Can adding a credit card to Android Pay be flagged as a security breach?

Question

Last weekend I added a credit card to Android Pay for the first time and used my phone to pay for a purchase at a grocery store. That Monday, the bank that issued the card called me and said that for security they were disabling the card and issuing me a new one.

They told me that there were no fraudulent charges, but Visa had contacted them and told them that there was reason to believe the card might be "compromised." That was the only information they had, and there is no apparent way for me to contact Visa and find out more.

Has this been known to happen when adding cards to Android Pay? The system is supposed to be more secure, but is it possible that using a card from a phone for the first time could be flagged as suspicious behavior?

Phone information: I'm using a LG G3 with the latest version of Android. It's not rooted. I downloaded Android Pay from the Google Play store.

Answer 1

I doubt this is truly answerable, because the algorithms behind Visa's decisions and your bank's decisions on what to flag for fraud are nonpublic. I suspect, though, that the two things are not connected, despite the apparent connection in time.

Typically when Visa flags a card as potentially compromised, as opposed to your card issuer flagging it as having potentially fraudulent charges, that means that it was either in a 'dump' of credit card numbers, or was used in a retailer which was known to have been hacked or associated otherwise with potential credit card fraud. This language for example was used with me when I was notified that my card was potentially compromised in the Target hacks. Visa was notified by Target of the list of Visa cards used there, and then Visa notified my banks and they notified me.

If the use in Android Pay were concerning, it more likely would have come from your bank as a result of flagging a specific charge, in which case they ought to have used different language. There's no guarantee they would, of course; they might use the same language to avoid taking responsibility for the action and/or to make it less obvious what triggered it.

However, if Android Pay works the way Apple Pay does, your bank was involved in the adding process, and authenticated your use of the card through their own processes; as such, they knew (or should have known) you were using the card through Android Pay and were comfortable with the security precautions there (to make sure you were adding your actual card and not someone else's card).