Database Develop

[Magisk][Module] Play Store Visa - Get your device certified with custom ROMs

Introduction
Fix UNCERTIFIED status in Play Store for OP2/OP3/Note4 and maybe more.
Uncertified status may lead to some restrictions on specific apps (saying Netflix). It is not only judged by SafetyNet status but also some build props in your ROM. So this module does NOT may or may not help you to pass SafetyNet.
More specifically, to pass SafetyNet, if you are on a custom ROM/Kernel,
a patch in your kernel like this is REQUIRED (maybe optional because of MagiskHide?)
If you are on stock ROM or other ROMs that enabled dm-verity, never touch system part.
SELinux is always enforcing
Installation
Search for "Play Store Visa" in Magisk Manager or download at Github.
Support for New Devices
This module made it by injecting proper build fingerprint properties per device, most commonly ro.build.fingerprint. So device support is highly dependent on a working build fingerprint from a certified stock ROM. You can test and find a combination by your own and add to service.sh accordingly.
I used to find those fingerprints hard to search around. Although one fingerprint may work for all devices of a kind, but people barely shares it. Pull requests are very welcomed so we may help one another!
Define: a working fingerprint
For the time being, I test the prop edits working by:
clean data of Play Store
reboot for the module to apply (or invoke resetprop through adb)
open and check certification status in settings. (may have some delay)
search for Netflix in Play Store.
If you can see Netflix in search results after wiping store's data, then your props edits are good to go!
Enjoy
Q&A
Q:
Only for OP2/OP3/note4? Not support for other device?
A:
To support other device, we need the value of `ro.build.fingerprint` from a stock ROM. I don't own other devices so I may not have chance to extract it. Contributions are welcomed, and I may search for other useful ones in the future..
Q:
What's the difference between this module and this one?
A:
We both solved part of the problem, see my explanation below. I'm happy to contribution my parts, if necessary, to prevent reinventing the wheels.
XDA:DevDB Information
Play Store Visa, App for all devices (see above for details)
Contributors
ttimasdf
Source Code: https://github.com/Magisk-Modules-Repo/playstore_certification_bypass
Version Information
Status: Beta
Created 2018-03-26
Last Updated 2018-03-31

Only for OP2/OP3/note4?
Not support for other device?

What's the difference between this module and this one?

ttimasdf said:
More specifically, to pass SafetyNet, if you are on a custom ROM/Kernel,
a patch in your kernel like this is REQUIRED
If you are on stock ROM or other ROMs that enabled dm-verity, never touch system part.
SELinux is always enforcing
Click to expand...
Click to collapse
That patch you're talking about is unnecessary if you use Magisk. MagiskHide already changes ro.boot.verifiedbootstate to "green".
MagiskHide also hides a permissive SELinux, so keeping it enforcing isn't necessary to pass SafetyNet if you use Magisk. Although keeping SELinux enforcing is highly advisable...
I'm also curious as to what observations you've made about SafetyNet and a certified Play Store. From my own (very light) research I've found that it relies on SafetyNet. Not directly, but the CTS profile matching part. From the link to Google support in the OP:
If your device is uncertified, Google doesn’t have a record of the Android compatibility test results.
Click to expand...
Click to collapse
If your device hasn't passed the Android compatibility test, it won't be reported as certified in the Play Store, and it won't pass SafetyNet. On the other hand, if you pass SafetyNet, your device has passed the compatibility test, and then it'll also be certified in the Play Store.
Would love the hear your findings if you're up to sharing.
---------- Post added at 13:27 ---------- Previous post was at 13:25 ----------
abacate123 said:
What's the difference between this module and this one?
Click to expand...
Click to collapse
Quite similar in that we both change the device fingerprint. We go about it a bit different, and mine has a couple of other features as well.

My play store don't have "Device certification" tab :'(

zerlkung said:
My play store don't have "Device certification" tab :'(
Click to expand...
Click to collapse
Can you find and install Netflix? If so, your device is certified. If not, it's uncertified.

