Risk signals

Google's AI Surfaces will provide contextual data to merchants to help them assess transaction risk and make decisions on whether or not they want to proceed with the transactions. This allows merchants to be in full control of the purchases that happen on their platforms.

This data is primarily shared during the Complete Checkout API call.

• In the 2026-01-23 specification, these signals are found within the risk_signals object.
• In the 2026-04-08 specification, this object is named signals.

The data signals provided are the same for both specification versions.

Google will share the following data types with merchants:

---

Session Data

Signal Name	Description	API Path (2026-01-23:risk_signals / 2026-04-08:signals)
IP Address	IP address of the user in the session.	ip_address
Session Start Time	Time when the purchase was initiated (Unix epoch timestamp).	session_start_time

Note: These session data signals are included in all requests.

---

Device Data

Signal Name	Description	API Path (2026-01-23:risk_signals / 2026-04-08:signals)
Device Type	Type of device being used (e.g., MOBILE, DESKTOP, TABLET, or UNKNOWN). Derived from User Agent.	device_type
Device Timezone	Current timezone of the device being used in the session.	device_timezone

Note: These device data signals are included in all requests.

---

Browser Data

Signal Name	Description	API Path (2026-01-23:risk_signals / 2026-04-08:signals)
User Agent	Browser client information string.	user_agent
Browser Language	Language being used in the browser on the device (e.g., "en").	locale
Viewport Height	Height of the browser viewport in pixels.	viewport_height_px
Viewport Width	Width of the browser viewport in pixels.	viewport_width_px

---

Order Data

The following data points are available within the Create/Update Checkout API calls and provide context for the order:

Signal Name	Description	API Path (Create/Update Checkout)
Product ID	Helps the merchant identify the item.	line_items[x].item.id
Fulfillment ID	Helps determine delivery type and method.	Varies based on fulfillment setup

---

Shipping & Billing Data

Address and buyer information is primarily provided during the Create/Update Checkout API calls.

• Buyer Information:

Signal Name	Description	API Path (Create/Update Checkout)
User's Email ID	Signed-in user's Google Email ID.	buyer.email

• Shipping Address: Available in Create/Update Checkout under fulfillment.methods.destinations[x] (where type is "shipping" and x is the selected_destination_id).

Signal Name	Description	API Path	Optional
First Name	Recipient's first name	first_name	No
Last Name	Recipient's last name	last_name	No
Full Name	Recipient's full name	full_name	Yes
Phone Number	Recipient's phone number	phone_number	Yes
Street Address	Main street address line	street_address	No
Extended Address	Apartment, suite, etc.	extended_address	Yes
City	City or locality	address_locality	No
Region	State or region	address_region	No
Postal Code	ZIP or postal code	postal_code	No
Country	Country code	address_country	No

• Billing Address: Available in Complete Checkout. The fields are the same as those listed in the Shipping Address table and are found within the payment.instruments[x].billing_address object (where x is the selected_instrument_id). ---

Payment Verification Data

The following fields are available within the risk_signals (for v23) or signals (for v4/8) object in the Complete Checkout response.

Note: For the initial MVP, Google Pay does not perform all checks at transaction time, so some fields may return an empty string or null. These may become richer over time.

Signal Name	Description	API Path (2026-01-23:risk_signals / 2026-04-08:signals)
AVS Full Result	Address Verification System (AVS) check result.	avs_full_result
CVV Result	Card Verification Value (CVV) check result.	cvv_result
Authentication Triggered	Indicates if extra user authentication was performed.	authentication_triggered
Authorization Processed With 3DS	Indicates if 3D Secure verification was performed.	authorization_processed_with_3ds

---