Android pay how does it work?

My biggest question is that does it require a passcode or fingerprint to be used?

If you lost your phone could someone use Android pay to purchase items?