Google Pay security hole.

Posted 26th Apr 2022
Hello.
Much to my surprise Google pay made a payment straight through the lock screen I subsequently found out up to £45.00 will bypass the lock screen. It works in ASDA & and most of the local pubs. For years I've messed about with passwords what a waste of time. My phone a Samsung Galaxy runs Android 11 and was updated in April. If anyone knows how to enforce the lock screen I'd be glad to hear.
Community Updates
New Comment

Categories

23 Comments

sorted by
's avatar
  1. jameshothothot's avatar
    Tip: For added security, you can set up your phone so that it must be unlocked to complete an NFC transaction.
    To turn on this setting:

    Go to Settings Settings.
    Tap Connected devices and then Connection preferences and then NFC.
    Turn on Require device unlock for NFC.
    If you can't find this option, you may need to update your phone to the latest version of Android.

    support.google.com/pay…oid (edited)
  2. McShane's avatar
    Not a security hole, just user error.
  3. Toon_army's avatar
    You still have to press the button on the side so your screens on, you can't just put your phone on the machine and pay
  4. RoosterNo1's avatar
    Turn off NFC -sorted !
    Long press power button brings up Google pay, which reminds you to turn on NFC.
    Couple more presses, but you won't be pocket robbed !
  5. bozo007's avatar
    McShane27/04/2022 03:36

    Not a security hole, just user error.


    More like an uninformed user. I am surprised more people aren't aware that full unlocking is required only when going above the contactless limit; otherwise, only the screen needs to be on.
  6. MicroManaged's avatar
    RoosterNo127/04/2022 03:12

    Turn off NFC -sorted !Long press power button brings up Google pay, which …Turn off NFC -sorted !Long press power button brings up Google pay, which reminds you to turn on NFC.Couple more presses, but you won't be pocket robbed !


    You can't be pocket robbed as the screen has to be on.
  7. ray1066's avatar
    Author
    jameshothothot27/04/2022 08:47

    Hmmm. What phone do you have? Might be in a different menu setting. Also. …Hmmm. What phone do you have? Might be in a different menu setting. Also. Some people say you need to turn the phone screen on. Do you have a lock screen? Mine is finger print locked. Not sure if nfc works if you don't turn on with correct finger print?Also could do what I do and other suggested... Just turn NFC off. Only switch it on when you want it.Don't think you need a new phone.


    Samsung galaxy A70 android 11 update April 2022.
    Thanks for trying to help.
    RTFM & user error from others some real effort went in there.
    The go-to android guy at Currys, Three store & EE store didn't realize Google pay had this small payment hole.
    I'll try the NFC route but it could become tedious turning the feature on and off.
  8. deleted2686495's avatar
    ray106627/04/2022 10:48

    Samsung galaxy A70 android 11 update April 2022.Thanks for trying to …Samsung galaxy A70 android 11 update April 2022.Thanks for trying to help.RTFM & user error from others some real effort went in there.The go-to android guy at Currys, Three store & EE store didn't realize Google pay had this small payment hole.I'll try the NFC route but it could become tedious turning the feature on and off.


    Depends on your phone - a lot of them allow a button on the pull down menu/notifications thing.

    On the other hand, the Pixel phones don't have a quick/practical way to turn NFC on and off.
  9. aLV426's avatar
    I think this is a case of RTFM...
  10. bigwheels's avatar
    My Poco F2 Pro runs android 12, it lets me make some payments with the screen locked.
    Amount does not seem to be relevant, £50 ok, then next time £1.20 needs unlocked.
    I think I will follow jameshottotrot’s advice and set up screen unlock.
  11. bozo007's avatar
    bigwheels27/04/2022 07:33

    My Poco F2 Pro runs android 12, it lets me make some payments with the …My Poco F2 Pro runs android 12, it lets me make some payments with the screen locked.Amount does not seem to be relevant, £50 ok, then next time £1.20 needs unlocked.I think I will follow jameshottotrot’s advice and set up screen unlock.


