It is significantly harder to game though - companies succesfully offer behavioral monitoring for DLP products with far less data than the payment data Google has access to. Years of payments with a certain payment type? That's a pattern. Renting movies at certain time in the week? That's another... The truth of the matter is, somebody has to actually care to do this. From accounts of googlers I've read, that's not what the culture of Google is likely to result in though.