In my home country (Turkey), we have virtual cards that usually have zero limit, and you can assign a limit to them temporarily (like an hour) to make a purchase. Then the card returns to the state without any limit, so no merchant gets to charge more than once or above the assigned limit. If that virtual card is compromised, you can just get a new card and kill the old one.