If you use an Android device, you would likely have come in contact with Google Play Store and Google Pay.

Google Play Store is the digital store of free or paid mobile apps, games and digital products for an Android device.

When paying for services such as YouTube Premium or when buying digital products via the Play Store, Google Pay is used to process payments. The payment information, which contains the customer’s credit or debit card details, is saved to a Google account.

As a Nigerian who wants to pay for a mobile app on Play Store, clicking on “install” directs you to a page where you will need to add your credit or debit card. You are required to “Add a payment method to your Google Account to complete purchase”.

Once you input your card details, they are saved automatically until you choose to remove them.

READ ALSO: How Fraudsters Are Stealing From Emails Through AI

RISKS LINKED WITH SAVED PAYMENT METHODS

Google Pay is meant to be a secure payment service which allows users to pay in stores and online without retrieving the card every time. But the fact that your card details are stored on your Google account could create an opening for hackers to access and steal your money through debit card fraud.

Debit card fraud, according to Investopedia, happens when someone such as a hacker obtains your debit card information to make unauthorised purchases or withdraw money from your account.

Hackers use various methods to compromise phones, computers, email accounts and bank accounts. They usually take advantage of system vulnerabilities, poor security measures or mistakes made by users.

Among a host of other common techniques, hackers use phishing, malware, brute-force attacks, password cracking and social engineering to gain unauthorised access to users’ sensitive information.

Some recommended ways to safeguard yourself against these include getting bank alerts, protecting your mobile devices, using strong, unique passwords, enabling Two-Factor Authentication (2FA) to add an extra layer of security and avoiding links or attachments from unknown or suspicious sources.

Ensuring your operating system, browsers and antivirus software are up to date, using HTTPS-secured websites, not using public Wi-Fi for sensitive transactions, monitoring your bank, email and online accounts for suspicious activities and only downloading verified apps from reputable websites can also protect you.

An article published in The Sun UK reads, “One of the tried-and-true ways to stay safe online is to enable multi-factor authentication on devices and accounts that support it. This sign-in method asks users to confirm their identity several times before accessing their accounts. Using biometric credentials like a fingerprint or face scan is among the best ways to keep your information private.”

A 2023 report by NordVPN, a platform that offers secure and anonymous online connections, states that the onus lies on users to protect themselves by integrating online privacy and security tools in their daily lives. This is because banks and online stores cannot control the broader issues linked with identity theft and data breaches.

While analysing six million stolen bank cards with details sold on the dark web in 2023, NordVPN found that the card details were stolen alongside other sensitive personal data, which poses a significant risk of identity fraud.

From personal experience and speaking with a few other Nigerian users, I found that there were different ways Nigerians interacted with the Google payment platform and Google Play Store.

First, your card is saved automatically when paying for a product or service. If it is a one-off payment, you can easily remove the payment method.

However, for recurring payments — such as monthly subscriptions — for services such as Truecaller or YouTube Premium as seen in the image below, you cannot just remove your payment method.

Removing a payment method requires you to replace with another. Except you cancel the subscription.

READ ALSO: Insertion, Retraction, Strange Debits… How Seconds-Long ATM Fraud on Bank Premises Puts Every Customer at Risk

You must replace the previous one with a new credit or debit card. Another alternative to avoid saving your debit card details online is by cancelling the product and then removing your card information afterwards.

When you cancel a subscription, you will still be able to use your subscription for the time you have already paid. For instance, if you paid for a one-month Truecaller subscription on December 1 and decide to cancel on December 27, you will have access to it until December 31 and you will not be charged another monthly subscription on January 1.

An attempt by the reporter to cancel one of her subscriptions.

What this means is that you can decide to pay for an entire year of subscription for a service, cancel the subscription and then remove your saved payment method.

You can also choose to keep renewing the subscription every month, even after cancellation, by setting a reminder one or two days before you are cut off from the service.

Meanwhile, in cases where users permit regular, automatic deductions, I found that besides the verification at the initial subscription, subsequent payments rarely required verification.

