Google Wallet: what it is, features and how it works

What is Google Wallet?

Google Wallet is a mobile app and platform for storing and using digital versions of payment cards, transit passes, boarding passes, student IDs, car keys and loyalty cards. Launched in 2011 as Google Wallet, the service went through several rebrandings until Google brought back the Wallet name in 2022, combining the functionality of Google Pay and the original Wallet.

The platform is available on Android and Wear OS devices, as well as through a web interface. In 2024, Google expanded support to iOS through Google apps. The philosophy behind Wallet is replacing the physical wallet with a digital counterpart — the user loads cards and documents into the app and uses them by tapping the phone to an NFC terminal.

Key features for the user

A user can add up to 20 payment cards and an unlimited number of transit cards and event tickets. A separate token is created for each card, tied to the device. When paying, the terminal receives not the real card number but a one-time digital code. If the phone is lost, all tokens are remotely invalidated through the Find My Device service.

In addition to payments, Wallet supports digital car keys for BMW, Hyundai, Volvo and other brands. The user unlocks and starts the car by tapping the phone to the door handle. In 2025, Google announced support for digital IDs in select US states.

Geography and reach

As of early 2026, Google Wallet is available in 90 countries worldwide. Contactless payment support works in 80 countries, transit tickets — in 35, digital IDs — in 4. The largest markets are the USA, India, Japan, the UK, Germany and Brazil. The service has been unavailable in Russia since 2022.

How Google Wallet works: tokenization and NFC

Technically, Google Wallet uses two key mechanisms: tokenization of payment data and the NFC protocol for transmitting the token to the terminal. Tokenization ensures that the real PAN (Primary Account Number) of the bank card never leaves the device. Instead, the payment system issues a Device Account Number — a virtual number tied to the specific phone.

When the user taps the phone to the terminal, the NFC controller (usually built into the Qualcomm or MediaTek chipset) creates a secure channel with the payment terminal. Through this channel, a cryptogram is transmitted — a dynamic code generated based on the token, time and a one-time transaction number. The merchant sees only the cryptogram, not the card data.

The role of Trusted Execution Environment

TEE (Trusted Execution Environment) is an isolated area inside the processor that runs in parallel with the main Android OS. Even if the OS itself is compromised, data inside the TEE remains protected. Google Wallet stores tokens exclusively in the TEE. Transaction signing operations are performed inside this isolated environment — neither the Wallet app nor third-party processes have direct access to them.

For additional protection, Hardware Attestation is used — a mechanism where the phone's chip proves to Google's servers that the device is not rooted, the bootloader is not unlocked, and the TEE has not been modified. If the check fails, payment functions are blocked.

The card addition process

Adding a new payment card to Google Wallet involves several verification steps. After manually entering the card number or scanning it through the camera, the app sends the data to the Google payment gateway. The issuing bank receives a tokenization request through the Visa Token Service (VTS) or Mastercard Digital Enablement Service (MDES). The bank checks the CVV and 3DS code, after which it issues a Device Account Number. This number is written to the phone's TEE. The entire process takes 30–60 seconds.

Key features of Google Wallet

Google Wallet has outgrown the role of a simple payment app and has evolved into an ecosystem of digital documents. Below are the main categories of items that can be stored in the wallet.

• Payment cards — credit and debit cards from Visa, Mastercard, American Express, Mir (until 2022), UnionPay, RuPay. Added via camera or manual entry.
• Transit cards — passes for metro, buses and trains in 35 countries. In some cities (London, New York, Tokyo), top-up happens automatically.
• Boarding passes and tickets — airlines Lufthansa, KLM, Air France, United, Delta send passes directly to Wallet. Movie theaters and concert venues — barcode tickets.
• Loyalty programs — store, cafe and airline cards. The app displays accumulated points and available coupons.

Each item has its own Object type in the Passes API: LoyaltyObject, OfferObject, GiftCardObject, TransitObject, EventTicketObject and FlightObject. Each object contains fields for name, logo, barcode, expiration date and additional information.

