Biometric Payments: How Face and Palm Scanning Replace Cards

Biometric payments let shoppers authenticate a transaction with their face, palm, or iris instead of swiping a card or tapping a phone. The idea is not new: fingerprint sensors have guarded mobile wallets since Apple introduced Touch ID in 2013. What has changed is the venue. Retailers, banks, and card networks are now deploying biometric readers at the point of sale itself, turning a customer's body into their payment credential.

Amazon One has reached over 400 U.S. locations and is expanding palm checkout to all 500+ Whole Foods stores. Mastercard has launched a Biometric Checkout Program with pilots across Brazil, and JPMorgan Payments has tested face and palm authentication with retailers and food-service providers. In China, Alipay's "Smile to Pay" system has been live at physical stores since 2017, and the company now offers a PL1 palm terminal with a reported false acceptance rate of less than one in a million.

How Biometric Payment Systems Work

Every biometric checkout system follows the same four-stage pipeline: capture, liveness check, template extraction, and match. The differences lie in which modality the system reads (palm vein, face, iris) and where the resulting template is stored.

Sensor Hardware

Palm vein scanners, such as the ones in Amazon One terminals, emit near-infrared light and capture the pattern of blood vessels beneath the skin. Because vein patterns sit under the surface, they are harder to photograph or replicate than a fingerprint. Facial recognition terminals typically combine an RGB camera with a structured-light or time-of-flight depth sensor to build a 3D map of the face. Iris scanners use near-infrared illumination to photograph the colored ring around the pupil, capturing patterns that remain stable across a person's lifetime.

Liveness Detection

A biometric reader that cannot distinguish a living person from a printed photo or silicone mold is useless for payments. Liveness detection addresses this with two broad approaches. Active liveness prompts the user to perform an unpredictable action: blink, turn their head, or speak a random phrase. Passive liveness analyzes the captured data without user interaction, checking for depth, texture, or blood flow signals that a spoof would lack. Palm vein systems have a natural advantage here: the scanner can only read a vein pattern when blood is actively flowing, which means a silicone replica or 3D-printed hand will not produce a valid image.

Deepfake risk: As synthetic media improves, liveness detection must keep pace. Vendors now layer multiple checks: depth mapping, micro-texture analysis, and infrared reflectance patterns that differ between living skin and synthetic materials. The arms race between spoofing and detection is ongoing.

Template Storage and Matching

After the sensor captures raw biometric data, the system extracts a mathematical template: a compact representation of features such as vein bifurcation points, facial geometry ratios, or iris texture codes. The raw image is discarded. The template is then compared against enrolled records using a matching algorithm, and the transaction proceeds if the similarity score exceeds a configurable threshold.

Where that template lives matters enormously for privacy. Three storage models dominate:

• On-device storage keeps the template on the sensor or the user's phone, never transmitting it. Apple Face ID and most passkey implementations use this model.
• Cloud storage sends an encrypted template to a server for matching. Amazon One and Mastercard's Biometric Checkout Program use cloud-side matching, which allows enrollment at one terminal and authentication at any other.
• Hybrid approaches store an encrypted template on a card or token and perform matching at the terminal without a network round-trip. Fujitsu's PalmSecure technology supports this model using encrypted templates that can be matched without decryption.

Who Is Building Biometric Checkout

The biometric payments landscape spans retailers, card networks, banks, and fintech companies. Each approaches the problem from a different angle.

Amazon One

Amazon's palm-scanning system launched in 2020 at Amazon Go stores and has since expanded to Whole Foods, Panera Bread, select airports (through Hudson, CREWS, and OHM retailers), and sports stadiums. The system uses near-infrared imaging to read palm vein patterns and palm-line geometry. Customers enroll by scanning their palm at a terminal and linking it to a credit card or Amazon account. Checkout then requires only a hand hover over the reader: no card, phone, or PIN.

