Does a biometric payment approval identify the person?¶

No. A biometric approval shows that the device or payment system accepted the biometric authentication process. It does not automatically identify the person beyond all doubt.

Avoid the dangerous assumption¶

The dangerous assumption is that a fingerprint or facial-recognition approval proves the registered device owner personally authorised the payment.

Consumer biometric systems usually perform a local match against biometric templates enrolled on the device.

The payment provider may receive confirmation that device authentication succeeded without receiving the biometric image or template itself.

Several fingerprints or appearances may be enrolled on one device.

The device may also permit fallback authentication using a passcode, PIN or password.

Relevant records may include the device, wallet token, authentication result, transaction reference, timestamp and whether biometric or fallback authentication was used.

Ask the device, wallet or payment provider what the record actually confirms.

Do not describe a provider record as proving that a named person’s fingerprint or face was used unless the evidence supports that level of detail.

A device owner may have allowed another person to enrol a biometric or know the passcode.

Device compromise, coercion or mistaken local recognition may also require consideration, although the evidence should be assessed proportionately.

Compare the approval with possession of the device, account access, communications, CCTV, location evidence and surrounding activity.

When reporting, state that the device recorded successful biometric or device authentication rather than asserting personal identity.

Operational takeaway¶

Treat biometric approval as evidence of successful device authentication and establish the actual user through enrolment, possession, device and contextual evidence.