Stripe-android: Google Pay Postal Code & CVC

[kevinskrei]

Hello,

According to the Stripe/Google Pay docs, we are supposed to do this after onActivityResult:

val paymentData = PaymentData.getFromIntent(intent!!) //Contains billing address via `paymentData.cardInfo.billingAddress`
val token = paymentData?.paymentMethodToken?.token //Does not contain address
val stripeToken = Token.fromString(token)

And then we use the stripeToken to pass to our servers for payment processing. My company is concerned about the number of denials because we are not capturing the billing zip or cvc code. I am setting the billing address required

CardRequirements.newBuilder()
                                .setBillingAddressRequired(true)
                                .setBillingAddressFormat(WalletConstants.BILLING_ADDRESS_FORMAT_MIN)

and can see that the zip is coming from google via the paymentData.cardInfo.billingAddress successfully. However, I'm only passing in the token to Token.fromString(paymentData?.paymentMethodToken?.token) to which all of the address fields are null and therefore Stripe's JSON parsing does not have this information.

Is there a way to get this information into the Google Pay token before Stripe parses the JSON token? Otherwise, I'll have to build the "card" myself instead of using the token ID? I'm assuming there is some handshake between Stripe/Google to create this token so it should be receiving the billing address but ignoring it?

[mshafrir-stripe]

@kevinskrei Unfortunately I'm not familiar enough with Google Pay's API to be able to diagnose the issue, but sounds like your idea could work.

[drewmahrt]

Wouldn't that negate the security benefits provided by Google Pay? By creating our own Card, we're handling the payment information manually. This sounds like something that needs to be resolved between Stripe and Google during the token creation process.

[kevinskrei]

This could pretty easily be handled in the SDK. The SDK could add a method to take in the the Google Pay object and parse it to the Stripe Token gathering all of the data provided by Google. I would consider this a must if stripe is supposed to support Google Pay.

[mshafrir-stripe]

@kevinskrei so you're seeing actual declines due to missing billing address? I can investigate on my end whether Google is indeed transmitting us the billing address.

[mshafrir-stripe]

@kevinskrei please reopen if you still need assistance

[shokimble]

Having the same problem. Declines from issuer because stripe is not capturing the Google pay billing address and sending to issuer.

Google pay returns the billing address but stripe returns a token that does not have the billing information attached to it so the transaction is declined or worse, authorised without a valid billing address and open to fraud.

Unfortunately we have had chargebacks coming from Google pay transactions that probably could have been avoided

Is there a workaround (can't see one if a charge can't attach a billing address) or a way of having stripe attach the billing address properly to the token?

[mshafrir-stripe]

Thanks for filing. We're aware of this issue and investigating it internally. It's due to a backend issue, not the Stripe Android SDK or Google Pay SDK. I'll update here once we have more updates.

[shokimble]

@mshafrir good to hear it's being worked on. Are you able to update us here when it's resolved or is there somewhere else we can subscribe for updates?

Edit: probably should have done some active reading as you said you'd update here.

[shokimble]

@mshafrir any updates on this? Is it a google pay issue or stripe? When will it be resolved?

I have done some analysis on our payments using Google Pay and I am pretty confident that there appears to be a pattern of fraudulent attacks on us via google pay. One example is a single "customer" trying 10 more cards on our app within a period of 24 hours all through Google Pay. This takes some effort and much easier to do in app so clearly they're banking on this flaw in Google Pay.

Some get picked up by Stripe radar, some by our processes, a good deal of our chargebacks are coming from this source and some just never getting through because the bank have already picked it up as fraud.

It seems to me that the attackers know there's a vulnerability in Google Pay but whether they know to target stripe based apps or not is another question so this may be a Google Pay wide issue.

Either way this seems pretty huge and potentially embarrassing for Google/Stripe. We've completely removed Google Pay with stripe from our app as we don't particularly want to be held liable for chargebacks caused by one of your two companies.

Do you have anyone there who can address and answer this issue ASAP? Feel free to have them reach out to me personally.

