Today my debit card has been charged with a series of unauthorized transactions made in Brazil (and I am located in Europe). My bank quickly froze the card, but the first transaction (~USD200) they are refusing to cancel and refund because, as they say:
1) it was made via Google Pay
2) Google Pay is secure and cannot be hacked because it requires physical device authorization.
The issue I'm curious about - what could be the path the hacker used to make the payment?
This is not a issue of getting hold of the debit card number number/CVV, which is of course possible. The transaction was made via Google Pay. To be authorized, it would require either physical access to my mobile (obviously, I was not present in Sao Paolo today). Or this would require a physical login into my browser (Chrome). Which would require authorizing login from a new device, from new location etc. (and I did not get any warnings about that in my email).
Needless to say, I was not involved in fraudulent transaction at all: no SMS codes, no calls, no requests to authorize anything etc.
I am genuinely puzzled how could such an authorized Google Pay transaction happen and how can anyone protect themselves against attacks like this.
1) it was made via Google Pay 2) Google Pay is secure and cannot be hacked because it requires physical device authorization.
The issue I'm curious about - what could be the path the hacker used to make the payment?
This is not a issue of getting hold of the debit card number number/CVV, which is of course possible. The transaction was made via Google Pay. To be authorized, it would require either physical access to my mobile (obviously, I was not present in Sao Paolo today). Or this would require a physical login into my browser (Chrome). Which would require authorizing login from a new device, from new location etc. (and I did not get any warnings about that in my email).
Needless to say, I was not involved in fraudulent transaction at all: no SMS codes, no calls, no requests to authorize anything etc.
I am genuinely puzzled how could such an authorized Google Pay transaction happen and how can anyone protect themselves against attacks like this.