Authentication methods

Google Pay™ uses 2 methods of buyer authentication:

CRYPTOGRAM_3DS authentication:
This authentication mode is associated with cards stored as Android tokens. The payment method is “tokenized” by the issuing bank, which is the only one able to decipher the card number. During the payment, Google transmits encrypted data (payload) containing the card token and a 3D Secure cryptogram generated on the buyer’s device when the card is added to Google Wallet.

When the issuer receives this data from the payment gateway, they do not require 3D Secure authentication.

This authentication method complies with the SCA (Strong Customer Authentication) standard imposed in Europe.
Authentication PAN_ONLY:
This authentication mode is associated with cards registered in the buyer’s Google account that are not tokenized and do not allow contactless payment.

It is used, for example, when the buyer selects a card added via Chrome auto-fill, or if a payment is made from a PC, another Android device, an Android device without Google Wallet enabled, etc.

During the payment, Google transmits encrypted data (payload) containing the card number and expiry date.

When the issuer receives this data from the payment gateway, they submit a request for 3D Secure authentication to the buyer.