Question about the cause of the differences in Google Pay features

Question

If you are logged in with your Google account and click "Manage your Google Account," you can then edit your payment profile. But you cannot (1) see the complete card number except for the last 4 digits or (2) change the number of an existing card. You are only allowed to (1) edit other information of the card like CVC and billing address or (2) remove the card.

By contrast, if you use Google Pay at the checkout page of a seller's website, you will find that you can see your actual card number and edit it, but right-click is disabled on the payment form (What is the reason for this?).

I am wondering whether there are any security concerns involved that cause the differences. Does the actual credit card number in the latter scenario stay in the application memory? If so, what is the chance of a user's RAM being hacked and his credit card information getting stolen?

Answer 1

Most likely, Google withholds the full number of the credit card as a way to prevent someone else that got access into your account to get it. They only reveal the last four digits so that you can discern which credit card it has. This implies that you are not allowed to edit the credit card number, as that would allow the user to view the full number. Removing the card and adding a new one works well, instead. (Plus, they probably have some internal identifier to link this card with purchases, so internally they probably want as well that a new card is set up as a new object, not as a change of an old one)

However, you found out that

if you use Google Pay at the checkout page of a seller's website, you will find that you can see your actual card number and edit it

I would consider this a result of the implementation of this particular seller. The seller API clearly lets them know the full credit card number (this could be needed to linking a chargeback to card XYZ with a purchase, or if they are handling directly the communication with the merchant). The seller page also allows you to change the credit card number on-the-fly. Which is a good feature from an UX point of view. However, showing the full credit card number here misses the point of actually attempting to hide it from the user (note that credit card numbers aren't considered a secret, but it isn't a good idea to make them much available, either). I think they should simply show those last characters instead.

but right-click is disabled on the payment form (What is the reason for this?).

Sometimes websites block right-clicking "for security", such as trying to "protect" the page code they sent to the user browser by blocking the contextual menu and thus making it slightly harder to view the page source. It doesn't really work, though, so that will basically only annoy users that wanted to use it (e.g. for actions as mundane as 'Copy' or 'Paste'). It makes sense to block the right click if the page implements its own contextual menu (several webmails do this) as a replacement (otherwise the user could get one upon the other), but little else.