Google Pay: Processing information for payment and anti-fraud providers

Google Pay is a digital wallet that allows customers to pay with a card saved to their Google account or provisioned to their mobile device. When a customer pays with Google Pay, VTEX sends the transaction to your connector via the Create payment endpoint, including card fields not present in standard card transactions.

This guide addresses common questions from payment and anti-fraud providers about processing these transactions.

Google Pay transactions use a tokenized card number instead of the number printed on the card, which is the Primary Account Number (PAN). There are two types of tokenized number:

• DPAN (Device Primary Account Number): Tokenized version of the PAN linked to a specific device of the customer, such as a smartphone, smartwatch, or tablet.
• FPAN (Funding Primary Account Number): Tokenized number that identifies the account charged for the transaction. Wallets use it when the customer can choose between more than one payment method, such as different cards or bank accounts.

For more information, see DPAN and FPAN: Understanding security in the online tokenized payment flow.

In addition to standard card transaction fields, the card object of a Google Pay DPAN transaction can include the following fields:

VTEX sends cryptogram, eci, and paymentOrigin only when these fields are enabled for your account. To enable them, open a ticket with VTEX Support.

The following example shows the card object of a Create payment request for a Google Pay DPAN transaction. In this example, card data is tokenized because the connector environment isn't PCI DSS compliant:

This example shows only wallet and card-related fields. For the complete request body, see the Create payment endpoint.

Standard credit and debit card transactions made without a digital wallet don't include these fields, so your connector must keep processing payloads that omit them. For the complete list of requirements, see Processing DPAN cards in external connectors.

Transactions made with other digital wallets carry their own paymentOrigin values, such as Apple Pay. Transactions made without a digital wallet don't include this field.

In the VTEX Admin, go to Orders > Transactions, or type Transactions in the search bar at the top of the page, and open the transaction you want to check. Transactions made with a digital wallet display the following fields:

The VTEX Admin displays panType in the transaction details, but the Create payment request that VTEX sends to your connector doesn't include this field. To identify the wallet in the payload, use paymentOrigin.

No. Transactions with DPAN cards don't require the CVV, because device tokenization identifies the cardholder. VTEX sends the CVV in certain transactions with FPAN cards.

Subscription and recurring transactions also don't use the CVV.

A DPAN is linked to a specific device, so you need a mobile device with the card provisioned in Google Pay. On desktop browsers, Google Pay uses a card saved to the Google account, which results in an FPAN transaction.

To run a DPAN test transaction, follow these instructions:

1. On an Android device, add a card to the Google Pay app or through the redirect from your bank's app.
2. On the same Android device, open the Chrome browser and access your store.
3. Add a product to the cart and, at checkout, select Google Pay as the payment method.
4. Select the card displayed with the card image.
5. Complete the payment.
6. In the VTEX Admin, go to Orders > Transactions and confirm that the transaction details display panType as DPAN.

In step 4, select the card displayed with the card image, which results in a DPAN transaction. Selecting the card displayed with the logo of the card network results in an FPAN transaction.

• Processing DPAN cards in external connectors
• Create payment
• DPAN and FPAN: Understanding security in the online tokenized payment flow