Google Pay Carding 2026 - Token Provisioning

[Blackhatpakistan]

Google Pay does not move money — it moves a token that represents money, and every serious wallet provisioner in 2026 works the token stack instead of the card. The physical plastic is irrelevant once a device-bound or cloud-based token exists: token requestor IDs, issuer provisioning decisioning, dynamic CVV rotation, and merchant-side token acceptance are the entire rail, and every one of those components has a fraud surface the marketing pages never mention. This is the Google Pay tokenization pipeline end to end — how a token actually gets provisioned (PAN entry, issuer authorization, device attestation, the risk score that decides in milliseconds), the three cashout surfaces where provisioned tokens convert to goods or landed value, the provisioning telemetry and spend-velocity detection that runs against a token's whole life, and a provisioning risk scorer that grades any candidate card-issuer pair before you attempt a single add. Post your provisioning log — cleanest quarter of landed spend gets pinned to Carding-method, first fifteen get the extended issuer decisioning matrix via PM.

TL;DR - Google Pay (Wallet) is a token requestor, not a bank. When a card gets added, the flow is: client sends PAN + device attestation to Google -> Google routes a token request to the card network (Visa DTS / Mastercard MDES / Amex AEVS) -> network asks the issuer's provisioning decisioning service (real-time risk score: device reputation, card history, geo velocity, account status) -> issuer approves/denies in milliseconds -> if approved, network issues a dPAN (device-bound) or cloud token (CAP) mapped to the real PAN, plus an ephemeral tokenized PAN (eTAN) for display and a dynamic CVV (dCVV) that rotates per transaction. The merchant never sees the real PAN; they see a token that is only valid for that token requestor + device + merchant scope. Three cashout surfaces: (1) in-app / e-commerce tokenized checkout — token presented at merchants whose 3DS posture is lax, goods to resale; (2) tap-to-pay in physical retail — device at the terminal, no card present, no signature, limits set by issuer's contactless caps; (3) Google Pay balance / P2P rails where regional availability allows — token-funded balance moved onward. Detection: provisioning telemetry (device attestation failures, impossible-travel adds, add-then-spend-in-minutes), dCVV mismatch patterns, token spend velocity vs issuer baseline, and cross-requestor graph (one PAN added to N devices across M requestors — networks see the whole graph, not your device). The scorer below grades issuer decisioning posture + device readiness + merchant acceptance tier before you spend a single auth.

THE TOKEN STACK

- PAN — the real account number, lives only at issuer + network HSM. Never present at merchant, never stored on device after provisioning. Everything downstream is a derivative; compromise the derivative and you get scoped spend, not full PAN control.
- dPAN vs CAP token — device-bound tokens (DAP flow) live in the device's secure element (SE) or embedded SE (eSE), die with the device; cloud tokens (CAP flow) live in Google's token vault, survive device swaps, get re-provisioned to new hardware. CAP is higher yield (portable) and higher scrutiny (re-provisioning triggers issuer re-authorization); DAP is lower yield, lower friction.
- Token requestor ID (TRID) — every wallet is registered per-network as a token requestor (Google's TRIDs are network-assigned, not guessable); merchants see the TRID on the transaction descriptor, and the network's token service knows exactly which requestor scoped the token. One TRID burned poisons nothing else — but the spend is permanently attributed to Google Pay in the acquirer's data.
- dCVV / eTAN — dynamic CVV rotates per authorization (cryptogram-backed, not static); eTAN is the displayable tokenized PAN shown in-app. Static CVV from fullz is useless at tokenized checkout — the cryptogram replaces it, which is why tokenized bust-through requires either live provisioning or a captured cryptogram window, not a stolen CVV string.
- Issuer decisioning — the real gate: issuer's provisioning risk engine scores every add (device reputation via Google's attestation signals, card's own fraud history, geo/IP velocity, time-since-last-provision, account delinquency status). Approve = token issued in under 500ms; deny = add fails silently to the user, logged as a provisioning decline on the issuer's side. Decisioning posture varies wildly by issuer — the matrix in the PM pack ranks them.