Was this created in response to Google blocking GApps on uncertified devices/roms? If so then that is great, I didn't expect a solution to come out so fast.
That being said, based on current reports it would not be hard to create a universal "coyote mode" by getting the existing ro.build.fingerprint and then modifying the build date portion so that it is before March 2018. Said mode would not make the device certified if it wasn't already but would allow GApps to run normally thus the term "coyote mode" (a coyote is a person who smuggles other people across the border).

nl3142 said:
Was this created in response to Google blocking GApps on uncertified devices/roms? If so then that is great, I didn't expect a solution to come out so fast.
Click to expand...
Click to collapse
Google is not blocking gapps for custom roms. At least not yet.
In fact, you can actually register an uncertified device using a custom rom (it says android id, but it'll accept the imei number) here: https://www.google.com/android/uncertified/

abacate123 said:
Google is not blocking gapps for custom roms. At least not yet.
In fact, you can actually register an uncertified device using a custom rom (it says android id, but it'll accept the imei number) here: https://www.google.com/android/uncertified/
Click to expand...
Click to collapse
Though since the Android ID is regenerated after either every factory reset (pre-Oreo) or even every boot (Oreo) it will be pretty easy to run into the 100 Android ID limit.

nl3142 said:
Though since the Android ID is regenerated after either every factory reset (pre-Oreo) or even every boot (Oreo) it will be pretty easy to run into the 100 Android ID limit.
Click to expand...
Click to collapse
IMEI fellow...

abacate123 said:
IMEI fellow...
Click to expand...
Click to collapse
Which wifi only devices like tablets don't have, so obviously that isn't going to work.

Cbk | Unknown said:
Only for OP2/OP3/note4?
Not support for other device?
Click to expand...
Click to collapse
As said above, to support other device, we need the value of `ro.build.fingerprint` from a stock ROM.
I don't own other devices so I may not have chance to extract it. So we only need some contributions

abacate123 said:
What's the difference between this module and this one?
Click to expand...
Click to collapse
Oh, I know that module but didn't read it's doc until you mentioned. In a word, the same solution for different questions.
My problems is, my ctsProfile is True for my phone but I cannot get Netflix from the store. But after some props edit it just works so I published my solution. Maybe I could make a PR into it
Didgeridoohan said:
That patch you're talking about is unnecessary if you use Magisk. MagiskHide already changes ro.boot.verifiedbootstate to "green".
MagiskHide also hides a permissive SELinux, so keeping it enforcing isn't necessary to pass SafetyNet if you use Magisk. Although keeping SELinux enforcing is highly advisable...
I'm also curious as to what observations you've made about SafetyNet and a certified Play Store. From my own (very light) research I've found that it relies on SafetyNet. Not directly, but the CTS profile matching part. From the link to Google support in the OP:
If your device hasn't passed the Android compatibility test, it won't be reported as certified in the Play Store, and it won't pass SafetyNet. On the other hand, if you pass SafetyNet, your device has passed the compatibility test, and then it'll also be certified in the Play Store.
Would love the hear your findings if you're up to sharing.
---------- Post added at 13:27 ---------- Previous post was at 13:25 ----------
Quite similar in that we both change the device fingerprint. We go about it a bit different, and mine has a couple of other features as well.
Click to expand...
Click to collapse
Your project goes a lot further than mine but I didn't notice it as a key to my problem :silly:
From my finding, SafetyNet ctsProfile seems to rely solely on ro.build.fingerprint and the "certified" status does the same. The rom I used on Note4 patched the fingerprint and passed SafetyNet from the very beginning.
But Play Store seems to have more verifications on other build props, in my case, ro.build.version.release, ro.build.version.incremental to match the ones in fingerprint. The patch I used for OP3 did not patched them (for I have no time to inspect) so I passed SN, get certified, but still cannot search for Netflix. I don't know it's a more strict policy enforced by Netflix or Google but it makes the certification imperfect. Maybe we shall look into this together

ttimasdf said:
Oh, I know that module but didn't read it's doc until you mentioned. In a word, the same solution for different questions.
My problems is, my ctsProfile is True for my phone but I cannot get Netflix from the store. But after some props edit it just works so I published my solution. Maybe I could make a PR into it
Your project goes a lot further than mine but I didn't notice it as a key to my problem :silly:
From my finding, SafetyNet ctsProfile seems to rely solely on ro.build.fingerprint and the "certified" status does the same. The rom I used on Note4 patched the fingerprint and passed SafetyNet from the very beginning.
But Play Store seems to have more verifications on other build props, in my case, ro.build.version.release, ro.build.version.incremental to match the ones in fingerprint. The patch I used for OP3 did not patched them (for I have no time to inspect) so I passed SN, get certified, but still cannot search for Netflix. I don't know it's a more strict policy enforced by Netflix or Google but it makes the certification imperfect. Maybe we shall look into this together
Click to expand...
Click to collapse
Hm... I'm wondering. From what I've tested and seen reported, all that is needed is to pass SafetyNet for your device to be certified. On that we're on the same page though.
I've also seen reported (and experienced) that even after getting your device certified in the Play Store, it can take several reboots and/or up to a whole day before the apps that rely on the certification status (Netflix, etc) to show up/install. Could it be that you were simply experiencing a delay when you couldn't install Netflix? It's possible that any other props are part of the new Gapps blocking on uncertified devices, but somehow I don't think so... I will do more research and report back.
And as a side note, about the CTS profile test:
Changing the device fingerprint is only one part of making a device pass. That causes the devices to be recognised as a certified device with trusted software, even if the manufacturer hasn't certified the device or if you've installed a custom ROM (both would normally cause ctsProfile to be false). It will also report false if your bootloader is unlocked or if you've rooted your device, but both of these will be taken care of by MagiskHide. Xposed will of course also cause issues, but for the ctsProfile check this can actually be fooled by the No Device Check Xposed module. It'll still cause a basic integrity failure though, and be detected in other ways.
I'll be back...