Integration with Wear OS

On Wear OS watches, Google Wallet works autonomously — the watch has its own NFC antenna and can make payments without being connected to the phone. To do this, cards are copied to the watch's TEE via a Bluetooth connection. Just press the power button twice — Wallet opens, and you can tap the watch to the terminal. Transit tickets and loyalty cards are also supported.

Digital car keys

The digital key feature uses the UWB (Ultra-Wideband) protocol to precisely determine the distance to the car. A phone with a UWB chip (for example, Pixel 9 Pro or Samsung Galaxy S25) can unlock the door without being taken out of the pocket — just approach. The key can be shared with another Wallet user via Google Messages for a limited time.

Google Wallet Passes API for developers

Passes API is a REST API from Google that allows developers to create, update and deliver digital passes to users' Google Wallet. The API supports JSON request format and authentication via OAuth 2.0. The developer can create objects programmatically and send them to a specific user's device via a link or push notification.

{
  "id": "33880000000000001",
  "classId": "IT_SECTR_LOYALTY_CLASS",
  "state": "ACTIVE",
  "barcode": {
    "type": "QR_CODE",
    "value": "ITSECTR2026"
  },
  "loyaltyPoints": { "balance": { "int": 350 } }
}

In the example, a loyalty card with a QR code and a balance of 350 points is created. The object contains a reference to the IT_SECTR_LOYALTY_CLASS class, where visual parameters are defined: colors, logo, text. The class is created once, objects — for each user. This approach saves API requests and allows mass updating of the design of all cards.

Main API methods

The API provides methods for creating classes and objects, updating them, getting a list and deleting them. Requests are made to the base URL https://walletobjects.googleapis.com/walletobjects/v1. Authentication is done through a Google Cloud service account with the Editor role. An access token is requested via OAuth 2.0 with the scope https://www.googleapis.com/auth/wallet_object.issuer.

Content requirements

Each object sent to the wallet undergoes Google moderation — it is checked for compliance with brand guidelines, absence of spam and barcode correctness. The logo must have a minimum resolution of 300x300 px, the text must fit within the viewing area on the phone screen. The average review time is 1–2 business days.

Security and privacy of Google Wallet

The security of Google Wallet is built on three levels: hardware protection (TEE, Hardware Attestation), network protection (TLS 1.3, tokenization) and user control (biometrics, Find My Device, remote wipe). Each level covers a specific attack vector — from physical access to the device to data interception in payment networks.

According to the Google Security Blog report (2025), not a single case of compromise of payment data stored in the TEE has been recorded since 2022. All security incidents involved phishing attacks, where users themselves entered card data on fake websites. To combat phishing, Google has introduced contextual warnings within the app.

Remote token management

If the phone is lost or stolen, the owner can go to the Find My Device website and select the “Erase data” option. After that, all tokens in the TEE are invalidated — payment terminals will reject transactions from this device. Additionally, Google revokes the Hardware Attestation certificate of the specific chip, so even a factory reset will not restore payment functions on this device.

Privacy and user data

Google does not store transaction history inside Wallet. Each transaction is processed by the issuing bank, and Google acts only as a transport layer. The device's location is not transmitted to the merchant — the terminal receives only the token and cryptogram. The exception is transit tickets, where the entry/exit station is recorded for fare calculation.

Google Wallet and Google Pay: differences

After the 2022 rebranding, many users are still confused about the difference between Google Wallet and Google Pay. The short answer: Wallet is the app (UI + storage), Google Pay is the technology layer (API + tokenization + NFC payment gateway). Google Pay as a brand survived in India and Singapore, where it works as a P2P payment system using the UPI protocol.

In practice, for users outside India, it all comes down to one thing: open Google Wallet, tap the phone to the terminal — payment goes through Google Pay technology, but you only see the Wallet interface. For developers, payment integration is done through the Google Pay API (part of the Google Wallet SDK), and pass management is done through the separate Passes API.