Biometric payment
What is biometric payment?
Biometric payment is a transaction authorized by a physical identifier such as a fingerprint, face, iris, voice, palm vein, or heart rhythm, rather than by a password, PIN, or signature. A fresh scan is matched against a stored template, and the match result releases the credential that completes the payment.
The identifier itself never reaches the merchant or the . Enrollment converts the scan into a mathematical template and the original image is discarded, so what travels to the is a cryptographic confirmation that a match occurred, not the fingerprint or the face.
Biometric payment names the transaction; names the identity check inside it. The same fingerprint scan can unlock a phone or approve a purchase, and it becomes a biometric payment only when it authorizes a movement of funds.
Key facts
- Also known as: biometric transaction, biometric-enabled payment
- Identifier types: fingerprint, face, iris, voice, palm vein
- What is stored: a mathematical template, not the original scan or image
- Authentication factor: inherence, or "something you are". Under rules in the EEA, an inherence factor paired with possession or knowledge satisfies the two-factor requirement, which is why a wallet payment confirmed by fingerprint counts as authenticated.
- Typical carriers: smartphones and wearables, biometric payment cards with an on-card sensor, in-store palm and face readers
How it works
- Enrollment. The registers a fingerprint, face, or other identifier on a device or with a provider. The scan is converted into a template and the source image is discarded.
- Capture at checkout. At payment, a sensor takes a fresh scan through a phone camera, a fingerprint reader, or an in-store scanner.
- Matching. The new scan is compared against the stored template. In device-based methods this comparison runs inside the device's secure hardware and the biometric data never leaves it.
- Credential release. A successful match unlocks the stored payment credential, usually a network token created through rather than the raw card number.
- Authorization. The token and the authentication result travel to the issuer as a normal request. The issuer approves or declines on its usual risk criteria, with the biometric result raising the confidence attached to the request.
Types of biometric payment
- Digital fingerprinting: a scanner captures the cardholder's fingerprint, the original image is discarded, and a fingerprint map is retained for comparison against later scans. Fingerprinting is the prevailing biometric method and is compatible with most mobile devices and mobile payment platforms such as Apple Pay and Samsung Pay. Card networks also issue biometric-enabled cards with the sensor built into the card body.
- Facial recognition: maps numerous distinct points on the cardholder's face into a unique representation of the individual without storing an image of the face. Adoption widened after Face ID shipped on the iPhone X in late 2017.
- Voice recognition: compares the cardholder's voice pattern against a pre-recorded sample. Voice is less distinctive than a face or a fingerprint, but it's affordable and non-intrusive, and more computers ship with a built-in microphone than with a fingerprint scanner.
- Iris scanning: the pattern of the human iris is unique in the same way a fingerprint is, and it's highly accurate at close range. The cameras on most modern smartphones can map the iris without dedicated hardware.
- Palm vein mapping: infrared light maps the distinct vein structure inside the palm and converts it into an code. Deployment is narrower than fingerprint or face because it depends on a dedicated reader rather than hardware the cardholder already carries.
Why it matters
- A stolen password works from anywhere, while a template bound to specific hardware does not, which closes the credential-stuffing route into a saved card.
- The biometric check replaces manual entry of the card number and at checkout, so a device-based payment completes in one gesture instead of a form.
- Biometrics satisfy the inherence factor under strong customer authentication, so a wallet payment can meet the EEA requirement inside the wallet rather than sending the cardholder into a separate .
- When the biometric check answers a challenge, a successful authentication moves fraud liability from the merchant to the issuer under the .