This means that your card can be used without any authentication whatsoever. And it’s risky! If your email or devices are hacked, it becomes easy for a hacker to use your card information without a PIN or authorisation.

While scouring the Internet for resources for this report, I found that you may enable extra verification such as fingerprint or face lock on your Android device and forget to do so on your computer.

For instance, when I tried to pay for Simple Gallery Pro via Google Play on my Android phone as well as on my laptop, I discovered that the former device required biometric verification. This verification only applies to purchases through Google Play for my Google account on my phone.

The app on Google Play.

Verification on the phone.

However, the experience was different on my laptop. There was no request for verification. This was because, under my payment methods, the option to manually verify every time I pay using the autofill payment methods was turned off.

Also, the fact that there was an enabled option that allowed sites to check if I have payment methods saved seemed unsettling, so I had to turn it off alongside other options.

Before options under payment methods were disabled.

After options under payment methods were disabled.

READ ALSO: These ‘Fun’ and ‘Harmless’ Social Media Quizzes Can Make You Easy Prey to Hackers

EXPERIENCES OF DIFFERENT USERS

Samuel Tijani, a research assistant, told FIJ that he preferred using a Kuda Bank card for recurring subscriptions instead of his main bank’s debit card. He explained that he only transfers small amounts of money to the Kuda card to avoid losing large sums to unauthorised transactions.

Justinah, a student, said she uses her main bank card and deductions are made automatically without any other verification except the OTP that was required the first time she paid for an item.

In response to why she uses her main bank card, she said, “I am comfortable using it because if they (hackers) want to remove money, they will not see anything to remove.

“I actually use OPay more than that GTBank card, but the main thing is that there is no money there, so I feel comfortable using it. Also, I can cancel the subscription every time.”

Neither Tijani nor Justinah saw the need to manually manage their subscriptions — such as cancelling after payment, removing card details and setting a reminder to renew before the next billing cycle to avoid service interruptions.

UNAUTHORISED, SUSPICIOUS ACTIVITIES

Irrespective of the security measures users put in place, no security system is foolproof. Some Nigerians have experienced unauthorised debits with the description “Web/Purchase/GooglePlayNg”.

FIJ published a report in early December detailing how N72,900 disappeared from Toyin Akinlabi’s Guaranty Trust Bank (GTB) account without her authorisation in October.

The bank told her that the disputed transaction was carried out with her card credentials though she insisted that she did not authorise the transaction.

To prevent accidental purchases made from the Play Store app, Google recommends entering certain information such as a password before making a purchase.

Accidental purchase.

The good news is that an accidental purchase or unauthorised charge can be refunded. At least in most cases because refund policies are determined by what the user’s account bought, when and how the user paid and where they are located.

Google says, “If you give your account or payment details to someone else, appear to be abusing our policies, or don’t protect your account with authentication, we usually can’t issue a refund.

“If you find a Google Play purchase on your card or other payment method that you didn’t make and that wasn’t made by anyone you know, report unauthorised charges within 120 days of the transaction.”

READ ALSO: EXPLAINER: EFCC ‘Linked Naira Marley to the Dark Web’. Here’s What You Need to Know About the Internet’s Most Hidden Part

Gbubemi Oritse, an Android user, told FIJ that he was able to recover his money after someone hacked into his email, got his card number that was saved in Google Play Store and used it to purchase an item.

All he had to do was send a message to Google, confirm that his email was hacked into and his money was refunded.

He noted that banks would not be able to make refunds in such cases. For such fraudulent transactions to place, whoever is responsible would have obtained one’s card PIN, hence the need to remove that card from your Google account and probably block it to prevent further unauthorised transactions.

Google has several measures in place to notify users of suspicious activities on their accounts. Your account may have been hacked if you notice unfamiliar changes to critical security settings,unauthorised financial activity and unusual activity notifications or suspicious activity in Google products you use.

This link contains some of the practical methods recommended by Google Support to safeguard a Google account against unauthorised access.
The post Users’ Google Account Weaknesses, Tips to Avoid Unauthorised Debit Alerts appeared first on Foundation For Investigative Journalism.