To pay at points of sale, users hold their authenticated Android device to the point-of-sale system's NFC reader. Users can also remotely halt the service on a lost phone via Google's Find My Device service. The 'dynamic security code' is the cryptogram in an EMV-mode transaction, and the Dynamic Card Verification Value (dCVV) in a magnetic-stripe-data emulation-mode transaction. The service keeps customer payment information private from the retailer by replacing the customer's credit or debit card Funding Primary Account Number (FPAN) with a tokenized Device Primary Account Number (DPAN) and creates a 'dynamic security code generated for each transaction'. Google Pay uses the EMV Payment Tokenization Specification. The service has smart-authentication, allowing the system to detect when the device is considered secure (for instance if unlocked in the last five minutes) and challenge if necessary for unlock information. To pay at points of sale, users hold their authenticated device to the point of sale system. Users can add payment cards to the service by taking a photo of the card, or by entering the card information manually.

Google Pay requires that a screen lock be set on the phone or watch.

Instead, it generates a virtual account number representing the user's account information. When the user makes a payment to a merchant, Google Pay does not send the actual payment card number. The service lets Android devices wirelessly communicate with point of sale systems using a near field communication (NFC) antenna and host-based card emulation (HCE).

It is similar to contactless payments already used in many countries, with the addition of two-factor authentication. It replaces the credit or debit card chip and PIN or magnetic stripe transaction at point-of-sale terminals by allowing the user to upload these in Google Wallet.

Google Pay uses near-field communication (NFC) to transmit card information facilitating funds transfer to the retailer.

Google pay debit card