Didgeridoohan said:
Hm... I'm wondering. From what I've tested and seen reported, all that is needed is to pass SafetyNet for your device to be certified. On that we're on the same page though.
I've also seen reported (and experienced) that even after getting your device certified in the Play Store, it can take several reboots and/or up to a whole day before the apps that rely on the certification status (Netflix, etc) to show up/install. Could it be that you were simply experiencing a delay when you couldn't install Netflix? It's possible that any other props are part of the new Gapps blocking on uncertified devices, but somehow I don't think so... I will do more research and report back.
And as a side note, about the CTS profile test:
Changing the device fingerprint is only one part of making a device pass. That causes the devices to be recognised as a certified device with trusted software, even if the manufacturer hasn't certified the device or if you've installed a custom ROM (both would normally cause ctsProfile to be false). It will also report false if your bootloader is unlocked or if you've rooted your device, but both of these will be taken care of by MagiskHide. Xposed will of course also cause issues, but for the ctsProfile check this can actually be fooled by the No Device Check Xposed module. It'll still cause a basic integrity failure though, and be detected in other ways.
I'll be back...
Click to expand...
Click to collapse
Thanks for the hint. I do a few tests today. My module seems to be broken today but after added Play Store and `com.google.android.gsf` to MagiskHide list it works again.
And most interestingly, the fingerprint for my Note4 from the ROM seems to be blacklisted by Google.
I wiped data, disabled module, reboot. Device become uncertified and even cannot pass `basic integrity`. wipe-enable-reboot become certified and able to download again.
It's a cat and mouse game after all:angel:
Also I tested for the "delay" you mentioned. After a wiped reboot, tested 2 out of 3 times the Netflix shows in result. However, whether it can start download still depends on the certification status. If uncertified, download will say error after some time. With module enabled, the download succeeded normally. So Netflix is the most timely and accurate way to speak if your device is certified.
For I have not yet used any apps that check SafetyNet status at runtime, maybe I'll check it later.

Profound Thanks For You. Your Module Was Useful To Make A Specified One For My Phone. :good:

After installing this module, I get force close popup in most Google and non Google apps. FYI, I also have Youtube Vanced installed via Magisk module. I uninstalled the module but I still get the same popups. Also, the device remains certified. Is there any way to actually undo everything? From what I can understand, my device should remain uncertified for everything to work.

GeorgePr said:
After installing this module, I get force close popup in most Google and non Google apps. FYI, I also have Youtube Vanced installed via Magisk module. I uninstalled the module but I still get the same popups. Also, the device remains certified. Is there any way to actually undo everything? From what I can understand, my device should remain uncertified for everything to work.
Click to expand...
Click to collapse
This module merely changed some build props, if and only if your device is supported. Theoretically it should not mess other things around. Check your logcat if there's anything worth notice and clear app data if necessary

ttimasdf said:
As said above, to support other device, we need the value of `ro.build.fingerprint` from a stock ROM.
I don't own other devices so I may not have chance to extract it. So we only need some contributions
Click to expand...
Click to collapse
I made a screenshot from my Pixel 8.1 stock - april security patch
Maybe can help for pixel support :good:
Sent from my Google Pixel using XDA Labs

It is working on my Nexus 7 2013 WiFi tablet. Running Flo classic asop 8.1 r28 May 2018 version with Ground Zero Gapps. Did the clear data (clear cache alone didn't work) rebooted and open Playstore, my apps updates and installed tabs show zero item. A few hours later, check again and I get a Certified in Playstore settings.
Thank you, good job! :good:
Also trying on OnePlus One running AEX 8.1 v5.5. currently updates and installed tabs are also zero item. Going to let it be and see if it will populate over time. Under Playstore version build number, nothing under. Before installing Visa module, it say uncertified.
Library tabs on both show my history of apps.

