2 billion in 2024, up from €3.5 billion in 2023. As a share of all payments, the rate stayed stable, at around 0.002% of total transaction value. Card payments made with cards issued in the EU or EEA accounted for €1.329 billion of the 2024 figure.

What is payer manipulation?

Payer manipulation is fraud in which the victim authorises the payment themselves after being deceived. Someone posing as a provider, a delivery company or a colleague persuades the payer to send money or approve a transaction.

The same report identifies this as a growing category, and it is harder to stop than card fraud because the payment passes every technical check. Strong authentication confirms that you approved it, not that you meant to.

What is Verification of Payee?

Verification of Payee is a check that compares the recipient name you enter against the name registered on the account associated with the IBAN and tells you, before you send, whether the two match. It became a requirement for providers in the euro area member states in October 2025 under the Instant Payments Regulation.

It is aimed squarely at invoice fraud, in which a genuine invoice is intercepted, and its IBAN is swapped.

Can I get my money back after an unauthorised payment?

For a payment you did not authorise, EU rules generally require your provider to refund it and restore the account, with limited exceptions for gross negligence or fraud on your part. Report it as soon as you notice, because the outcome often turns on timing.

Payments you authorised yourself after being deceived sit in a different category and are treated differently, so the refund position is less clear-cut.

How do I block a payment card?

In most apps, it takes a few taps and takes effect immediately. In Blackcat, open the app, select the card and tap "Block card". The block is immediate and reversible, so it is worth using as soon as a card goes missing rather than waiting to confirm it is gone. If the card needs permanent closure or replacement, support arranges that after the block, and a replacement is posted to your registered address. Check more information on the security page.

How can I tell a real provider website from a fake one?

Check the address bar before you type anything. Clone sites imitating Blackcat exist, and the only official address is blackcat.app. Copies are convincing on the page and wrong in the domain, sometimes by one character.

Reach the site by typing the address or using a saved bookmark rather than following a link from an email, message or advert, and treat any page that asks for your full card details or app codes as suspect. The security team removes clones when they are reported.

What information should I never share with anyone?

Your card security code, one-time confirmation codes, app passcodes and account recovery codes. No legitimate provider will ask for any of them, including support staff, and an approval prompt you did not trigger should be declined rather than accepted.

If someone contacts you claiming to be from your provider and asks for these, end the conversation and get in touch through the app or the published support address instead.

Cashback and Balance Rewards

What is cashback on a payment card?

Cashback is a small proportion of what you spend, usually as a percentage of eligible card purchases, paid as a lump sum. It is a loyalty mechanism rather than a discount at the till, so it arrives after the fact.

Rates are modest, and the terms attached to them, including caps and exclusions, matter more to the amount you receive than the headline percentage does.

Which transactions usually do not earn cashback?

Cashback normally applies to card purchases only. Cash withdrawals, transfers between accounts, card-to-card movements and payments to financial services are typically excluded, and monthly caps are common.

With Blackcat, the 0.5% cashback applies only to eligible card purchases, not to other card activities such as cash withdrawals or transfers. Read the programme terms for the full exclusion list before you plan around it.

What is a balance reward?

A balance reward is a loyalty benefit calculated on the money sitting in your account, expressed as a percentage per annum and usually paid monthly. It is not interesting, because an electronic money institution is not permitted to pay interest on e-money, and it is not an investment product.

It is a benefit attached to a programme, and it can be changed or withdrawn under that programme's terms.

How is a balance reward different from interest on a savings account?

Interest is paid by a bank that lends your deposit out and is contractual. A reward is a loyalty benefit governed by programme terms, which can change.

The money also behaves differently: you do not need to lock it in a separate savings account or give notice to access it, because it stays in your payment account and remains available to spend. Blackcat's reward is 4% p.a. on average monthly balances of €300 or more, and 2.2% p.a. below that.

How often are rewards usually paid?

Monthly is the norm. A typical programme calculates over a defined period, often from the first day of a month to the first day of the next, and pays the amount partway through the following month. Because the calculation looks backwards, joining or leaving partway through a period affects what you receive for it.

Fees and Terms

What is a currency conversion fee?

It is the cost of turning one currency into another, and it usually has two parts: the reference rate used and the margin added on top. Some providers quote a percentage; others build the margin into the rate, making it harder to see. When comparing, look at the total amount debited for a given purchase rather than at the advertised rate alone.

Why do fees change over time?

Providers update pricing as their own costs, scheme charges and regulatory obligations change. EU rules require that you are told about changes to your framework contract in advance, typically two months, and that you can exit without penalty if you do not accept them. This is why the published copy links to a live pricing page rather than repeating numbers that would fall out of date.

Where should I check the current fees and terms?

On the provider's own pricing and terms pages, not in a comparison article or a review site. Fees change, regional differences apply, and third-party summaries quickly go stale. For Blackcat, the current tariff schedule and terms are published on blackcat.app, and the product pages for the euro IBAN account and payment cards set out what is included.

Where to go next

Cards, wallets and rewards are where the differences between providers show up fastest: acceptance at a hotel desk, whether a token survives a card replacement, what counts as an eligible purchase, and what a conversion actually costs.

With Blackcat, cards are issued on a credit-grade BIN, which improves acceptance where a guarantee hold is placed rather than a payment taken. A virtual card is available in the app immediately and a plastic card on request, additional cards share the account balance, every card is enrolled in 3D Secure by default, and blocking a card in the app blocks its wallet tokens at the same time.

Cashback of 0.5% applies to eligible card purchases, not to withdrawals, transfers or card-to-card moves. The cards page sets out the card features, and the euro IBAN account page covers the account behind them.

Fees, limits and reward terms change, so check the current pricing and terms on blackcat.app before acting on anything here. If a question was not answered, support is available at support@blackcat.app or through the in-app chat.

Disclaimer

This page is general information about how Euro payment tools work. It is not financial, tax or legal advice, and it does not take into account your circumstances. Fees, limits, eligibility criteria and reward programme terms change, and the figures quoted here were accurate at the time of writing; always check the current pricing and terms before acting. Regulatory requirements described here apply to providers generally, and their application to any particular provider may differ.

The Malta Financial Services Authority licenses Papaya, Ltd. Papaya, Ltd. issues Blackcat as an Electronic Money Institution (EMI). Registration number C55146. Client funds are safeguarded in accordance with applicable legislation. The Depositor Compensation Scheme does not cover funds held in e-money accounts.