If you send a payment based on Google Pay by phone or hour to the NFC terminal, a randomly generated 16-digit number is sent, not your credit card and personal information. This means that if the terminal or store you used has been hacked, your personal financial information should be secure. Once again, this randomly generated number is stored on a cloud server, not on your phone, for added protection. Lastly, payments are only sent if your phone is working and unlocked. If it is locked and not used, your account should be secure.