Risk signals implementation

Google's AI surfaces provide contextual data to merchants to help them assess transaction risk and make decisions on whether or not they want to proceed with the transactions. This allows merchants to be in full control of the purchases that happen on their platforms.

This data is primarily shared during the Complete Checkout API call.

In the 2026-01-23 specification, these signals are found within the risk_signals object.

Important: The risk_signals object is an open-ended map. Google might add new risk signals to this object without prior notice. To prevent request failures, your API implementation must gracefully ignore any unknown or undocumented keys.

Google shares the following data types with merchants:

Session Data

Signal Name	Description	API Path
IP Address	IP address of the user in the session.	ip_address
Session Start Time	Time when the purchase was initiated (Unix epoch timestamp).	session_start_time

Note: These session data signals are included in all requests.

Device Data

Signal Name	Description	API Path
Device Type	Type of device being used (e.g., MOBILE, DESKTOP, TABLET, or UNKNOWN). Derived from User Agent.	device_type
Device Timezone	Current timezone of the device being used in the session.	device_timezone

Note: These device data signals are included in all requests.

Location Data

The following coarse geographic location signals are derived to assist with fraud prevention and account takeover detection.

Signal Name	Description	API Path
User Country	The coarse country location of the buyer (e.g., United States).	user_country
User State	The coarse state or province location of the buyer (e.g., California).	user_state

Browser Data

Signal Name	Description	API Path
User Agent	Browser client information string.	user_agent
Browser Language	Language being used in the browser on the device (e.g., "en").	locale
Viewport Height	Height of the browser viewport in pixels.	viewport_height_px
Viewport Width	Width of the browser viewport in pixels.	viewport_width_px

Order Data

The following data points are available within the Create/Update Checkout API calls and provide context for the order:

Signal Name	Description	API Path (Create/Update Checkout)
Product ID	Helps the merchant identify the item.	line_items[x].item.id
Fulfillment ID	Helps determine delivery type and method.	Varies based on fulfillment setup

Shipping & Billing Data

Address and buyer information is primarily provided during the Create/Update Checkout API calls.

• Buyer Information:

Signal Name	Description	API Path (Create/Update Checkout)
User's Email ID	Signed-in user's Google Email ID.	buyer.email

• Shipping Address: Available in Create/Update Checkout under fulfillment.methods.destinations[x] (where type is "shipping" and x is the selected_destination_id).

Signal Name	Description	API Path	Optional
First Name	Recipient's first name	first_name	No
Last Name	Recipient's last name	last_name	No
Full Name	Recipient's full name	full_name	Yes
Phone Number	Recipient's phone number	phone_number	Yes
Street Address	Main street address line	street_address	No
Extended Address	Apartment, suite, etc.	extended_address	Yes
City	City or locality	address_locality	No
Region	State or region	address_region	No
Postal Code	ZIP or postal code	postal_code	No
Country	Country code	address_country	No

• Billing Address: Available in Complete Checkout. The fields are the same as those listed in the Shipping Address table and are found within the payment.instruments[x].billing_address object (where x is the selected_instrument_id).

Payment Verification Data

The following fields are available within the risk_signals object in the Complete Checkout response.

Note: For the initial MVP, Google Pay does not perform all checks at transaction time, so some fields may return an empty string or null. These may become richer over time.

Signal Name	Description	API Path
AVS Full Result	Address Verification System (AVS) check result.	avs_full_result
CVV Result	Card Verification Value (CVV) check result.	cvv_result
Authentication Triggered	Indicates if extra user authentication was performed.	authentication_triggered
Authorization Processed With 3DS	Indicates if 3D Secure verification was performed.	authorization_processed_with_3ds

Example

The following example shows the structure of the risk signals object for version 2026-01-23.

{
  "risk_signals": {
    "ip_address": "123.456.7.890",
    "session_start_time": "1778090291092",
    "device_type": "DESKTOP",
    "device_timezone": "America/Los_Angeles",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
    "locale": "en",
    "viewport_height_px": 893,
    "viewport_width_px": 1515,
    "avs_full_result": "Y",
    "cvv_result": "M",
    "authentication_triggered": true,
    "authorization_processed_with_3ds": true
  }
}