Google Pay Ditches the CVV With Virtual Card Numbers for Amex Holders  

Autofill solved a lot of problems for eCommerce — especially friction at checkout.

Peeyush Ranjan, vice president and general manager of Google Pay, told Karen Webster that being able to fill in one’s payments details with a single click was a huge step in making us all feel more comfortable about using cards online.

But now, more than ever, we’ve got to hide our personal payment details from the fraudsters.

Defending against fraud, he said, “is a cat and mouse game.” The best lines of defense, he said, lie in hiding the 16-digit card numbers, while keeping user identities and credentials “bound” to the devices they use in eCommerce and card data “bound” to the merchants they frequent — all of it done safely and securely. The future of checkout, then, might lie with virtual cards.

Google said that beginning Tuesday (Feb. 7) it is rolling out virtual cards for American Express users — available, specifically, for the payment network’s proprietary American Express US consumer, business and corporate cards.

The move follows Google’s actions last year when it said Chrome browser and Pay users would be able to use virtual card numbers through autofill. The virtual cards have already been available to Capital One cardholders.

“This is a big step in the overall long-term direction of making online commerce safer and faster for our users,” Ranjan told Webster, and the company is working to bring virtual cards to those networks.

On the consumer side of the equation, the virtual card option is offered at checkout on Chrome browser or Android phones. The points of enrollment come when saving payment information in Chrome for the first time and after making a purchase online. The virtual option replaces holders’  credit card number with a unique card number that is in turn shared with merchants.

Google said in a blog post Tuesday that the details change often as commerce commences through Google Pay: Some cards will change the virtual card number for each merchant with which the consumer transacts, while others will change the CVC or CID, the three- or four-digit security code, in addition to the virtual card number.

Additional Layers of Security

Google has also said that there’s an additional layer of security in the mix: When Amex (or other) cardholders set up new virtual cards, they’ll have to go through a two-factor authentication process.  Google will also text the user’s phone to confirm identity. On occasion, Google noted on Tuesday, users may be asked to verify their identity before the form is filled: Google and the customer’s bank will jointly assess each transaction’s risk profile to determine if additional verification is warranted.

For Amex card users, Ranjan said, there’s liberation in knowing that even while typing in numbers — that one time — “there’s virtually no risk of those details being abused, through merchant hacks, or being used for any purpose other than for which I gave” that data. The virtual numbers, he said, are of no benefit to fraudsters who might see them in a database somewhere, as the virtual card number has no connection with the actual credit card numbers.

There’s an added benefit here, he said: Consumers don’t have to fumble with remembering their CVV numbers and other details. Merchants and issuers see increased conversions, and their chargeback rates decrease. Consumers can see their transaction details upon accessing them from their issuer app or websites and through Google Pay.

As Google continues expanding virtual card adoption, some added education will be needed — and additional outreach will be coming from the tech giant and the networks. Ranjan said that by dint of the “virtual” designation, holders have at least some understanding that it won’t be the real card data coming through. The Capital One rollout has been a successful one for the issuer and for Google over the last several months.

“They don’t even have to think about the CVV anymore,” he told Webster, “and they don’t have to think about or worry about the websites where they’re using this.”

As he told Webster of virtual cards: “The way we want to do this is  for everybody to be able — whatever card they have, whatever network its, whichever bank or merchant —  to be able to use this. The biggest job that technology has is to simplify complexity.”