Payment card information of a consumer is protected during online payment card based transactions by equipping a user device of the consumer with a control that, when activated by the consumer during an online shopping session, causes the user device automatically to request and receive, from a third-party payment processing service (PPS), temporary proxy payment card information, and to populate that information into an online transaction web interface of the merchant. The temporary proxy payment card information is associated in the third-party PPS with a real payment card account of the consumer. When the PPS receives a transaction authorization request from a merchant via a payment card network, the PPS uses the consumer's real payment card information to authorize the transaction. The consumer's real payment card information is never exposed to the merchant.