Biometric Payments UK: Face ID, Fingerprints, Wallets & Passkeys

Millions of customers already authenticate payments using their face or fingerprint.

But that does not necessarily mean the merchant is receiving, processing or storing biometric information.

This is one of the most important distinctions when discussing biometric payments.

In most everyday payment journeys, biometrics are used to confirm that the person using a device is authorised to make the payment.

The actual transaction is still processed through:

• a digital wallet;
• payment gateway;
• merchant account;
• acquirer;
• card network;
• bank-payment infrastructure; or
• another payment rail.

For example, a customer might authenticate Apple Pay using Face ID.

The merchant does not normally receive a photograph of their face.

Instead:

That is very different from a merchant installing its own camera or fingerprint scanner and using biometric recognition to identify customers directly.

What Are Biometric Payments?

Biometric payments use a person's physical, physiological or behavioural characteristics as part of the process of authenticating or identifying them before a payment is authorised.

Examples can include:

• fingerprint recognition;
• facial recognition;
• iris or eye recognition;
• voice recognition;
• behavioural characteristics; and
• other biometric authentication methods.

However, it is more accurate to describe many everyday examples as biometric-authenticated payments.

The biometric is proving:

“This appears to be the authorised person using this device or credential.”

It is not replacing the merchant account or payment network.

Biometric Authentication Is Not a Payment Method

This distinction is particularly important for merchants.

Apple Pay is a payment method or digital-wallet environment.

Face ID is an authentication method.

Likewise:

Google Wallet = payment wallet

Fingerprint / supported facial authentication / device credential = authentication

The merchant therefore does not normally need a special “biometric merchant account”.

Instead, the business needs a payment provider that supports the relevant wallet or authentication flow.

This is why the practical merchant question is usually:

“Does my gateway or card machine support Apple Pay, Google Wallet and modern authentication?”

rather than:

“Which merchant account stores fingerprints?”

How Do Biometric Payments Work?

The exact payment journey depends on the technology being used.

There are two very different models.

1. Device-based biometric authentication

This is the model most merchants already encounter.

The customer's smartphone, watch, computer or other trusted device performs the biometric authentication.

A typical flow might be:

Customer chooses Apple Pay → device requests Face ID → customer authenticates → payment credential is released → payment is processed

The merchant does not need access to the underlying facial biometric.

2. Merchant or platform biometric recognition

A more specialised system might allow customers to identify themselves directly through:

• a face scan;
• fingerprint;
• palm;
• voice; or
• another biometric characteristic.

The recognition system may then connect the customer identity to a payment credential or stored account.

This is a significantly different model because the merchant, platform or specialist provider may itself be involved in collecting or processing biometric data.

The privacy, security and data-protection implications are therefore considerably greater.

How Does Apple Pay Use Biometrics?

Apple Pay can use Face ID, Touch ID or other supported device authentication to confirm that the user intends to make a payment.

Apple's current security documentation explains that payment information is not released until the customer has authorised the transaction using an approved method.

Depending on the Apple device, this can include:

• Face ID;
• Touch ID;
• Optic ID;
• device passcode or password; or
• authorisation through an unlocked Apple Watch.

Apple Pay also uses tokenisation rather than simply passing the customer's underlying physical-card number to the merchant.

Apple states that an Apple Pay transaction uses a device-specific payment number and transaction-specific security information rather than sending the actual payment-card number to the merchant.

For merchants, that means Apple Pay combines several relevant technologies:

Our Apple Pay guide for merchants explains the wider acceptance requirements.

Does a Merchant Receive the Customer's Face ID or Fingerprint?

Not when simply accepting a normal Apple Pay transaction.

The customer's Face ID or fingerprint is used within the customer's device authentication process.

The merchant receives the information required to process the payment rather than the customer's raw biometric template.

This distinction is commercially important because it means a retailer accepting Apple Pay is not automatically operating a facial-recognition database simply because the customer uses Face ID to authorise payment.

The same broad principle applies to many device-based biometric wallet journeys: authentication happens in the device or authentication environment rather than the merchant collecting the customer's fingerprint or face itself.

How Does Google Wallet Use Biometrics?

Google Wallet also uses device verification before supported payments can be made.

Google's current Wallet guidance says users need a screen lock and must verify themselves for payments.