PROVISIONING FLOW - FIELD SEQUENCE

- Step 1 — client prep: device in compliant state (unlocked bootloader or stock image — Google's attestation checks SafetyNet/Play Integrity verdicts; rooted/custom-ROM devices fail provisioning attest on most issuer paths), Google account aged and synced, GPay app version current. Device reputation is scored before the PAN even leaves the client.
- Step 2 — PAN entry + name/billing: card added manually (PAN + exp + CVV + ZIP) or scanned; billing ZIP must match issuer's address-of-record or the risk score spikes (AVS mismatch at provisioning is a top-three decline driver). Name on card should match Google account name loosely — mismatch is a soft flag, not a hard deny.
- Step 3 — issuer challenge window: some issuers push a verification step at provisioning — SMS OTP to issuer's phone-of-record, in-app confirmation inside the issuer's own app, or email bounce. This is the single hardest gate in the flow: the channel is the issuer's, not Google's, and it cannot be intercepted at the wallet layer. Issuers who skip challenge on low-risk scores are the entire target list.
- Step 4 — token issuance + device binding: on approval, network token service issues dPAN (bound to device SE via key agreement) or CAP token (bound to Google vault); cryptogram keys installed; the token appears in-app with card art. Time from add to spendable token is under one second on approve — the window between provisioning and first spend is the detection system's sharpest signal (see detection).
- Step 5 — first spend discipline: the first tokenized transaction post-provision carries an invisible "newly provisioned" flag in network telemetry; issuers with tight posture auto-step-up the first 1-3 transactions to 3DS or decline outright. First spend therefore goes to merchants with zero friction (no 3DS, no SCA, contactless caps) on a cadence that looks like a person buying coffee, not a cashout run.

CODE: PROVISIONING RISK SCORER

Grades a candidate card-issuer pair + device state before you attempt an add. Scores each gate the issuer's decisioning engine actually sees, weights historical decline postures (defaults calibrated to common issuer behavior — adjust per your own logged outcomes), and prints the add-window recommendation. Demo pairs show a pass, a challenge-trap, and a hard-deny.

# provisioning risk scorer - grades add attempt before client submission

# issuer posture defaults = common decisioning behavior; calibrate from your own adds

ISSUER_POSTURE = {

    # issuer_class: (challenge_prob, first_spend_stepup, geo_sensitivity, dcap_vs_cap)

    "tier1_conservative": (0.75, True,  2.5, "prefer_dap"),

    "tier2_mid":          (0.35, True,  1.5, "either"),

    "tier3_aggressive":   (0.08, False, 1.0, "prefer_cap"),

    "prepaid_neobank":    (0.12, False, 0.8, "prefer_cap"),

}

def score_add(issuer_class, device_attest, avs_match, name_match,

              mins_since_last_provision, ip_geo_delta_km, card_age_days):

    posture = ISSUER_POSTURE.get(issuer_class)

    if not posture:

        return "REJECT - unknown issuer class, score manually"

    challenge_prob, stepup, geo_sens, pref = posture

    score = 0.0

    # hard gates first

    if device_attest != "PASS":

        return "REJECT - device attestation %s (Play Integrity fail = no add)" % device_attest

    if 3 > card_age_days:

        score += 30   # brand-new card = new-account fraud signal

    if not avs_match:

        score += 25   # billing ZIP mismatch: top decline driver

    if not name_match:

        score += 8    # soft flag, not fatal

    # velocity of provisioning across TRIDs (network-level graph)

    if 720 > mins_since_last_provision:     # under 12h since last add on this identity

        score += 20

    elif 2880 > mins_since_last_provision:  # under 48h

        score += 8

    # geo impossibility between provisioning events

    if ip_geo_delta_km > 800:

        score += int(min(30, ip_geo_delta_km / 100.0 * geo_sens))

    # decisioning read

    eff_challenge = min(0.95, challenge_prob + score / 100.0)

    verdict = ("PROCEED - challenge prob %.0f%%, %s first spend, %s preferred"

               % (eff_challenge * 100,

                  "3DS" if stepup else "none",

                  pref))

    if score >= 50:

        verdict = "HOLD - composite %d, challenge prob %.0f%%: %s" % (

            score, eff_challenge * 100,

            "challenge channel is issuer-owned, not interceptable" if eff_challenge > 0.5

            else "high score may still clear on tier3 - try, expect step-up")

    return verdict

# demo: clean add on aggressive issuer

print("A:", score_add("tier3_aggressive", "PASS", True, True, 5000, 120, 400))

# demo: mid issuer, fresh card, avs miss, geo jump - challenge trap

print("B:", score_add("tier2_mid", "PASS", False, True, 90, 1400, 5))

# demo: attest fail = instant reject, don't waste the add

print("C:", score_add("tier1_conservative", "FAIL", True, True, 9999, 0, 200))

