A biometric payment system checks a body trait, such as your face, fingerprint or palm, and then releases a payment credential that was set up in advance. The biometric itself is not the payment. It is a key that releases a card token, either on your own phone or in a merchant’s enrolled database. That difference decides how private, how accurate and how widely accepted each system is.
Most Americans already use the first kind every day. When you double-click an iPhone and glance at it to pay, Face ID releases a card token stored on the phone, and the store never sees your face. The second kind, where a camera or palm reader at the till recognizes you with no phone at all, has had a harder time. Amazon switched off its Amazon One palm payments for retail in June 2026, citing limited customer adoption.
Two Designs: Biometrics on Your Phone Versus at the Counter
Every biometric payment system answers one question: where does the matching happen? The answer splits the market in two.
| Design | Where your biometric is stored | Matching type | Examples | What the merchant sees |
|---|---|---|---|---|
| Device-based | On your phone or watch, in a secure chip | 1:1 (you against your own template) | Apple Pay with Face ID or Touch ID, Google Wallet with fingerprint | A card token, never your face or finger |
| Merchant or cloud-based | In a provider’s enrolled database | 1:N (your scan against many enrolled people) | Amazon One (retail ended June 2026), PopID with J.P. Morgan Payments, Mastercard Biometric Checkout partners | A match result plus a stored card token |
In the device design, the phone already knows who should be holding it. It compares your face with one stored template, the one you enrolled. In the counter design, the terminal does not know who you are. It must search a database of enrolled customers and pick the right one. That second job is far harder, and the math further down shows why.
What Happens in the Two Seconds at the Terminal
The steps below follow the device design, which covers almost all biometric payments in the US today.
- Enrollment: you scan your face or finger on the phone. The phone turns the scan into a mathematical template and keeps it in its security chip. You also add a card, and your bank swaps the card number for a device token.
- Tap: at checkout you hold the phone near the reader. The terminal asks for payment.
- Biometric check: the phone compares the live scan with your stored template. If they match, the security chip lets the token be used.
- Token and cryptogram: the phone sends the token and a one-time code to the terminal. The real card number never travels.
- Authorization: the card network maps the token back to your account, and your bank approves or declines, as with any card payment.
The counter design adds a database search in step three. Mastercard’s Biometric Checkout Program follows this flow: you enroll your card and your face or palm in a store or through an app, a camera or reader captures you at checkout, and the system compares the capture against enrolled users. After a match, the merchant charges a tokenized credential and the issuer approves it as normal.
How Accurate Is Face or Fingerprint Payment
Apple publishes its error rates, which makes it a useful benchmark. Apple says the chance that a random person can open a device is less than 1 in 50,000 for Touch ID and less than 1 in 1,000,000 for Face ID. Enrolling more traits raises the odds. With five fingerprints, Touch ID’s figure becomes up to 1 in 10,000. With two Face ID appearances, it becomes up to 1 in 500,000.
There are two limits that matter for payments, and a few rules about when the passcode takes over. Face ID errors are more likely with twins, look-alike siblings and children under 13. And after five failed matches, the device demands the passcode. That cap is what turns a small per-try risk into a fixed, tiny total risk.
When the Passcode Takes Over from Your Face
Biometrics are a convenience layer on top of the passcode, not a replacement for it. There are set moments when an iPhone or iPad ignores Face ID or Touch ID and asks for the code. These include right after a restart, when the device has not been opened for more than 48 hours, after a remote lock command, and after five failed biometric tries. The passcode is also required when it has not been used for 156 hours and biometrics have not been used for four hours.
Those rules matter for payments in a quiet way. A stolen phone does not stay open to endless face attempts, because the device soon falls back to the passcode. Apple’s newer Optic ID, used on Apple Vision Pro, carries the same published odds as Face ID, less than 1 in 1,000,000 for a single enrollment.