Depending on the device, supported verification can include:

• PIN;
• pattern;
• password; or
• qualifying biometric unlock.

Google distinguishes between different classes of biometric security and does not permit every type of biometric unlock to approve Google Wallet payments.

This is useful for merchants because it highlights another important principle:

“Uses biometrics” does not automatically mean “meets the security requirement for payments.”

The wallet, operating system and payment provider determine which authentication methods are acceptable.

See our Google Pay guide for merchants for wider acceptance information.

Biometrics and Strong Customer Authentication

Biometric authentication is also relevant to the UK's Strong Customer Authentication requirements.

Strong Customer Authentication is based on authentication using two or more independent elements drawn from categories including:

• knowledge – something the customer knows;
• possession – something the customer possesses; and
• inherence – something inherent to the customer.

Biometric characteristics can form part of the inherence category.

A mobile device can potentially provide the possession element, while a fingerprint or facial characteristic can contribute an inherence element.

This is one reason device-based payment authentication has become so important to modern ecommerce and digital wallets.

However, merchants should not attempt to determine their own SCA compliance simply by adding a fingerprint button.

The payment provider, issuer, gateway and authentication technology all play roles within the SCA process.

Biometrics and 3D Secure

Biometric authentication can also appear within online card-payment authentication.

EMV 3-D Secure allows merchants, payment providers and card issuers to exchange transaction and device information to help authenticate ecommerce payments.

Many transactions can be assessed without requiring a highly visible customer challenge.

Where additional authentication is required, the issuer may use methods including:

• one-time codes;
• bank-app approval;
• knowledge-based authentication;
• biometric authentication; or
• other supported security methods.

The merchant therefore does not necessarily control the exact authentication method the customer's bank chooses.

The more relevant merchant questions are:

• Does the gateway support current 3D Secure?
• Does the checkout handle authentication cleanly?
• Can customers return to checkout after authentication?
• Can the business measure authentication failures?
• Are soft declines requiring authentication recovered correctly?

These issues also connect directly with checkout abandonment and payment conversion.

What Are Passkeys and What Do They Have to Do With Payments?

Passkeys are another important development in authentication.

They are not themselves a payment method.

A passkey replaces traditional password-based authentication with cryptographic credentials associated with the user's device or account.

The user can normally approve the authentication using the same method they use to unlock their device, such as:

• fingerprint;
• face recognition;
• device PIN; or
• another approved local authentication method.

The FIDO Alliance describes passkeys as phishing-resistant because the credential is cryptographically tied to the relevant website or application rather than relying on a password the customer can accidentally disclose.

For payments, passkeys are relevant in several areas.

Customer login

A customer may sign into an ecommerce or account environment without entering a password.

Issuer authentication

Card issuers can potentially use FIDO-based credentials within payment authentication journeys.

Checkout authentication

Merchants, wallets and payment service providers can increasingly use passkey-style authentication to prove customer presence or intent without relying entirely on passwords or SMS one-time codes.

For larger merchants, this means the future payment stack may combine:

tokenisation + wallets + passkeys + device authentication + 3D Secure + risk analysis

rather than treating biometrics as a standalone payment technology.

Biometric Authentication vs Passkeys

They are related, but they are not the same thing.

A customer could therefore use a biometric to unlock a passkey which is then used within an authentication journey connected to a payment.

The technologies complement one another rather than replacing one another.

What Are the Advantages of Biometric-Authenticated Payments?

Faster customer authentication

Customers may be able to approve a transaction with a face or fingerprint rather than remembering and entering another password.

Reduced dependence on passwords

Passwords can be forgotten, reused or stolen.

Device-based biometric authentication can reduce dependence on passwords during the customer journey.

Potentially lower checkout friction

Wallets such as Apple Pay can reduce the amount of information customers need to enter manually, particularly on mobile devices.

Biometric authentication can then help approve the payment without adding another separate credential.

Tokenisation

Wallet-based payments can combine authentication with tokenised payment credentials, reducing the need for the merchant to handle the customer's underlying card number in the same way as manual card entry.

Better mobile payment journeys

A phone already contains:

• the wallet;
• authentication capability;
• device security; and
• customer interaction.

This can make the mobile payment journey considerably simpler.

Useful within modern authentication frameworks

Biometrics can form part of Strong Customer Authentication and other modern payment-security mechanisms where implemented correctly.

