Google Wallet

Is Google Wallet safe?

For paying in shops, yes. Google Wallet is safer than handing over a plastic card, because the terminal receives a randomly generated virtual card number instead of your real one, and the phone will not pay until you unlock it with a PIN, pattern, password or a strong fingerprint or face check. We found no breach of Wallet payment data.

The weaker side is privacy. Wallet sits inside your Google account, and Google collects a lot from it: purchases, passes, location and the apps on your phone. We score it 68/100, above Gmail at 62 and PayPal at 55, with privacy (50) as the clear low point.

How tap to pay protects your card

When you add an eligible card, Wallet creates a virtual card, "a digital version of your actual card, with a randomly generated number", which is what shops see when you tap. The app shows only its last four digits. Google says payment details are stored and transmitted encrypted.

Each payment needs a fresh check. Wallet accepts the phone's PIN, pattern or password and only Class 3 biometrics, the strongest grade on Android; weaker unlock methods such as Smart Unlock do not count. After a few minutes the check expires and the next payment asks again. Transit is the exception: you can switch off verification so you can tap through a ticket gate with a locked phone.

If something does go wrong, Google asks you to report unauthorised charges within 120 days of the transaction.

What Google does with your Wallet data

Google Play's data safety section is long. Wallet collects approximate location (precise location is optional), installed apps, app interactions, in-app searches, emails, files and documents, and personal and payment details. Device IDs and app interactions are listed for advertising or marketing as well as fraud prevention and analytics. Name, address, phone number, user IDs and payment information are shared with other companies, for running the service, fraud prevention and compliance; the label does not name the recipients.

The Google Payments Privacy Notice, updated in July 2026, goes further. Google may obtain consumer reports, as defined by US credit reporting law, and it builds fraud risk models from your payment history and shares risk scores with merchants and payment firms for their own fraud checks. By default, Google also tells participating merchants whether you have Google Pay set up, so they can offer it at checkout.

Google is gradually rolling out a "Your data in Wallet" page with four switches: personalising Wallet, using Wallet data to personalise other Google services such as Play and YouTube, saving Wallet History, and using Wallet data to personalise Google ads. Google's help page gives the example of shopping ads based on loyalty cards you have saved. If you would rather keep payments out of your ad profile, these are the settings to check.

Scams that target mobile wallets

The wallet itself is hard to break, so criminals target the people around it. In November 2024 ThreatFabric described a cash-out tactic it called "Ghost Tap". Fraudsters steal card details with phishing pages or banking malware, then get the one-time code the bank sends to approve adding the card to a wallet. Once the stolen card is in their own Google Pay or Apple Pay, they use a relay tool to pass it to accomplices, who tap it at shop terminals in other places. An earlier scheme, the NGate malware documented by ESET in August 2024, tricked victims into scanning their own bank card with their phone's NFC reader so it could be relayed.

The common thread is the code. Google says it never asks for passwords, card numbers or codes by email, text or phone, and never asks you to install an app for support.

How to use Google Wallet safely

1. Use a PIN or password of at least six digits as your screen lock, not a simple pattern, and turn on fingerprint unlock if your phone supports Class 3 biometrics.
2. Never read out or forward a code that your bank sends to add a card to a wallet, whoever asks.
3. Keep verification on for transit unless you really need to tap through gates with a locked phone.
4. In Wallet's data settings, turn off ad personalisation and, if you do not need it, Wallet History.
5. Turn off the setting that tells merchants whether you have Google Pay if you do not want them to know.
6. For a child under 13, use Google Wallet for kids with Family Link, which allows tap to pay in shops only and lets you see transactions.

How we scored it

Security (82) is Google Wallet's strongest factor: virtual card numbers, strong verification for each payment and no breach found. Privacy (50) is the weakest, because Wallet collects broadly, shares fraud scores and can feed Google's ads. The regulatory record (70) reflects no fine or standing order against Wallet: the CFPB withdrew its 2024 supervision order in 2025, and Google's large privacy settlements concerned other products. For paying friends rather than shops, see Cash App, where scams are the bigger risk.