Our Calculation: Odds Across Five Tries
A thief gets five tries before the passcode lock. The chance that at least one try succeeds is 1 minus the chance that all five fail, or 1 – (1 – p)^5. We ran that formula on Apple’s published rates and on random passcode guesses for comparison.
| Sign-in method | Per-try chance (Apple’s upper bound) | Chance within 5 tries | Per million strangers |
|---|---|---|---|
| Face ID, one appearance | 1 in 1,000,000 | 0.0005% | About 5 |
| 6-digit passcode, random guess | 1 in 1,000,000 | 0.0005% | About 5 |
| Face ID, two appearances | 1 in 500,000 | 0.0010% | About 10 |
| Touch ID, one finger | 1 in 50,000 | 0.0100% | About 100 |
| Touch ID, five fingers | 1 in 10,000 | 0.0500% | About 500 |
| 4-digit passcode, random guess | 1 in 10,000 | 0.0500% | About 500 |
The passcode rows assume a random code. Real people pick birthdays and 1234, so a real passcode is often weaker than the table shows. The comparison holds anyway: a single-face Face ID setup is about as strong against a stranger as a fully random six-digit code. Touch ID with five enrolled fingers is in the same range as a random four-digit PIN. If you want to rerun the odds with other numbers, our percentage calculator handles the conversions.
Why Pay-by-Face and Palm Terminals Face Harder Math
A counter terminal does not compare you with one template. It compares you with everyone enrolled. Each comparison carries a small false match rate, and the chances add up as the database grows.
We modeled this with a simple formula. If each comparison has a false match rate of r, the chance that a scan wrongly matches at least one of N other enrolled people is 1 – (1 – r)^N. The rates below are illustrative inputs, not any vendor’s published figure.
| Enrolled customers (N) | Chance of at least one false match at r = 1 in 1 million | At r = 1 in 1 billion |
|---|---|---|
| 10,000 | 1.0% | 0.001% |
| 100,000 | 9.5% | 0.01% |
| 1,000,000 | 63.2% | 0.1% |
The lesson is plain. A matcher that is excellent for opening one phone would be unusable at a national checkout network. Counter systems need far lower error rates per comparison, or they shrink the search. Common ways to shrink it include asking for a phone number first, limiting the search to customers enrolled at one venue, or adding a second check. Each fix adds a step, and each step eats into the speed that made pay-by-face appealing.
Biometric Payment Systems in Use and What Happened to Them
Apple Pay, Google Wallet and Card-Based Biometrics
Phone wallets are the success story because they piggyback on hardware people already own. The biometric releases a token, the merchant keeps its normal card terminal, and the bank sees a standard tokenized card payment. Nobody had to enroll in a new database. That is why device biometrics took over while counter biometrics struggled.
Amazon One
Amazon One let shoppers pay by holding a palm over a reader at Whole Foods, Amazon stores and some venues. On January 27, 2026, Amazon said it would end Amazon One palm payments, which stayed available until June 3, 2026. The company cited limited customer adoption and said all customer data tied to the service would be securely deleted after it ended. Palm check-in at existing healthcare sites continued. The same announcement covered the closure of all 72 Amazon Go and Amazon Fresh stores in the US.
The lesson for other providers is about habit, not hardware. The palm reader worked, but shoppers already had a phone in hand, and a second enrollment offered little extra speed.
PopID and J.P. Morgan Payments
J.P. Morgan Payments offers in-store face payments to merchants. The bank expanded its partnership with PopID and debuted the service with South Florida Motorsports, organizer of the Miami Grand Prix, in May 2024. It named Whataburger as a national chain planning to extend biometric payments. J.P. Morgan says a 2023 proof of concept had transactions averaging under a second. That figure comes from the bank’s own study, so treat it as a company claim.
Mastercard Biometric Checkout Program
Mastercard launched its program in May 2022, starting with a pilot in Brazil. It works as a rulebook for providers rather than as a product Mastercard runs. Providers must pass accreditation, which includes security testing, biometric performance testing and PCI DSS compliance, and must follow privacy-by-design rules. Mastercard says it does not collect or process personal data in the program.