Do Biometric Payments Reduce Fraud?

They can strengthen payment authentication, but merchants should avoid assuming biometrics eliminate fraud.

Fraud can occur at many stages of the payment journey, including:

• account takeover;
• stolen devices;
• social engineering;
• merchant fraud;
• first-party misuse;
• refund abuse;
• identity fraud;
• compromised credentials; and
• other forms of payment abuse.

Apple, for example, combines device authentication with tokenised payment credentials and transaction-specific security information.

That creates several security layers.

But the merchant still needs appropriate:

• fraud controls;
• chargeback processes;
• account security;
• transaction monitoring; and
• payment-provider configuration.

Biometric authentication is therefore one security control within a larger payment system.

What Are the Disadvantages of Biometric Payments?

Biometric authentication can fail

Fingerprints may not read correctly.

Faces may not be recognised.

Devices can be damaged.

Customers may be unable or unwilling to use biometric authentication.

A payment journey therefore needs appropriate fallback options.

Not every customer wants to use biometrics

Some customers prefer a PIN, passcode or another authentication method.

The FCA has also emphasised that payment authentication should work for different groups of consumers and should not rely solely on smartphones where appropriate alternatives are needed.

Compatibility varies

Different devices, operating systems, wallets and providers support different authentication capabilities.

Authentication does not guarantee authorisation

A customer can successfully prove their identity and still have the underlying payment declined.

Authentication and payment authorisation are different stages.

Direct biometric systems create substantial privacy responsibilities

If the merchant itself collects biometric information for identification, the legal and security implications are much greater than simply accepting Apple Pay or Google Wallet.

What Happens if Face ID or a Fingerprint Doesn't Work?

Modern wallet authentication generally includes another permitted authentication route.

Apple, for example, supports device passcodes or passwords where biometric authentication is unavailable or unsuccessful.

Google Wallet similarly supports approved PIN, pattern, password or qualifying biometric verification depending on the device.

From the merchant's perspective, this means the business should not design checkout assuming:

“The customer must successfully use their fingerprint or the transaction fails.”

The wallet or device manages the customer's available authentication methods.

Does a Merchant Need Special Hardware for Biometric Payments?

Usually not where the business is simply accepting a biometric-authenticated digital wallet.

In-store

A compatible contactless card machine can accept supported digital-wallet transactions.

The customer's biometric authentication happens on their device.

Online

The merchant needs an ecommerce gateway or payment integration that supports the required wallet.

In-app

The merchant's application and payment provider need the appropriate wallet and API integration.

The business normally does not need to buy a facial-recognition camera or fingerprint reader simply to accept Apple Pay or Google Wallet.

Biometric Wallet Payments vs Direct Biometric Payments

These models should not be confused.

The final row is where businesses need considerably more caution.

Biometric Payments and UK GDPR

Biometric data can receive additional protection under UK data-protection law.

The Information Commissioner's Office explains that biometric data used for the purpose of uniquely identifying a natural person is special category data.

Examples can include biometric information created from:

• facial recognition;
• fingerprints;
• iris scanning;
• voice recognition; and
• other physical or behavioural characteristics.

This is an important distinction for payment businesses.

Accepting Apple Pay

The merchant is normally not building a biometric-recognition system simply because the customer authenticates Apple Pay using Face ID.

Building your own facial-payment system

If your business itself collects and processes facial or fingerprint information to uniquely identify customers, the situation is very different.

The ICO states that businesses operating biometric-recognition systems need to identify:

• an appropriate lawful basis;
• an appropriate Article 9 condition for special category processing;
• how the processing complies with data-protection principles;
• how data is secured;
• who controls the information;
• whether a DPIA is required; and
• how people's rights are protected.

Do not treat biometric information like an ordinary customer identifier.

Should Merchants Store Customer Biometric Data?

For most ordinary merchant payment requirements, there is no reason to.

If customers can authenticate through Apple Pay, Google Wallet, their banking app, passkeys or another established authentication environment, the merchant can often benefit from biometric-enabled authentication without collecting the biometric itself.

This can be a much cleaner architecture:

authentication provider verifies customer → merchant receives authenticated payment credential

rather than:

merchant captures face/fingerprint → merchant stores biometric template → merchant authenticates customer → merchant initiates payment

The second model may be appropriate for some specialist platforms, but it introduces a very different level of data-protection and security responsibility.