Mastercard Biometric Checkout Program

Mastercard's program provides a standards framework rather than its own hardware. Banks, merchants, and technology providers build on Mastercard's specifications for security, data handling, and user consent. The first pilot launched in Brazil with Payface across five St. Marche supermarkets in Sao Paulo, where shoppers enroll via the Payface app and authenticate with a smile at the terminal. Technology partners include NEC, Fujitsu, PopID, and PayByFace. Mastercard has indicated plans to expand pilots across the UK, Asia, Africa, and Latin America.

JPMorgan Payments

JPMorgan began piloting palm and face authentication at U.S. merchants in 2023, working with biometrics company PopID. The pilot ran at retail locations and an internal Aramark-operated cafeteria. The system allows consumers to link payment credentials from multiple issuers, not just JPMorgan cards, to their biometric enrollment.

Alipay and WeChat Pay

China has been the most aggressive market for biometric checkout. Alipay deployed its "Smile to Pay" facial recognition system at a KFC KPRO restaurant in Hangzhou in 2017 and later subsidized merchants to install face-scanning terminals. The system pairs facial recognition with a phone number confirmation. More recently, Alipay launched the PL1 palm payment terminal. WeChat Pay invested heavily in similar face-payment hardware, though early reports indicated slower-than-expected consumer adoption despite promotion.

Consumer Adoption and Sentiment by Region

Willingness to use biometric payments varies sharply by geography, age, and how much trust consumers place in the entity storing their data. Javelin Strategy & Research's Emerging Payments Survey 2026 found that 8% of U.S. respondents already use biometric authentication at a payment terminal, 45% said they were likely or very likely to do so, and 31% said they were unlikely or very unlikely. A separate survey of 2,001 Americans by Handwave and Censuswide (March 2026) found that 48% would use palm payments regularly if they trusted the data handling, with sharp age splits: 46% of 25-to-34-year-olds trust biometrics as a payment method compared with 28% of those over 55.

China moved earliest but hit friction. Alipay and WeChat Pay subsidized face-payment terminals for merchants, yet a Mintel survey found that while nearly two-thirds of Chinese online shoppers were open to using biometric data for payment, in-store face-pay adoption lagged behind QR code scanning, which remains the dominant payment method in China. The extra step of entering a phone number or PIN after the face scan reduced the convenience advantage.

Availability, not reluctance: Javelin's 2026 report argues that the biggest constraint on biometric payment adoption is terminal availability, not consumer willingness. Most shoppers have never encountered a biometric checkout option. Where the hardware exists, usage rates climb.

Biometrics vs Other Authentication Methods

Biometric checkout competes with several existing authentication mechanisms, each with distinct security and usability profiles. The choice between them involves tradeoffs around phishing resistance, revocability, and friction at the point of sale.

A PIN is simple, revocable, and universally supported, but it can be shoulder-surfed or guessed. Passwords offer more entropy but are rarely used at physical checkout. Device-bound passkeys, built on the FIDO2 standard, pair a cryptographic key with a biometric unlock (fingerprint or face) on the user's device. The biometric never leaves the phone, and the authentication is phishing-resistant because the key is bound to a specific origin. Standalone biometric checkout (the systems described in this article) removes the device entirely: the body is the credential.

The critical difference between passkeys and standalone biometric checkout is where the biometric is used. Passkeys use the biometric locally to unlock a cryptographic key: the server never sees the fingerprint or face scan. Biometric checkout systems capture and match the biometric on the merchant's or provider's infrastructure. This distinction has significant strong customer authentication implications under regulations like PSD2, which require at least two independent authentication factors.

Privacy and Regulatory Landscape

Biometric data occupies a uniquely sensitive category because it cannot be changed. A compromised password can be reset; a leaked palm-vein template cannot be un-leaked. This permanence has driven regulators to treat biometric data differently from other personal information.

Illinois BIPA

The Illinois Biometric Information Privacy Act, enacted in 2008, remains the strongest U.S. biometric privacy law. It requires companies to obtain informed, written consent before collecting biometric identifiers, publish a retention and destruction schedule, and refrain from selling or profiting from the data. Crucially, BIPA provides a private right of action: affected individuals can sue for statutory damages of $1,000 per negligent violation or $5,000 per intentional violation. Texas and Washington have enacted similar laws, but without the private right of action that gives BIPA its enforcement teeth.