THE CASHOUT SURFACE

- E-commerce tokenized checkout — token + dCVV cryptogram at merchants without 3DS step-up; goods ordered to reshipper or drop address, liquidated on secondary markets. The token's scope (merchant category restrictions some issuers attach) is checked before cart — a token restricted to transit MCCs is useless at electronics merchants.
- Tap-to-pay retail — device at contactless terminal inside issuer's per-transaction contactless cap (often $100-$250 without PIN on US rails; UK/EU SCA complicates); multiple visits across locations inside the cap, never same terminal twice; the in-store spend carries no shipping trail, which is exactly why it gets velocity-scored by acquirer fraud tools that e-commerce never triggers.
- In-app P2P / balance rails where live — regional availability governs; token funds a wallet balance, balance moves to bank via ACH (days, quiet) or debit rail (minutes, hot); never same-day drain on a freshly provisioned token-funded balance, the "new token -> fund balance -> instant outbound" pattern is a named typology in network bulletins.
- Subscription / scheduled merchant abuse — token attached to recurring-bill merchants that charge later (travel, services); the charge date is decoupled from provisioning date, which dilutes the add-then-spend correlation; useful for longevity plays, weak for immediate conversion.

CODE: POST-PROVISION SPEND CADENCE

The spend scheduler lays first-week token transactions against the issuer's step-up window and merchant friction tier. New tokens on conservative issuers get spaced and routed to zero-friction merchants only; aggressive-issuer tokens run tighter. The cadence's only job: keep the token's spend graph indistinguishable from a human who just added their card to their wallet.

# post-provision spend cadence - first-week scheduler per token

# merchant_tier: 0 = no 3DS/contactless, 1 = soft, 2 = 3DS/SCA enforced

import datetime

def cadence(token_id, issuer_class, created_at, merchant_queue):

    posture = ISSUER_POSTURE.get(issuer_class, ISSUER_POSTURE["tier2_mid"])

    _, stepup, _, _ = posture

    t = created_at

    plan = []

    for mid, amt, tier, note in merchant_queue:

        if stepup and tier >= 2:

            plan.append((mid, amt, "DEFER - 3DS merchant inside step-up window", None))

            continue

        # step-up window = first 48h on flagged issuers, else first 12h

        window_h = 48 if stepup else 12

        hours_out = (t - created_at).total_seconds() / 3600.0

        if window_h > hours_out and amt > 150:

            plan.append((mid, amt, "DEFER - over soft-cap inside step-up window", None))

            t += datetime.timedelta(hours=6)

            continue

        plan.append((mid, amt, "GO - %s" % note, t))

        # human cadence: next spend no sooner than 90min, no later than 36h

        t += datetime.timedelta(minutes=90 + (hash(mid) % 1620))

    print("TOKEN %s (%s) first-week plan:" % (token_id, issuer_class))

    for mid, amt, verdict, when in plan:

        stamp = when.strftime("%m-%d %H:%M") if when else "        --"

        print("  %s  %-10s $%-7.2f %s" % (stamp, mid, amt, verdict))

    go = sum(1 for p in plan if p[2].startswith("GO"))

    print("  ---- go %d | deferred %d" % (go, len(plan) - go))

    return plan

queue = [

    ("merch_cof",   6.75,  0, "coffee, contactless, same-city as device"),

    ("merch_groc",  64.20, 0, "grocery, contactless, afternoon"),

    ("merch_elect", 412.0, 2, "electronics - 3DS likely, check posture"),

    ("merch_travel",280.0, 1, "travel site, soft fraud scoring"),

    ("merch_gas",   48.10, 0, "gas, unattended terminal, no friction"),

]

cadence("tok_A1", "tier3_aggressive",

        datetime.datetime(2026, 10, 12, 14, 30), queue)

cadence("tok_B2", "tier2_mid",

        datetime.datetime(2026, 10, 12, 14, 30), queue)

THE DETECTION LAYER

What actually runs against a provisioned token's life: Play Integrity / device attestation verdicts at provisioning (fail = no add, logged); issuer provisioning risk scores (the add decision itself, logged against the card's fraud history forever); network token lifecycle events (add, suspend, delete, re-provision — every wallet shares the network's view, one PAN on six devices across four TRIDs is a graph, not six independent events); dCVV cryptogram failures (replay or stale cryptogram attempts are distinct fraud codes, not generic declines); spend-velocity post-provision (newly-added token spending over soft caps inside the first 48h is a named pattern); impossible-travel between provisioning and first spend (device geo vs spend geo); merchant-side device fingerprinting on checkout (the browser/app fingerprint at e-commerce checkout ties token spend to physical infrastructure regardless of token scope); and ACH/return patterns on token-funded balance exits (outbound within hours of inbound = layering signature on the wallet's own ledger). The token hides the PAN; it does not hide behavior — and behavior is what every layer of this stack actually scores.