Biometric Payments for Ecommerce

Ecommerce is one of the areas where biometric authentication can offer the clearest customer benefit.

A conventional mobile card checkout might require the customer to enter:

• card number;
• expiry date;
• security code;
• billing information;
• delivery information; and
• additional authentication.

A supported wallet can potentially reuse information already held securely within the wallet and allow the customer to confirm the payment through their device.

This can shorten checkout considerably.

That is why biometric-enabled wallets should be considered alongside:

• checkout design;
• mobile conversion;
• 3D Secure;
• payment methods;
• network tokenisation;
• fraud controls; and
• gateway performance.

Biometrics alone do not improve conversion.

A well-integrated payment journey does.

Biometric Payments in Stores

For most UK merchants, in-person biometric payments already arrive through contactless digital wallets.

The customer may:

1. select a payment card in their wallet;
2. authenticate on the device;
3. present the phone or watch to the terminal; and
4. complete the contactless transaction.

The merchant's card terminal receives the payment credential through the normal supported contactless environment.

This means the important merchant requirements remain:

• contactless capability;
• compatible acquiring;
• supported wallets;
• terminal software;
• connectivity;
• settlement; and
• EPOS integration where required.

The merchant does not normally need to know whether the customer unlocked their wallet using a face, fingerprint or passcode.

Biometric Payments in Apps

Apps can use device capabilities to create particularly smooth authenticated payment journeys.

For example:

Customer selects product → chooses wallet → device requests biometric confirmation → transaction processed → app receives payment result

This can be useful for:

• retail apps;
• hospitality;
• travel;
• transport;
• subscriptions;
• marketplaces;
• booking platforms;
• SaaS; and
• other repeat-customer environments.

Businesses building these journeys should compare payment providers around APIs and wallet support rather than simply asking whether they “offer biometric payments”.

Biometrics, Tokenisation and Stored Credentials

Biometric authentication should also be separated from tokenisation.

They solve different problems.

Biometric authentication helps prove who is attempting to use a credential.

Tokenisation replaces sensitive payment-card information with another credential that can be used within the payment ecosystem.

Modern wallet payments frequently combine both.

This becomes even more important for:

• repeat purchases;
• subscriptions;
• account-based ecommerce;
• mobile apps;
• network tokens;
• stored cards; and
• future agentic-commerce journeys.

See our guide to network tokenisation for more detail.

Biometric Authentication and Agentic Payments

Biometric and device authentication may also become relevant as commerce becomes increasingly automated.

Agentic-payment models allow software or AI agents to act on behalf of customers subject to defined permissions and consent.

That creates a different authentication question:

How does the system know the customer authorised the agent to act?

Potential answers can involve:

• device authentication;
• passkeys;
• tokenised payment credentials;
• delegated authority;
• transaction limits;
• risk controls; and
• biometric confirmation at relevant stages.

Our Agentic Payments guide explores this emerging payment model in more detail.

Do Biometric Payments Cost Merchants More?

There is no universal biometric-payment surcharge or processing rate.

A merchant accepting Apple Pay, for example, still pays according to the commercial arrangement with its gateway, PSP or acquirer.

Relevant costs may include:

• merchant service charges;
• gateway fees;
• transaction charges;
• scheme and interchange costs;
• platform costs;
• integration costs; and
• other provider fees.

If a business is considering a specialist direct-biometric payment system, additional hardware, software, integration and compliance costs may apply.

These are therefore two very different commercial comparisons.

What Should Merchants Compare?

For most businesses, the useful comparison is not between fingerprint and facial recognition.

Instead, compare payment providers around the actual customer journey.

Wallet support

Does the provider support Apple Pay, Google Wallet and other payment methods relevant to your customers?

In-store acceptance

Are your card machines and acquiring setup compatible with the required wallet transactions?

Ecommerce integration

Can wallets be presented cleanly within your checkout?

In-app payments

Does the provider support the APIs and SDKs required by the application?

3D Secure

Does the provider support current ecommerce authentication properly?

Passkeys

If account or checkout authentication matters, can the wider platform support modern passwordless authentication?

Tokenisation

How are stored credentials and wallet payment tokens handled?

