How Google Pay works
When a card is added to Google Wallet, a virtual card is created: a randomly generated number that replaces the actual card number, of which the app shows only the last four digits. In a shop the phone shares that virtual card with the merchant's terminal. Google requires a screen lock on the device for in-store payments.
In card scheme terms the virtual card is a device token, issued through the scheme's token service with the issuer's approval. The payment remains a card payment: the scheme maps the token back to the card, and the issuer authorises it.
What a gateway receives from Google Pay
Online and in apps, Google's API returns the card, encrypted, for the merchant's payment provider in one of two forms:
- PAN_ONLY: a card stored in the user's Google Account, returned as the card number with its expiry month and year
- CRYPTOGRAM_3DS: a card stored as an Android device token, returned with a 3-D Secure cryptogram generated on the device
Why the two forms matter
The difference is authentication. A device token arrives with a cryptogram made on the phone, while a card number from the Google Account is an ordinary card-not-present payment that may still need 3-D Secure. A gateway therefore reads the form of each payment and handles it accordingly.
Google Pay or Apple Pay?
- Apple Pay
- Apple's equivalent, on Apple devices only. Apple Pay always sends a Device Account Number; Google Pay may also return a card saved in the Google Account.
- Google Wallet
- The app that holds cards, tickets and passes. Google Pay is the paying itself, with a card from the wallet or from the Google Account.
Where Google Pay shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
- BIN sponsorship: how to launch a card programmeWho does what in a sponsored card programme, what the BIN sponsor, Visa and Mastercard ask of a programme manager, the rules for crypto-linked cards, and where an EMI licence fits.
- How to build a crypto card app like RedotPayHow a stablecoin card really works: what happens between the tap and the answer, how the crypto is converted and held, what each module does, and the licences on each side.
Where it is written
The laws and standards this page's facts come from.
- Google Wallet Help, Keep your payment info safe
- Google Pay API, request objects: allowedAuthMethods (Google for Developers)
General information, not legal advice: what applies to you depends on your services and your market.