About

Many of us have probably used the credit card auto-fill feature in Google Chrome at least once. When you’re shopping online, the browser can automatically fill in your card number and expiration date at checkout, so you don’t have to pull out your card and type everything in every time.

You can change the relevant settings under payment methods in your profile.

You can also add your cards manually.

My personal experience

Because Chrome automatically pops this up on checkout forms, I do use it sometimes. But honestly, the experience is especially bad. For one thing, it still makes me manually enter the CVV every time, which means I have to go find the physical card anyway. More importantly, it only shows the issuing bank/network and the last four digits. That’s fine for cards from Chase or Citi. But with AMEX, it’s a huge headache. A lot of my cards end in things like 1000 or 1008, so I can’t tell which card Chrome is actually suggesting. If I pick the wrong one, I have to go find the card all over again. At that point, I could have already typed in the full card number myself.

On top of that, sometimes both my own cards and family members’ cards have been saved in Google Chrome before (after you pay with a card number, Chrome may pop up and ask whether you want to save it). When the saved card suggestion appears, I may not even know whose card it is, or whose billing info and name I’m supposed to enter. In short, if you have a lot of cards, this feature is almost counterproductive.

Now I just type in the card number directly and store it locally. When I need it, I just copy and paste it.

ChromeChrome

My Google account got locked, and I couldn’t use email either

Then came the most annoying part. I was booking a hotel over the last couple of days and accidentally used an old expired credit card that Google autofill had saved before. After I selected it, Google told me the card had expired and asked me to re-enter the expiration date and CVV. I dug out that card (I’m not even sure it was the same one), entered the new expiration date and CVV, and it accepted it. But at checkout, it flagged the payment as risky, wouldn’t let me pay, and sent me an email about it (which I didn’t read at the time). I then manually entered a new card number, expiration date, and CVV on the payment page, and the payment went through successfully with no risk warning at all, which shows there was nothing wrong with my card.

The next day, I noticed Chrome was asking me to verify my identity. Then I checked the email from the day before, and it said there was a serious risk issue with my account.

So I tried to see what activity supposedly triggered the risk warning. But to view that activity, I had to log in first.

After logging in, it then said I needed to recover my Google account.

Fine, I thought, let’s just unlock it step by step. But after I entered my backup email and the verification code I received, it told me the review would take 48 hours. During those 48 hours, a sign-in link would be sent to my backup email. Unbelievable. And during that time, I couldn’t use any Google-account-related services at all. That includes Gmail. That includes Gmail. That includes Gmail.

The so-called status check just shows the exact same page again.

A reminder: don’t try logging back into your Google account during this period. If you do, the recovery process may get canceled.

I’m guessing websites where I signed up or logged in using my Google account probably won’t work either.

My advice

It is definitely convenient to keep everything under one account, and I do believe Google’s auto-fill security, encryption, and risk controls are probably quite good. But I still recommend keeping your everyday services and your financial information separate. If something related to a credit card triggers Google’s risk controls and locks down your entire account—including Gmail—that can be incredibly disruptive.

Going forward, I’ll use my Google account just for email and address auto-fill. As for credit cards, I’ll keep track of them myself. Even the card issuer had no problem with the card, and the card itself continued to work fine, so I have no idea why Google suddenly freaked out.

I’ll update everyone once the account is unlocked.