Evan Schuman's StorefrontBacktalk

A bigger question is whether Google has misjudged its security. That Wallet ID is effectively the key that unlocks as many payment cards as a customer has registered with Google. Suppose a retailer or processor is breached, and a thief steals that Wallet ID along with a collection of other payment-card numbers. What then?

Google refused to talk about specific security details, but we can walk through the process. If card numbers are scooped up in a breach, the usual course of action for a thief is to put the numbers on magstripe cards or use them online. That shouldn’t work with the Wallet ID.

Google knows it doesn’t issue magstripe cards, so it should reject any transactions that don’t look like they came from contactless cards. And it’s not clear whether Google Wallet users will even know what their Wallet IDs are—there’s no reason it shouldn’t be completely internal to Google—so cases where the Wallet ID number is used online should be rejected, too.

And—presuming Google has its security act together—any such attempt should flag Google that the Wallet ID has been stolen, which should in turn both flag a breach for a retailer somewhere (although no one will know for sure where) and trigger a notification to the user that his phone’s Wallet ID has been breached and that his real cards might be at risk. (Yes, Google will have to explain to those users that Google doesn’t know what retailer or processor was breached, or when, or how, just that there must have been a breach and it wasn’t Google’s fault. Welcome to the world of breaches.)

Of course, these days professional card thieves increasingly sort card numbers, so they know which ones are PIN debit (prized because they can be converted to cash directly at ATMs) and what banks issued them. Google Wallet IDs will probably be discarded by the professionals as not worth the effort, because figuring out how to load the number on a contactless card, or else mimic an NFC-enabled phone running Google Wallet, would require a lot of work just to add a few more card numbers to the stash.

Then again, the challenge of out-thinking Google might actually attract some hackers with security obsessions and too much time on their hands. If that happens, we may get definitive answers to how secure the new architecture is—even if Google doesn’t like it.