[QUESTION] SafetyNet passed and device certified, but no Netflix on Play Store

Basically what the title says. I know is not a big deal not having Netflix, Mario Run or Mario Kart (maybe more, those are the ones I use) on Play Store, but it is useful for auto updates.
AFAIK this happens when Play Store is not certified or detecting unlocked bootloader. Now, the thing is, I have everything hidden in Magisk, SafetyNet pass on both Magisk and this app:
https://play.google.com/store/apps/details?id=com.scottyab.safetynet.sample
And weirdly enough, they seem to show up from time to time. How exactly does this work? Is it a play store detection thing, or is it some kind of flag on google's database? Because from the web, the apps shows as "not compatible" with my phone (when they don't appear on the phone, when they appear they are compatible on the web as well).
Sometimes I clear the data of play store and play services, but it doesn't seem to work, or seems to work randomly. I also tried clearing google services framework data, and it helped a couple of times, although I don't do that know, it mess up with apps and I learned that the hard way hehe
I'm just trying to figure out the google handling of this, and maybe a permanent solution from there.
I have a Xiaomi Mi 10 Pro with MIUI 12 (xiaomi.eu), Magisk and Xposed (phone's fingerprint is faked from an untouched phone and I can pass all the tests and use GPay, have Widevine L1... so all seems ok execpt for the apps things, which is beginning to bug me.
Thanks in advance.

I managed to get the apps showing on the store by doing these steps:
-Disabling internet connection on the phone
-Wiping play store and play services and rebooting
-Logging out from the device through the google security panel website
-Waiting 30min to 1h.
-Enabling internet again.
Then the apps were compatible again, as I can see on the play store web (not the app).
BUT, after 24h hours, or a bit less actually, they AGAIN appear as NOT COMPATIBLE on the play store web.
I'm trying to figure out why this may happen. Any clues? Thanks!

eXtremeDevil said:
I managed to get the apps showing on the store by doing these steps:
-Disabling internet connection on the phone
-Wiping play store and play services and rebooting
-Logging out from the device through the google security panel website
-Waiting 30min to 1h.
-Enabling internet again.
Then the apps were compatible again, as I can see on the play store web (not the app).
BUT, after 24h hours, or a bit less actually, they AGAIN appear as NOT COMPATIBLE on the play store web.
I'm trying to figure out why this may happen. Any clues? Thanks!
Click to expand...
Click to collapse
Hi, not sure if this answer will solve your problem, I'll post anyway.
I needed an app available only in US on time. So I got a VPN and connected it. But the app still wasn't available. So I force closed the app and cleared the data (only for the play store) and it worked perfectly.
I know you already cleared data. But this time, try those steps, maybe it'll work:
1- Enable Magisk Hide
2- Force Close Play Store
3- Clear only the Play Store Data
4- Launch the Play Store and see if it worked
Hope this will help.
Have a good day

Thanks for the answer, but I think the problem is a bit more complex than that. Yesterday I re-did all my steps again and I got this:
This time I have not turned off my phone since then, and the "compatibility" is maintained. I will try to stay another 24h with my phone on, then I will turn it off on tuesday night and see what happens.
Also, I think this post would be more useful in the Magisk thread, maybe? Could an admin move it there?
Thanks!

@eXtremeDevil
The "incompatible with your device" message is only shown if you open Google Play Store in PC's browser., not if you run Google Play Store on phone: there an incompatible app simply isn't listed.
Your issue has nothing to do with fact that Magisk is installed on your phone.
Download APK from another market. Open it with 7zip or any other unpacker. Look inside extracted file Manifest.xml for any app's restrictions.

jwoegerbauer said:
Your issue has nothing to do with fact that Magisk is installed on your phone.
Click to expand...
Click to collapse
Then where's the issue? Netflix is obviously compatible, is not a "real" incompatibility. Seems to me that google play store or services detect something on the phone then tell google servers to flag those apps as incompatible, therefore they are NOT shown on the phone and listed as "incompatible" on the web.
What I'm trying to do is to prevent this, prevent the phone from detecting whatever it is detecting and prevent my phone services to tell to google services/servers/database/whatever.
Because I can assure you, before rooting/Magisk this did NOT happen. So no, this is not a "real" incompatibility issue. Actually, as you can see on my screenshot, it IS compatible right now xD Who knows how many hours will this time last...

