4

Last weekend I added a credit card to Android Pay for the first time and used my phone to pay for a purchase at a grocery store. That Monday, the bank that issued the card called me and said that for security they were disabling the card and issuing me a new one.

They told me that there were no fraudulent charges, but Visa had contacted them and told them that there was reason to believe the card might be "compromised." That was the only information they had, and there is no apparent way for me to contact Visa and find out more.

Has this been known to happen when adding cards to Android Pay? The system is supposed to be more secure, but is it possible that using a card from a phone for the first time could be flagged as suspicious behavior?

Phone information: I'm using a LG G3 with the latest version of Android. It's not rooted. I downloaded Android Pay from the Google Play store.

  • 1
    I've been using Android Pay for a while now. No such issues. – littleadv Aug 24 '16 at 16:48
8

I doubt this is truly answerable, because the algorithms behind Visa's decisions and your bank's decisions on what to flag for fraud are nonpublic. I suspect, though, that the two things are not connected, despite the apparent connection in time.

Typically when Visa flags a card as potentially compromised, as opposed to your card issuer flagging it as having potentially fraudulent charges, that means that it was either in a 'dump' of credit card numbers, or was used in a retailer which was known to have been hacked or associated otherwise with potential credit card fraud. This language for example was used with me when I was notified that my card was potentially compromised in the Target hacks. Visa was notified by Target of the list of Visa cards used there, and then Visa notified my banks and they notified me.

If the use in Android Pay were concerning, it more likely would have come from your bank as a result of flagging a specific charge, in which case they ought to have used different language. There's no guarantee they would, of course; they might use the same language to avoid taking responsibility for the action and/or to make it less obvious what triggered it.

However, if Android Pay works the way Apple Pay does, your bank was involved in the adding process, and authenticated your use of the card through their own processes; as such, they knew (or should have known) you were using the card through Android Pay and were comfortable with the security precautions there (to make sure you were adding your actual card and not someone else's card).

  • The last paragraph is the crux of the matter: with Apple Pay, you can add any card you want so long as you have the card's information, or have physical possession of it, but that's not enough to authenticate it: the creditor needs to verify that you added it. This is for obvious reasons due to the ubiquity of NFC capable smartphones--without the authentication step, anyone could take a snapshot of your card and add it to their phone. So I don't see how Android Pay could work any differently. – heropup Aug 24 '16 at 17:21
  • @heropup Yep. Something else that interests me in relation to apple pay is that it seems that the apps for the various card issuers are tied in some way to apple pay itself - when I have a pending update for an app, for example, I cannot use the card associated with that app's bank in apple pay! I'm not sure how that actually works, but it's interesting to me that it appears to be connected. – Joe Aug 24 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.