IssueTracker

Thank you for reporting this issue. For us to further investigate this issue, please provide the following additional information:

Steps to reproduce
What steps are needed to reproduce this issue?
Please explain the reproduction steps in detail.

Frequency
How frequently does this issue occur? (e.g 100% of the time, 10% of the time)

Expected output
What is the expected output?

Current output
What is the current output?

Android bug report
After reproducing the issue, press the volume up, volume down, and power button simultaneously. This will capture a bug report on your device in the “bug reports” directory. Attach the bug report  file to this issue.

Alternate method:
After reproducing the issue, navigate to developer settings, ensure ‘USB debugging’ is enabled, then enable ‘Bug report shortcut’. To take bug report, hold the power button and select the ‘Take bug report’ option.

Steps to reproduce
press power button to turn the screen on, but dont unlock the phone
touch a NFC payment system

Frequency
How frequently does this issue occur? (e.g 100% of the time, 10% of the time)
100%

Expected output
for the payment to fail, since the device is not authenticated (no pin, password or fingerprint)

Current output
Payment is processed

attaching bugreport with a payment done in the last 15min/half hour.
latest android Oreo stable release for Nexus 6p. bootloader locked.

We are not clear about the reproduction steps.

Can you please explain in detail?

I don't really know what more detail i can provide other making a video of
it.

Bottom line, I'm able to do android pay payments without unlocking my Nexus
phone.
One would expect it to only work when device is unlocked, but I can
consistently do it just by powering on the screen without unlocking the
phone.

Does this help?
On Mon, 28 Aug 2017 at 14:16, <buganizer-system@google.com> wrote:

--
--
Fernando

Can you please capture and share video of the issue with us?

I think i found the reason for this behaviour
from my bank, HSBC
https://www.hsbc.co.uk/1/2/android-pay#FAQs
"For transactions over £30, your phone may prompt you for additional verification. Hold your device near the contactless terminal and follow the on-screen instructions."

so it seems that under £30, android pay wont require the device to be unlocked.
so android pay replicates the same behaviour as a contactless card.

Form the comment #7, we understood that this is an intended behaviour.
Please confirm on this?

seems to be.
just was not expecting that, since I was expecting to always having to unlock the device.

I was surprised by that behaviour also when Android Pay launched in Canada but it is working as intended like a contactless card. I think we have the highest Android Pay limit in the world at CAD$100 and that is also our contactless limit.

We have passed this to the development team and will update this issue with more information as it becomes available.

We have deferred this to a future release, but leaving this open for now.

I'm a bit confused here.
from my POV this ticket can be closed as it is working as intended , by the bank policy.

why is the dev team being involved ?
:O

Closing this issue based on the comment #13.