Biometric payments

A biometric payment card looks like an ordinary chip card with a small fingerprint sensor next to the chip. The cardholder keeps a finger on the sensor while tapping or inserting the card, and the card compares the finger with the stored template before it releases the payment. Thales, which makes such cards for banks, states that the fingerprint stays stored in the chip of the card, so neither the retailer nor the bank can see it. The cardholder enrolls the fingerprint at home or in a bank branch, and Thales says its card is certified by the major EMV schemes such as Mastercard and Visa.

BNP Paribas opened the Thales card to all its customers after a trial, as Jean-Marie Dragon, Head of Payments and Cards at the bank, said when Thales presented the card in July 2021. In Switzerland, Cornèrcard launched a Biometric Gold Visa credit card with Visa and Gemalto in November 2019, where the cardholder registers the fingerprint on the sensor of the card and enters the PIN once at the first payment.

The fingerprint on the card also changes the limits for contactless payments. Under Delegated Regulation (EU) 2018/389, a bank may skip strong customer authentication at the terminal only up to 50 euros per payment and until 150 euros or five payments in a row have built up, after which the cardholder has to authenticate again, usually with the PIN. A biometric card checks the cardholder at every tap, and Thales argues that its card therefore needs no payment limit.

Mastercard started its Biometric Checkout Program on 17 May 2022 as a set of standards for paying in a shop with a face scan or a wave of the hand. Banks, merchants and technology providers in the program follow minimum standards for security, biometric performance and data protection, and shoppers enroll voluntarily in the app of a merchant or an identity provider. The first pilot ran in five St Marche supermarkets in São Paulo, with Payface as the technology partner.

Europe followed in June 2024, when Mastercard, the Polish retail chain Empik and the fintech PayEye opened the first Biometric Checkout pilot in Europe in five Empik stores. Shoppers there pay with a glance at an eyePOS terminal that combines iris and face recognition. PayEye also signed a cooperation agreement with Worldline in July 2024, and the announcement of both companies (in Polish) describes the flow: the customer registers in the PayEye Global app with a selfie, links a payment card and later confirms each payment by looking at the terminal. The eyePOS 3 terminal also accepts NFC payments, QR codes and ordinary cards at the same checkout.

For palm payments, Handwave, a fintech from Riga, announced on 2 September 2026 an expanded agreement with Visa under which a payment card is linked to the palm of the user through tokenization. Handwave checks palm geometry, vein patterns and liveness, names the Baltic states as its first launch market and expects pilots with banks and retailers to reach production before the end of 2026.

A phone wallet already works biometrically, because it asks for the fingerprint or face of the user before it releases a card stored in the wallet. The European Banking Authority counts such mobile wallet approaches as compliant with strong customer authentication when they combine the phone bound to the app with a knowledge or inherence element.

For online purchases, Visa offers the Visa Payment Passkey, which is built on the FIDO standards and confirms a payment with the fingerprint or face recognition of the device instead of a password or a one-time code. In Ukraine the service has been available since April 2025, when Visa launched it with the utility bill platform GERC as part of Click to Pay, and the payment service RozetkaPay added it in April 2026. Behind the FIDO standard is a key pair whose private key stays on the device and is unlocked by the biometric check, as with passkeys in banking.

PSD2 requires strong customer authentication for electronic payments and names inherence, something the user is, as one of three categories next to knowledge and possession. The technical standards on authentication add that the devices and software reading an inherence element must have a very low probability of accepting an unauthorized party as the payer.

The European Banking Authority listed in its opinion EBA-Op-2019-06 of 21 June 2019 which biometric methods can count as inherence: fingerprint scanning, vein recognition, hand and face geometry, retina and iris scanning and voice recognition. The EBA adds that the quality of the implementation decides whether a method complies in practice. A biometric check covers one element only, and the second has to come from another category, such as the phone bound to the banking app. Exemptions, 3-D Secure and liability belong to the wider rules of strong customer authentication, while typing and touch patterns used against fraud fall under behavioral biometrics.

The General Data Protection Regulation defines biometric data as personal data from the technical processing of physical, physiological or behavioral characteristics that allow or confirm the unique identification of a person, such as facial images or fingerprints. Article 9 prohibits processing biometric data to identify a person uniquely unless an exception applies, and for a payment service the exception that usually fits is the explicit consent of the customer for a specified purpose. Enrollment in the Mastercard program and in the PayEye app is voluntary, and a template kept only in the chip of the card, as in the Thales design, never reaches the bank or the shop.

The EU AI Act separates two kinds of matching that payment systems use. Biometric verification is the one-to-one check that a person is who that person claims to be, and Annex III of Regulation (EU) 2024/1689 excludes it from the high-risk category of remote biometric identification. Remote biometric identification compares a person with a reference database without the person's active involvement, typically at a distance, so providers of face and palm terminals have to check which definition their matching falls under. The regulation also bans biometric categorization systems that infer race, political opinions, religious beliefs or sexual orientation from biometric data.

Biometric payments are card, wallet or account payments that the payer confirms with a fingerprint, a face, an iris or a palm instead of a PIN or a password. The biometric check only authenticates the payer, and the money still moves over the card scheme or the bank account behind the payment.

The card carries a fingerprint sensor and a secure chip that holds the template of the cardholder. At the terminal the cardholder keeps a finger on the sensor while tapping or inserting the card, and the card approves the payment only when the fingerprint matches. Cornèrcard asks for the PIN once at the first payment, and with the Thales card the fingerprint is enrolled at home or in a bank branch.

A copied card number or a stolen PIN is not enough when the payment also needs the fingerprint or the face of the payer. For an inherence element, the EU rules require a very low probability that someone else is accepted as the payer, and a template that stays on the card or the phone is not held on a central server. A fingerprint cannot be replaced like a password once it leaks, and the GDPR lists biometric data used for identification among the special categories of personal data.

The shopper registers once, links a payment card to the palm and later holds the hand over a reader at the checkout. Handwave reads palm geometry and vein patterns with a liveness check, and with Visa it links the card through a token, so the reader works with a substitute value instead of the card number.

Usually yes, because Article 9 of the GDPR forbids processing biometric data to identify a person unless an exception applies, and explicit consent for a specified purpose is the exception that fits a payment service. In the Mastercard program enrollment is voluntary, and the eyePOS 3 terminal of PayEye still accepts ordinary cards from shoppers who never register a face or an iris.