@eXtremeDevil
If your statement "SafetyNet passed and device certified" - what indicates Magisk gets not detected - is actually still true then turn on your mind.

That's the kind of help I'm asking here, AGAIN, my device is FULLY compatible with Netflix or Mario Run. I installed them through Play Store with no issues and I can run them with no issues. BUT for some reason, even passing SafetyNet and being the device certified, sometimes google detects something that makes those apps incompatible, and no, is it not the hardware or the ROM, is a security related issue, only I don't know which one.

OK, so today after 3 or for days without issues (and without rebooting) I rebooted the phone and the problem went back. I wiped both play store and play services data, rebooted three times and so far so good. Let's see what happens.
Could any forum moderators move this thread to the Magisk subforum?
Thanks.

eXtremeDevil said:
OK, so today after 3 or for days without issues (and without rebooting) I rebooted the phone and the problem went back. I wiped both play store and play services data, rebooted three times and so far so good. Let's see what happens.
Could any forum moderators move this thread to the Magisk subforum?
Thanks.
Click to expand...
Click to collapse
Nice to see it worked
(I'll ask the mods for the thread to be moved, if you wanna do that yourself next time just report your thread and select "thread moving")

Raiz said:
Nice to see it worked
(I'll ask the mods for the thread to be moved, if you wanna do that yourself next time just report your thread and select "thread moving")
Click to expand...
Click to collapse
Thanks for the moving trick, I didn't know that
Ask for the problem, is not actually fixed, I still lose those apps from time to time, and I'm still looking for a cause and for a definitive solution

It happened again after 2 or 3 reboots. I suspect the culprit is EdXposed or one of its modules. What I can't understand is why my other phone doesn't have that issue, or my girlfriends phone, that actually has the original Xposed...

I was seeing a similar issue. Without Magisk installed I was able to download Netflix from the Play store without issue. After Magisk installed and pass CTS, going back to play store Netflix app page showed red error msg, "This app isn't compatible with your device anymore. Contact the developers for more info." Force stop Play Store, clearing cache/storage resolved issue.

Curious but did you try setting the Magisk Manager option to hide and rename the manager package? Also if you have either ed/xposed, did you check if installing SudoHide module and hiding Magisk Manager from Play Store turns out different results? Doing the latter will remove Play Store (or any app you hide from Magisk through SudoHide for that matter) from the Magisk hide app list, something to keep in mind in case you need magisk hide enabled for play store, but I'm assuming you don't need to since you tried that already to no avail. Otherwise I'm curious to know if either, both, or neither solves this issue.

mr3p said:
I was seeing a similar issue. Without Magisk installed I was able to download Netflix from the Play store without issue. After Magisk installed and pass CTS, going back to play store Netflix app page showed red error msg, "This app isn't compatible with your device anymore. Contact the developers for more info." Force stop Play Store, clearing cache/storage resolved issue.
Click to expand...
Click to collapse
Yes, that seemst to work. I think I also need to clean Play Services app as well.
mario0318 said:
Curious but did you try setting the Magisk Manager option to hide and rename the manager package? Also if you have either ed/xposed, did you check if installing SudoHide module and hiding Magisk Manager from Play Store turns out different results? Doing the latter will remove Play Store (or any app you hide from Magisk through SudoHide for that matter) from the Magisk hide app list, something to keep in mind in case you need magisk hide enabled for play store, but I'm assuming you don't need to since you tried that already to no avail. Otherwise I'm curious to know if either, both, or neither solves this issue.
Click to expand...
Click to collapse
Tried that, didn't work. And yes, I have the manager renamed to something random.
SafetyNet does not pass 100% of the time, the clear data works but only for a while, I guess there's nothing to be done here...

Safetynet fail

Hello,
today my phone suddenly wrote to me that it is no longer possible to use google pay.
Phone Pixel 5. Stock firmware.
Google pay reports that the device is certified.
I use magical canary 23001. I have the safetynet fix module installed.
Google pay does not work. And magisk reports an error when verifying the safetynet.
Any help please?