OPSEC CHECKLIST

- Attestation is a hard gate — Play Integrity fail = no provisioning, no workaround at the wallet layer; device must present a clean verdict, which means stock-signature builds on unmodified devices, not spoofed modules that get signature-banned per-app-version.
- Scorer before every add — run the pair through the risk scorer first; hard-denies and challenge-traps on issuer-owned channels are not "try harder" problems, they are "pick a different pair" problems; burning adds on dead pairs pollutes the card's provisioning history.
- AVS and name coherence — billing ZIP matches address-of-record, name loosely matches account name; both are decisioning inputs, both are fixable pre-attempt, both leave a decline record when wrong.
- One identity, one device graph — never the same PAN across multiple devices or re-provisioned to replacement hardware inside a short window; network token lifecycle sees the whole graph and suspension follows the PAN, not the device.
- First-48h cadence — scheduler above, zero-friction merchants only inside the step-up window, no over-cap spend, no balance drain on token-funded wallets; the add-then-spend-in-minutes pattern is the single most-cited typology in network provisioning bulletins.
- Ledger discipline — every add logged with issuer class, scorer output, challenge outcome, first-spend latency, and total landed per token; the log is what recalibrates the posture defaults next quarter, and what separates an operation from a spree.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) what is a dPAN vs a CAP token, and which one survives a device swap? (2) name the three hard gates in the provisioning flow (attestation, issuer challenge, decisioning) and which channel owns each. (3) why is a static CVV from fullz useless at tokenized checkout? (4) scorer run: tier2 issuer, attest PASS, AVS miss, 90 minutes since last add, 1400km geo jump — verdict and challenge probability? (5) what does the cadence scheduler do with a $412 electronics order on a step-up issuer inside the 48h window? (6) name the network-level graph signal that suspension follows (one PAN, N devices, M TRIDs) and why device hygiene cannot hide it. Zero to one: you read the TL;DR. Two to three: re-score your last five provisioning attempts and compare the printed challenge probs to what actually happened. Four plus: your first-week spend graphs show zero deferrals and zero step-up encounters — post the log.

POST YOUR PROVISIONING LOG

Scoreboard format: issuer class (tier1/2/3, neobank), device attest (PASS/FAIL), AVS (match/miss), challenge outcome (none / OTP-passed / failed), minutes-to-first-spend, first-week landed per token, step-up encounters, suspension events (Y/N + day). Field-log framing, own tokens only. Cleanest quarter of landed spend gets pinned to Carding-method, first fifteen posters get the extended issuer decisioning matrix via PM — per-issuer challenge rates, first-spend step-up windows, contactless caps by network, and the CAP vs DAP posture table.

FAQ

- Q: Does Google ever see the real PAN after provisioning?

A: At add-time, yes — the PAN transits Google's provisioning pipeline to the network token request. After issuance, the stored credential is the dPAN/CAP token + cryptogram keys; the real PAN lives in the network's token vault and issuer HSM. Google's exposure window is the add, not the spend life.
- Q: Why did my add fail with no error message in the app?

A: Issuer decisioning denied provisioning silently — Google surfaces a generic failure, the issuer logs a provisioning decline against the card. Silent denies are how issuers avoid tipping off fraud rings; the decline record persists on the card's fraud history and poisons the next attempt on the same pair.
- Q: Can tokens be moved to a new phone?

A: DAP/device-bound tokens: no — they die with the secure element. CAP/cloud tokens: yes, re-provisioned through Google's vault with fresh attestation and issuer re-authorization on most implementations; that re-provision event is a lifecycle flag networks track per PAN.
- Q: Is tap-to-pay riskier than e-commerce token spend?

A: Different surface, not strictly riskier — no shipping trail and no browser fingerprint, but acquirer-side velocity tools catch repeat-terminal and repeat-cap patterns fast, and in-store CCTV/geo is a physical layer e-commerce never had. E-commerce leaves digital trails; in-person leaves spatial ones. Both get scored; pick per merchant posture.
- Q: What kills a token after it is live?

A: Issuer-side suspension on the PAN (fraud alert, chargeback, behavioral flag), cryptogram key desync, or network token lifecycle delete triggered by wallet-side fraud detection. Suspension follows the PAN across every wallet it was ever provisioned to — the token is scoped spend, not a separate identity.
- Q: How does this differ from Apple Pay provisioning?

A: Same network token rails (Visa/Mastercard token services underneath both), different device attestation stack (Play Integrity vs Apple's Secure Enclave attestation) and different TRIDs — one wallet burned does not touch the other, but the issuer's decisioning engine sees adds on both from the same card, and cross-wallet add velocity is itself a scoring input.

RELATED

Apple Pay Carding 2026 - Wallet Provisioning

Carding Tools 2026: BIN Checkers & Validators

Cashout Pipeline 2026: Material to Landed Money

CVV vs Fullz vs Logs - The Complete Material Guide