Privacy Law: What Merchants Must Do Before Scanning a Face
Device payments keep biometrics on the customer’s phone, so the merchant never handles them. Counter systems are different. The merchant or its provider collects biometric data, and several US laws apply.
Illinois has the strictest rules through its Biometric Information Privacy Act, known as BIPA. Before collecting a face scan or palm print, a business must tell the person in writing what it collects, why and for how long, and get a written release. It must also publish a retention schedule and a policy for destroying the data. Damages run up to $1,000 for each negligent violation and up to $5,000 for each intentional or reckless one, plus legal fees.
Those damages once multiplied with every scan. On August 2, 2024, Illinois signed SB 2979, which says repeated collection of the same biometric from the same person by the same method counts as a single violation. It also allowed consent by electronic signature. By April 2026 the Seventh Circuit had held that the amendment applies to pending cases.
For a small merchant, the practical rule is simple. Use a provider that handles consent, storage and deletion for you, get its compliance terms in writing, and ask where templates are stored. If customers can pay by phone instead, that path keeps you out of biometric storage entirely. Our small business cybersecurity checklist covers the vendor questions that apply to any provider holding customer data.
Spoofing, Liveness Checks and Fraud Risk
Biometric fraud rarely means a perfect copy of someone’s face. It usually means tricking the capture step with a photo, a mask or a replayed video. Systems fight this with liveness checks, which look for signs of a real, present person, such as depth, skin texture or small movements. Phone sensors such as Face ID’s depth camera are hard to fool with a flat photo, which is one reason device payments have a good record.
Counter systems and online identity checks face a newer threat: deepfake video. FinCEN warned banks in November 2024 that criminals were using AI-made images and video to beat identity checks, and it listed red flags such as webcam plug-ins during live verification. Our guide to deepfake detection software explains the tools banks use to screen that kind of media.
The other weak spot is the account around the biometric. If a criminal resets your wallet account through a phishing message, the biometric is no longer the barrier. Stronger sign-in helps there, as covered in our look at passwordless authentication software.
Choosing a Biometric Payment Option as a Merchant
For most US merchants, the decision is easier than vendor marketing suggests.
- Accept phone wallets first: any contactless terminal already takes Apple Pay and Google Wallet, so you get biometric security with no new hardware and no biometric data to store.
- Consider pay-by-face only for closed venues: stadiums, campuses and event sites with repeat visitors can keep the enrolled group small, which helps the matching math.
- Ask for accreditation: if a provider says it works with Mastercard’s program, ask for proof of its accreditation and its PCI DSS status.
- Plan for opt-in: some customers will never enroll, so keep normal card lanes fast.
- Watch the exit terms: Amazon One’s shutdown shows that a provider can leave. Ask how your customers’ data will be deleted if that happens.
If you run a mobile food business, our review of POS systems for food trucks lists terminals that take tap-to-pay wallets out of the box.
Common Questions About Paying with Your Face or Fingerprint
Is Paying with Face ID Safer Than Using a Card?
For theft of the card number, yes. The store receives a token and a one-time code, not your card number, and the payment needs your face or passcode. Apple says Face ID’s random-match odds are less than 1 in 1,000,000 per try.
Does the Store Get a Copy of My Face When I Use Apple Pay?
No. In device payments the face template stays in the phone’s security chip. The store’s terminal receives only payment data.
Why Did Amazon Stop Palm Payments?
Amazon cited limited customer adoption. Palm payments for retail ended on June 3, 2026, and Amazon said it would delete the related customer data.
Can Someone Use a Photo of Me to Pay?
Modern systems use liveness checks to reject photos, and phone depth sensors are hard to fool with a flat image. No system is perfect, which is why phones fall back to a passcode after five failed tries.
Which States Regulate Biometric Data?
Illinois is the best-known example through BIPA, which requires written notice, a written release and a public retention policy before a business collects biometrics.
This article is for information and education only and is not legal, financial or security advice.