Just to say that the same occurred to me on a Oneplus 8 pro: Google Pay says the phone is not safe and Safetynet fails with basicintegrity (-), ctsProfile (-) and evaltype = basic. The cause seems to have been a Google Pay update two days ago (or, more probably, Google Play Services or the like, since I had disabled Google Pay updates). I have universal safetynet fix and magiskhide props config installed. If anyone could help, I'd appreciate. Let me know if I have to post more information. Thanks

UPDATE - A guy on Reddit says he fixed it by uninstalling EdXposed. Actually, I had that module and removed it and now I seem to pass the safetynet test, although Google Pay still has some issues (I will try cleaning data and cache, and possibly do the same to Google Play Services, I am also trying to put Google Services Framework under Magiskhide...). He says LSPosed (instead of EdXposed) should be fine, which it apparently is.

andrearesti said:
UPDATE - A guy on Reddit says he fixed it by uninstalling EdXposed. Actually, I had that module and removed it and now I seem to pass the safetynet test, although Google Pay still has some issues (I will try cleaning data and cache, and possibly do the same to Google Play Services, I am also trying to put Google Services Framework under Magiskhide...). He says LSPosed (instead of EdXposed) should be fine, which it apparently is.
Click to expand...
Click to collapse
Thanks for this update. Was having the same issue on my OP6T. I had already eyed at switching to a different Xposed clone since this keeps occuring every few weeks. Maybe now is a good time as ever.

Great. Thanks you so much.

Did something change wrt G Play-services that breaks Zygisk Denylist?

I am using Google Pixel 6 Pro and my Google Pay stopped working and my Magisk installation was removed, I have no idea what triggered this. After re-installing the canary version of Magisk I noticed the following when configuring my Denylist:
- Google Play-services is now only listed under "Show OS apps". I might be mistaken but before it was under "Show systemapps"?
- Google Play-services is no longer selected after a powercycle
Although safetynet test apps PASS, it is clearly NOT working:
- Can no longer find Netflix app in Google Play store (good indicator certification is not in order)
- Google Pay complains about root detection after adding my card
Appreciate any advise/tips/suggestions

Magisk disappearing is interesting and I don't know what happened there.
No need to add Play services or other system processes to DenyList. Only deny Play Store, Gpay etc. If you deny Play services it'll end up unticked after a reboot which is normal. After a new Magisk installation including safetynet-fix and Props Config modules, clear Play Store cache and storage in Settings/Apps (I do this for Play services too although it may not be necessary). After some brief wait time your Pixel should show as certified in Play Store settings in addition to passing Safetynet.

Everything is working now, I also re-installed the modules. I might have indeed denied to many services, thank you for clarifying only App Store itself and banking apps is sufficiënt! If I lose root again suddenly I will attach ADB logfiles.

straumli said:
I am using Google Pixel 6 Pro and my Google Pay stopped working and my Magisk installation was removed, I have no idea what triggered this. After re-installing the canary version of Magisk I noticed the following when configuring my Denylist:
- Google Play-services is now only listed under "Show OS apps". I might be mistaken but before it was under "Show systemapps"?
- Google Play-services is no longer selected after a powercycle
Although safetynet test apps PASS, it is clearly NOT working:
- Can no longer find Netflix app in Google Play store (good indicator certification is not in order)
- Google Pay complains about root detection after adding my card
Appreciate any advise/tips/suggestions
Click to expand...
Click to collapse
If you have safetynetbfix flashed this is normal as it does it for you and unselects it. If you don't have saftey net fix flashed you can select it and it will stick

Google Wallet rolled out - device now not secure enough!

S21FE here, A12 rooted with Magisk 24.3 for several months. USNF and device is certified in Google Play Store, fully passing YASNAC.
Banking apps and Gpay on the deny list and all worked fine.
Today I get a notification from Google that my device is no longer secure enough for contactless pay. Figured it was because I'd been messing around with screen2auto in the car and rebooting a few times. Checked all other security sensitive apps and they all still worked fine.
Did the usual clearing of cache and data for Pay, Play Store and Play Services and ended up stuck on a screen saying that Google Pay was being updated and couldn't be used.
When I went to uninstall and reinstall, I realised it had been replaced with Google Wallet. Installed it. Added it to deny list, rebooted for good measure before opening but no dice.
Google wallet detects root despite passing SafetyNet and Device Cert.
At least now I'm fairly sure it's due to rollout rather than something dumb I've done, but is anyone else getting this now?
I updated Magisk and manager (which is hidden btw) after first unsuccessful try, then went through clearing caches, data and uninstalling and reinstalling then rebooting again but still no luck.

Yes it's being discussed in the 2 main Google Pay threads already here.

BootloopedMillennials said:
Yes it's being discussed in the 2 main Google Pay threads already here.
Click to expand...
Click to collapse
Yeah I realised shortly after posting! Thanks for replying though.