Fraud controls

How does authentication connect with fraud decisioning?

Fallback

What happens where the customer cannot use their preferred biometric?

Data responsibility

Is the business merely accepting a wallet transaction or actually processing biometric data itself?

The MAS Biometric Payments Test

1. Payment method

Is this Apple Pay, Google Wallet, a card payment, bank payment or a specialist biometric platform?

2. Authentication

Who verifies the customer?

3. Credential

What payment credential is actually transmitted?

4. Gateway

Which provider carries the online or in-app payment?

5. Acquirer

Who ultimately acquires the transaction?

6. Data responsibility

Does the merchant ever process biometric data directly?

7. Customer experience

Does the authentication reduce friction while still providing usable alternatives?

This prevents businesses from buying “biometric technology” before understanding what payment problem they are actually trying to solve.

How Merchant Advice Service Helps

Merchant Advice Service does not provide biometric-recognition software.

Our role is to help businesses understand the payment infrastructure required around the customer journey.

This can include:

• Apple Pay;
• Google Wallet;
• merchant accounts;
• payment gateways;
• card machines;
• digital wallets;
• 3D Secure;
• tokenisation;
• mobile checkout;
• in-app payments;
• payment APIs;
• authentication;
• international payments;
• integrations; and
• more complex payment architecture.

For most merchants, that means finding providers that support biometric-authenticated wallets rather than asking the business to collect customer biometric information itself.

You can also browse payment gateway providers and merchant account providers through The Payments Directory®.

Editorial Note

This guide is written and reviewed by Merchant Advice Service to help UK businesses understand biometric authentication and its role within modern card, wallet and ecommerce payments.

Merchant Advice Service is an independent payment advice and provider-matching service. We are not a biometric technology provider, identity-verification provider, card issuer or data-protection adviser.

Biometric authentication, wallet functionality, data-protection requirements and payment-provider capabilities can change. Businesses considering direct biometric recognition should take appropriate technical and data-protection advice for their particular use case.

Our information, matching and introduction service is free to businesses. MAS may receive commission or a referral fee from some commercial partners where an introduction results in a completed product or account.

Related Merchant Advice Service Content

How to Accept Apple Pay
Our merchant guide to accepting Apple Pay face-to-face, online and within supported payment environments.

Google Pay: A Merchant's Guide
Explains Google wallet payments, contactless acceptance and online payment-gateway requirements.

Cart Abandonment & Ecommerce Payments
Explains how wallets, authentication, 3D Secure, payment methods and gateway performance can affect checkout conversion.

Network Tokenisation Explained
A deeper guide to tokenised payment credentials and their role in wallets, stored cards and modern payment infrastructure.

Agentic Payments
Looks at authentication, tokenisation, delegated authority and payment credentials as AI-led commerce develops.

Ecommerce Payment Providers UK
Our wider guide to merchant accounts, payment gateways, wallets, alternative payment methods and ecommerce payment architecture.

Sources & References

Apple – Apple Pay Security and Privacy
Apple's current explanation of Apple Pay authentication, device security, tokenised payment credentials and how Face ID, Touch ID, Optic ID and passcodes can be used when authorising payments.

Apple Platform Security – Payment Authorisation With Apple Pay
Technical Apple documentation explaining how payment authorisation interacts with biometric authentication, the Secure Enclave and Secure Element.

Google Wallet – Verify That It's You to Make a Purchase
Google's current guidance on approved device verification methods for Wallet payments, including PINs, passwords and qualifying biometric authentication.

Financial Conduct Authority – Strong Customer Authentication
Official FCA guidance covering UK Strong Customer Authentication requirements for online account access and relevant electronic payment transactions.

EMVCo – EMV 3-D Secure
Official information explaining EMV 3DS authentication for ecommerce payments, including issuer challenges that can use biometrics and other authentication methods.

FIDO Alliance – FIDO Authentication and Payments
Current guidance on passkeys and phishing-resistant authentication for merchant checkout, issuer authentication and payment environments.

Information Commissioner's Office – Biometric Recognition
Official ICO guidance explaining when biometric recognition involves special category biometric data under UK GDPR.

Information Commissioner's Office – Processing Biometric Data Lawfully
ICO guidance covering lawful basis, special category conditions and data-protection responsibilities where organisations directly process biometric data.