GDPR and EU Regulation

Under the EU's General Data Protection Regulation, biometric data used for identification is classified as a "special category" of personal data under Article 9, requiring explicit consent or another specific legal basis for processing. The GDPR does not specifically address liveness detection, but regulators have interpreted the general data protection principles to apply. Ireland's Data Protection Commission opened an inquiry into Ryanair's biometric customer-verification process, and German, Spanish, and Portuguese regulators took action against Tools for Humanity's iris-scanning Orb over GDPR compliance concerns.

Emerging State and National Laws

The regulatory landscape is fragmenting. Beyond Illinois, Texas, and Washington, more than a dozen U.S. states have introduced biometric privacy bills. No federal biometric privacy law exists in the United States. In Asia, China's Personal Information Protection Law (PIPL) classifies biometric data as sensitive personal information requiring separate consent. India's Digital Personal Data Protection Act similarly requires explicit consent for biometric processing outside government programs.

The irrevocability problem: Privacy advocates point out that biometric payment systems create a permanent link between a person's physical body and their financial identity. A password can be changed, a card can be reissued, but a palm print or iris pattern is fixed for life. If a stored template is breached, the affected user cannot simply enroll new biometrics.

Biometrics and Self-Custodial Wallets

The intersection of biometric authentication and self-custodial cryptocurrency wallets is where the technology could have its most transformative impact. Today, securing a self-custodial wallet means managing a seed phrase: twelve or twenty-four words that serve as the ultimate backup key. Seed phrases are powerful but fragile. Users lose them, store them insecurely, or fall victim to phishing attacks that trick them into revealing the words.

Biometric authentication offers an alternative path. Rather than asking users to memorize or store a phrase, a wallet can use device-bound biometrics (via passkeys or secure enclaves) to protect the signing key. The user's face or fingerprint unlocks the key locally: the biometric never leaves the device, and the private key never leaves the secure element. This model preserves self-custody while dramatically reducing the UX burden. Projects like passkey-based Bitcoin wallets are already exploring this design pattern.

Platforms like Spark are well-positioned for this shift. Spark's architecture supports instant, self-custodial Bitcoin and stablecoin transfers without on-chain transactions. Pairing that with biometric-protected signing (where the user's face or fingerprint unlocks their key share in a threshold signature scheme) could make everyday Bitcoin payments as simple as a palm hover at a terminal, without sacrificing custody. The convergence of biometric UX and digital identity infrastructure is accelerating this possibility.

What Comes Next

The biometric payment market was valued at approximately $13.7 billion in 2026, with projections reaching $25 billion by 2030 at a compound annual growth rate around 17%, according to The Business Research Company. But market size forecasts mask the real question: will consumers accept a payment method that requires surrendering biometric data to a third party?

Three trends will shape the answer:

• Terminal proliferation matters more than consumer surveys. Javelin's research suggests that availability, not willingness, is the primary adoption bottleneck. As Amazon expands palm checkout to all Whole Foods locations and Mastercard's framework reaches more markets, trial rates should climb.
• On-device matching may resolve the privacy impasse. If biometric templates stay on the user's device (as passkeys already do) rather than in a cloud database, the regulatory and consumer-trust barriers drop significantly. Hybrid models that perform matching at the terminal without transmitting raw data are a middle ground worth watching.
• Crypto wallets could leapfrog traditional payments. While card networks and banks retrofit biometrics onto existing payment rails, self-custodial wallet builders can design biometric authentication natively. A wallet like General Bread, built on Spark, could integrate passkey-based biometric signing from the ground up, rather than bolting it onto a decades-old card network infrastructure.

The technology works. The privacy frameworks are catching up. The open question is whether the industry converges on a model where the user retains control of their biometric data, or whether convenience wins at the cost of handing palm prints and face maps to centralized databases. For deeper analysis of how digital identity and payment systems are merging, see our coverage of fintech digital identity convergence and the evolution of payment tokenization.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.