Evan Schuman's StorefrontBacktalk

How would that work? Would each card number get its own PIN (the way physical cards do)? Would Google Wallet have to keep track of how long each PIN has before it times out? It’s beginning to sound like Google will have to negotiate with multiple issuing banks, multiple card brands and multiple mobile carriers to make this work—and it’s already having trouble getting onebank to get with the program.

Where does all this leave retail chains who have signed up for Google Wallet—or, for that matter, any retailer who can accept contactless cards (since Google Wallet is supposed to behave like plastic for them, as well)? That’s unclear, too.

Consider: When a customer walks up to a POS and waves a Google Wallet phone, it may not be necessary for the customer to key in a PIN at the POS, even if it’s for a large purchase. That phone could have been stolen and the PIN cracked. Or it might have just been stolen minutes before, with the thief acting quickly to make a big fraudulent purchase before the PIN timeout expires. Does the retailer have card-fraud liability, because there was no physical authentication at the POS? Even Google doesn’t seem to be sure.

If retailers arein the clear, who’s liable? Is it the issuing bank that wouldn’t allow the PIN to be stored in the Secure Element? Is it the card processor that agreed to accept what the phone says instead of a number punched into a physical PIN pad? Is it Google, which decided to let PINs last for up to 30 minutes? Or will customers finally fall off the zero-liability turnip truck and have to pay for their own lax security habits?

That last one seems unlikely. According to a Google spokesperson, “Google is responsible for fraudulent losses not covered by Money Network [the processor], the consumer’s credit card company or the consumer’s financial institution that were a result of a security flaw in the application. The consumer’s liability is defined in the terms and conditions of the underlying payment account.”

That still doesn’t confirm that retailers are off the hook; just because a card brand or issuing bank nominally covers a fraud loss, that doesn’t mean card-brand fines won’t happen to siphon funds out of a retailer’s merchant account.

The good news in all this confusion is that the growing pains of Google Wallet will probably help all of Google’s competitors avoid the same problems. The less appealing news: Mobile payments clearly have a lot of growing to do.