Design a geography-aware virtual card service

## Scenario You are asked to design a **virtual card number** product for a financial app. Users can generate virtual card numbers to pay online/in-store. The product must support **geography-aware behavior**, such as: - Issuing card numbers that are valid only in certain countries/regions, or have region-specific limits - Handling multi-currency and cross-border usage - Supporting travel use cases (temporary region allow-lists) - Reducing fraud (e.g., card-not-present, unusual location) ## Requirements ### Functional - Create/activate/suspend/delete a virtual card - Configure controls: region allow/deny list, spend limits, merchant category restrictions, time windows - Authorize transactions and decide approve/decline in real time - Show transaction history per virtual card ### Non-functional - Low-latency authorization (e.g., <150 ms p95 for decisioning layer) - High availability - Strong security (tokenization, access control) - Auditability and customer support traceability ## Deliverables Provide: 1) Components and data model 2) How authorization works end-to-end (including geo checks) 3) Fraud/risk integration 4) Key edge cases (travel, VPN, mismatched location signals, offline/partial data)