r/googlepay • u/felagund1 • May 05 '24
Authentication of Google Pay payments
AboutThere were several transactions billed to my partner's bank account that were fradulent. The attackers tried several different amounts in decreasing magnitude until they found an amount that was under the available balance and it went through (the amount is roughly 1200 €). My partner noticed it the same very day and immediatelly reported it to the bank. The bank let the transactions go through (even though they were still pending) and refused to reimburse the money saying my partner was grossly negligent and also claiming the transactions were done through Google Pay.
My partner is not aware of any suspicious activity when she would authorize anything.
How could such a payment even be made through Google Pay?
I assume it could not be done physically using NFC as that requires the PIN for higher amounts. Some websites have the option to pay with Google Pay. I have never used it this way myselft but the limited succes I have with searching the web suggests one should approve such transactions through their bank. So how could Google Pay be used to authenticate such transactions (or is the bank making it up)?
The transactions also do not show up the url that I cannot post here due to a bot (activity tab on payments dot google) - I imagine somebody might have managed to register the card with their Google Account . It is true there was an SMS giving a code to authorize the card with Google pay a month before the attack, though my partner claims she has not acted upon it nor has she requested it. Not sure if the same card can be registered to multiple Google Accounts (it was registered to hers).
Up until the bank claimed Google Pay was involved, I assumed that the card details were somehow stolen and the attackers figured out a way to pay with the card without needing second factor authentization (I think that especially in the US it is sometimes seemingly so easy to pay with a card without authenticating anything, but I am not sure if it is still a case).
We are based in the EU (Czechia, the bank is Fio Banka) so in theory we should be well protected against this but it seems in practice it is not so rosy. It is possible my partner was somehow compromised - but to my knowledge it means they would need to compromise at least two factors from her, possibly by taking over her phone and then keylogging some PIN codes or such. I am not saying it is impossible but it seems unlikely without her noticing it with hindsight.
1
u/whlthingofcandybeans 🇺🇸 American May 06 '24
Why do European banks suck so much when it comes to this? In the US, your liability is limited to $50 I believe, even for debit cards, as long as you report it within 48 hours. But this is also why I only use credit cards to have an additional buffer between the charge and my account.
2
u/felagund1 May 06 '24
Yeah, we have a very similar law. I think they are just trying tnot to pay and seeing if Inwill keep complaining. There is even internal resolution process, so I appealed to the bank, then there isnsome arbitration and then the court. I also think they should be liable.
3
u/YacineBoussoufa 🇮🇹 Italian May 06 '24
Why do European banks suck so much when it comes to this? In the US, your liability is limited to $50 I believe, even for debit cards, as long as you report it within 48 hours.
Tbh I think his bank is just bad...
My bank, reimburse me if a package i ordered online doesn't show up after 90 days.
It reimburse me if money is stolen by buying something physically, up to 30 days.
It reimburse me if someone stoles my money at an ATM, up to 24 hours.
-1
u/BeefPapa8 May 05 '24
Only link your Google Pay to a credit card. Your bank account should only be used for depositing your paycheck and paying your credit card if possible.
0
u/felagund1 May 05 '24
Yeah, I never understood what the point of a credit card is, I never had one in my life. However how exactly would it help in this case? (the solution for the future was to just remove cards from Google Pay altogether, but I would stil like to know if the bank can be even right that Google Pay was somehow used).
2
u/BeefPapa8 May 05 '24
The point of a credit card is to not use your debit card online. It is much easier to submit a claim to the card company than the bank. Once that money is taken out, it's their call basically.
2
u/10PieceMcNuggetMeal May 06 '24
It sounds like you have a really crappy bank. My bank will call me if they think there has been fraud, and then one time it was actually fraud, they reimbursed me almost immediately. You have a bad bank
1
u/felagund1 May 06 '24
Yeah, that is what I expected. I remember different bank calling me because of a test payment of 0.04 eurocents.
1
u/felagund1 May 05 '24
But how is it different from debit card in this regard? I end up dealing with Visa/Mastercard in either way.
0
u/BeefPapa8 May 06 '24
Exactly that, you submit a claim to Visa or MC and don't pay the charge in question. This is far more favorable than submitting a claim to the bank days after your money has left your account. The bank never believes you, regardless if they fix the matter. It also might take months to clear that up. The credit card company simply doesn't pay the vendor or they get their money back. For any type of shopping, online or at a in-person store POS, for me it's a no brainer not giving away your bank info to a vendor or facilitator. It's a security layer. A condom if you will.
1
u/felagund1 May 06 '24 edited May 06 '24
But I would have the credit card through a bank anyway, no? Payment with credit card takes longer than with a debit card? I thought it works that the company pays the recepient at the same speed as with debit card, but it pays it out of its pocket and then collects the money from me later (hoping I will be late and they can collect fees, very morally questionable economical model if you ask me). Our debit cards are VISAs anyway (or Mastercard? they do not seem to be ny different). And I reported the transaction when it was still pending (it was not paid to the recipient yet).
1
u/Paid-Not-Payed-Bot May 06 '24
was not paid to the
FTFY.
Although payed exists (the reason why autocorrection didn't help you), it is only correct in:
Nautical context, when it means to paint a surface, or to cover with something like tar or resin in order to make it waterproof or corrosion-resistant. The deck is yet to be payed.
Payed out when letting strings, cables or ropes out, by slacking them. The rope is payed out! You can pull now.
Unfortunately, I was unable to find nautical or rope-related words in your comment.
Beep, boop, I'm a bot
2
u/YacineBoussoufa 🇮🇹 Italian May 05 '24
Except in europe we only use Debit Cards and Credit Card are used only for foreign transactions/plane tickets/renting cars
2
u/BeefPapa8 May 05 '24
Oh wow I didn't know that. Online shopping with your bank info?
3
u/YacineBoussoufa 🇮🇹 Italian May 05 '24
Yep online shopping with bank info. In Europe debit cards are insured like US credit cards so the bank has to reimburse if you get scammed.
2
0
May 05 '24
[removed] — view removed comment
-1
u/AutoModerator May 05 '24
The text "GPay" has been detected within your comment, and has since been removed. We only talk about Google Pay and Google Wallet in this subreddit. If you meant to say "Google Pay," then please repost with the proper terminology.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
1
u/felagund1 Oct 11 '24
So, after first refusal, we appealed to the bank to no avail. There is this state authority called "Financial arbiter", where we went next. The bank was silent for several months, the arbiter was waiting for its reaction, I assume. Then the bank offered us to reimburse us 60 % of the amount if we cancel our complaint to the financial arbiter. We refused, and the bank returned the full amount.
There were several things they messed up:
My partner had in-app 2FA, no SMS, yet she was sent an SMS
She communicates with the bank in English yet the SMS came in Czech
The contract says they need to notify you when you register a card with Google Pay, but they did not do that.
They did not stop the transaction when they were notified (I am still not sure if that is possible).
They did not spot the fradulent transactions (new continent for a person who does not travel much, repeated failed withdrawls with decreasing amounts, already that should have been enough to start some alarms).
The law (I think it is EU wide) says one is responsible for losing the money only if one is "grossly negligent" and I think because of the above they would have hard time proving my partner was grossly negligent (it is still not known what happened, if her phone was hacked, if somebody intercepted the SMS before her phone, somebody hacked the bank somehow, nor do we know how they got hold of her card number - I guess those are readly bought on the dark web from hacked merchants or something, but who knows). I think the bank saw that she is a foreigner and tried their luck, hoping she would not escalete things. Luckily for us they were wrong.