I'm afraid if neither company wants to address this issue with their customers then I will need to go the old fashioned route of making a public racket. Likely through the tech press who would have a field day on two big companies exposing small businesses to such a risk.

[mshafrir-stripe]

@shokimble I understand that this issue continues to impact you, so thanks for your patience and providing more details. I have escalated this issue internally as we continuing our investigation. I’ll respond back to this issue once I have any details that I can share. Is there a way to directly contact you?

[mshafrir-stripe]

@shokimble if you create a PaymentMethod.BillingDetails object using from Google Pay's CardInfo#getBillingAddress() and then create a new Payment Method with that + the token, that may ensure that the billing address is passed along.

PaymentMethod.BillingDetails billingDetails = // populate from google pay
PaymentMethodCreateParams paymentMethodCreateParams = PaymentMethodCreateParams.create(
   PaymentMethodCreateParams.Card.create(googlePayToken),
   billingDetails
);

Then, create a Payment Intent using the Payment Method as described in https://stripe.com/docs/payments/payment-intents/android.

[shokimble]

Thanks for the work around. It should help others experiencing this issue. As I have said we have removed the Google Pay functionality entirely (pending the all clear from your end).

My major concern right now is whether there is some sort of vulnerability with Google Pay and/or the Stripe integration. I understand you may not be able to give specific updates, however, I just wanted to raise the possibility given some of the activity I have seen that seems to be specifically targeting Google Pay functionality.

[mshafrir-stripe]

I updated our Google Pay documentation and example app with instructions on how to create a new PaymentMethod object using the Google Pay token + billing details.

If you're still having issues after making this change, please let me know.

[mshafrir-stripe]

FYI I just published 10.2.0, which adds the method PaymentMethodCreateParams#createFromGooglePay(JSONObject) to facilitate creating a PaymentMethodCreateParams from a Google Pay PaymentData JSONObject. This method ensures that any available billing details are included in the PaymentMethod. I will also update our Google Pay integration docs.

[ened]

@mshafrir createFromGooglePay(JSONObject) will not work when the PaymentData is coming back via an intent; in that case toJson will return null, as stated in the documentation:

Note that this will be null if PaymentDataRequest was not constructed using fromJson(String).

[mshafrir-stripe]

@ened Correct. The Builder approach is deprecated - https://developers.google.com/android/reference/com/google/android/gms/wallet/PaymentDataRequest.Builder

[ened]

Do you know of a replacement flow? Intent in JSON out won’t work in the future.

[mshafrir-stripe]

@ened inspect the PaymentData object. It should have an embedded Token JSON string. You can parse the string and obtain the Token Id.

See https://github.com/stripe/stripe-android/blob/ec1d8ea73b95fb27022dc8b6a1f7d1530261ffe3/stripe/src/main/java/com/stripe/android/model/GooglePayResult.kt

Also see https://stripe.com/docs/api/tokens/object for an example of a Token object's JSON representation.

[ened]

@mshafrir-stripe I meant say that when a PaymendData object comes from the intent, then it's .toJson method won't work, as documented by Google:

Note that this will be null if PaymentDataRequest was not constructed using fromJson(String).

And from google side any but the toJson fromJson methods are deprecated, which means this code:

        final PaymentData paymentData = PaymentData.getFromIntent(data);
        if (paymentData == null) {
            return;
        }

        // You can get some data on the user's card, such as the brand and last 4 digits
        final CardInfo info = paymentData.getCardInfo();
        // You can also pull the user address from the PaymentData object.
        final UserAddress address = paymentData.getShippingAddress();
        final PaymentMethodToken paymentMethodToken =
                paymentData.getPaymentMethodToken();
        // This is the raw string version of your Stripe token.
        final String rawToken = paymentMethodToken != null ?
                paymentMethodToken.getToken() : null;

will work but create "deprecation" warnings. I was simply wondering if you know of a better or alternative way in order to avoid the deprecation warnings.

[mshafrir-stripe]

@ened the reason that it is marked as deprecated is because the Builder pattern for creating a PaymentRequest is deprecated