    This is more because of recent security requirements where a PIN / phone unlock is required after a certain number / value of transactions.
  12. ray1066's avatar
    Author
    jameshothothot27/04/2022 00:15

    Tip: For added security, you can set up your phone so that it must be …Tip: For added security, you can set up your phone so that it must be unlocked to complete an NFC transaction.To turn on this setting:Go to Settings Settings.Tap Connected devices and then Connection preferences and then NFC.Turn on Require device unlock for NFC.If you can't find this option, you may need to update your phone to the latest version of Android.https://support.google.com/pay/answer/7644132?hl=en-GB&co=GENIE.Platform%3DAndroid


    So basically I'll have to replace my phone to make Google pay safe as that method is not available on my phone.
    Thank you.
  13. jameshothothot's avatar
    ray106627/04/2022 08:40

    So basically I'll have to replace my phone to make Google pay safe as that …So basically I'll have to replace my phone to make Google pay safe as that method is not available on my phone. Thank you.


    Hmmm. What phone do you have? Might be in a different menu setting.

    Also. Some people say you need to turn the phone screen on. Do you have a lock screen? Mine is finger print locked. Not sure if nfc works if you don't turn on with correct finger print?

    Also could do what I do and other suggested... Just turn NFC off. Only switch it on when you want it.

    Don't think you need a new phone. (edited)
  14. Adster's avatar
    jameshothothot27/04/2022 08:47

    Hmmm. What phone do you have? Might be in a different menu setting. Also. …Hmmm. What phone do you have? Might be in a different menu setting. Also. Some people say you need to turn the phone screen on. Do you have a lock screen? Mine is finger print locked. Not sure if nfc works if you don't turn on with correct finger print?Also could do what I do and other suggested... Just turn NFC off. Only switch it on when you want it.Don't think you need a new phone.


    I can't find any option to do that on a Galaxy S20. The only options are on/off and to select which app is the default payment service
  15. Adster's avatar
    ray106627/04/2022 10:48

    I'll try the NFC route but it could become tedious turning the feature on …I'll try the NFC route but it could become tedious turning the feature on and off.


    Thats what I thought, the whole point of using your phone is convenience and its easier to just use a card than turn NFC on and off every time I want to use it.

    I've seen a few posts elsewhere where people have used the tasker app to automatically enable/disable NFC when the phone is unlocked/locked. My experience with automation apps is that they aren't 100% reliable though
  16. TheGalaxy's avatar
    The behavior is no different to contactless cards in that regard, which also require no authentication

    If you want a way to automate enabling NFC only when device is unlocked then I could recommend the Tasker app (I think similar free alternatives exist, but I'm not familiar)

    You can set actions that occur for specific triggers.

    e.g
    When device is unlocked -> enable NFC
    When device is locked -> disable NFC

    That should achieve what you want (edited)
  17. RoosterNo1's avatar
    deleted945327/04/2022 08:30

    You can't be pocket robbed as the screen has to be on.


    A lot of folk just dump the phone when they've done with it... A friend of mine has her screen off time set to 15 minutes ! She often walks away from it blaring away like a searchlight
    "Don't want to miss anything" is the order of the day.... Have you tried to drive in a busy town with these lemmings staring at their hands ? Would be dead easy to hoover up a fortune !
  18. FrampyStinkwonkel's avatar
    ray106627/04/2022 08:40

    So basically I'll have to replace my phone to make Google pay safe as that …So basically I'll have to replace my phone to make Google pay safe as that method is not available on my phone. Thank you.


    No.
  19. ray1066's avatar
    Author
    RoosterNo127/04/2022 11:22

    A lot of folk just dump the phone when they've done with it... A friend of …A lot of folk just dump the phone when they've done with it... A friend of mine has her screen off time set to 15 minutes ! She often walks away from it blaring away like a searchlight "Don't want to miss anything" is the order of the day.... Have you tried to drive in a busy town with these lemmings staring at their hands ? Would be dead easy to hoover up a fortune !


    Exactly
  20. ray1066's avatar
    Author
    Thanks.
    I used to do a lot of code writing in working life. Tasker sounds like a great idea that I never realised existed.
  21. jameshothothot's avatar
    ray106627/04/2022 10:48

    Samsung galaxy A70 android 11 update April 2022.Thanks for trying to …Samsung galaxy A70 android 11 update April 2022.Thanks for trying to help.RTFM & user error from others some real effort went in there.The go-to android guy at Currys, Three store & EE store didn't realize Google pay had this small payment hole.I'll try the NFC route but it could become tedious turning the feature on and off.


    Is it definitely Google pay or samsung pay?

    This might help

    makeuseof.com/dis…ay/
  22. bozo007's avatar
    - are you using Google Pay or Samsung Pay? The latter doesn't require the screen to be on, but Google Pay does. That is how it is on my S22.
's avatar