Is a four-digit security code too much friction? Google, Amex say it is.

American Express is the first company to adopt Google technology that supports virtual cards with minimal input from users while shopping — eliminating the need to type a three-digit security code from the back of a plastic card at checkout. 

While many websites let users store payment card details for later checkout, they still require users to provide the three- or four-digit security code printed on the plastic card as an extra measure of authentication. This step is no longer necessary thanks to advancements in security technology, according to Google and Amex.

"The security code is the last thing you still have to manually enter. It's a tiny bit of friction that the virtual cards can resolve," said Lisa Yokoyama, head of product for Amex Digital Labs.

Google has launched virtual cards on Chrome and Android, as part of a broader restructuring of Google's payments technology. Google is storing user credentials in Google Wallet, while Google Pay will be used in tandem to make payments. The move, which Google is making to declutter the Google Pay experience, also includes tokenized virtual cards within Google Pay. Users will have the choice to make their enrolled Google Pay cards virtual, eliminating the need to re-enter the card's security code for in-app purchases.

Amex is responding to a rapid and ongoing expansion in online payments. Online retail sales are expected to reach $6.5 trillion in 2022, up from $3.5 trillion in 2019 and $1.3 trillion in 2014, according to an Amex analysis. There are also new online shopping categories such as home sales, office equipment and groceries that had long been handled primarily offline.

"There's more people coming online than before, and we're looking to create new digital experiences for them," Yokoyama said.  

Consumers use Google to create and save virtual card numbers when using Autofill on Chrome and Android. The virtual card numbers replace the 15-digit physical card with a token, while also automatically generating a dynamic four-digit card identification number, replacing the four digits displayed on the front of the user's Amex card (Visa and Mastercard use a three-digit code printed on the back). 

"There's an extra layer of security there since the token is not the actual number that's printed on the card," Yokoyama said. 

The virtual cards can be managed at Google Pay's site, where consumers enable the feature for cards, access virtual card numbers and view recent transactions. 

"Using virtual card numbers helps to reduce physical card [reissuance] when fraud occurs because the token can be turned off without impacting the physical card number," said David Shipper, strategic advisor for retail banking and payments at Aite-Novarica Group. "American Express is the first, but other card networks and browsers are likely to follow because this adds a lot of security to transacting online."

Google reports that Visa, Mastercard and Capital One will also deploy virtual card technology for Chrome this summer. Visa, Mastercard and Capital One did not return requests for comment by deadline. A Google spokesperson said that as people do more shopping online, "keeping payment information safe and secure is critically important." 

As more transactions take place in multiple physical and online channels, businesses are under increasing pressure to ensure the consumer has a quick, painless shopping experience, according to Vijay Sondhi, chief executive of NMI, a payment processing technology company. 

"These partnerships emerging in the payment industry are connecting tech giants with traditional fintech players to create these great experiences for both the merchant and end consumer," Sondhi said.

Such partnerships will become more prevalent as businesses try to anticipate consumer expectations for different payment options, such as tap-to-pay, mobile wallets and biometric authentication, Sondhi said.

"The virtual cards are a way to make it easier for consumers to transact where the volume of payments may be increasing," said Marco Salazar, director of payments  for Javelin Strategy & Research, who said Google can use the tech to keep pace with Apple, which uses a Wallet app to store credentials for Apple Pay. 

Apple also plans to support consumer payments between contactless cards and Apple's hardware, but does not plan to directly process payments. Apple stores user credentials in a digital wallet for use on Apple Pay, supporting the same type of separation of credential storage and payment technology that Google is creating through its restructuring.  

The virtual cards also make Google a more active participant in consumer payments, according to Daniel Keyes, an analyst at Javelin's payments practice. 

"With Google and Apple it's often an arms race to make sure both are offering the same capabilities," Keyes said.