Paying with your face in an age of deepfakes: Is it still a good idea?: Opinion

Source: Straits Times
Article Date: 30 Oct 2026

Unlike a compromised credit card, facial data can't be replaced. But consumer concerns may be misplaced.

Imagine going to a supermarket, and instead of tapping our phones or cards to pay for our groceries, we could simply glance at a screen. A camera could scan our face, compare it with a biometric template, and the payment could be authorised.

Facial recognition technology has gained traction around the world – we use our faces to unlock our phones, gain entry to our offices and homes, and even clear immigration.

As we move further towards a cashless society, being able to pay with nothing more than our face could become increasingly commonplace and represent the ultimate convenience. We could be completely hands-free, without needing to fumble with our phones, credit cards, cash or passwords.

Fintech company Revolut recently launched an initial pilot of Britain’s first in-store facial recognition checkout system, Pay with Smile. It uses facial technology to verify the identity of the user against selfie identification checks to authenticate and process a payment securely.

In August, meanwhile, it was reported that a closed trial of facial recognition technology for fare payment is under way at Punggol Coast MRT station, allowing participants to enter and exit the station through a modified gantry using a facial scan.

But even as the technology becomes increasingly available, a bigger stumbling block to adoption is security. Facial recognition payments use our biometric information, which is arguably much harder to steal than a credit card number or bank account details. But should a breach occur, the consequences could be more serious: We can’t replace our facial data like we would a credit card.

These concerns are heightened when seen in the light of the rapid advances in artificial intelligence and other technologies, which could make it easier to spoof or crack biometric templates. Is the convenience offered by facial recognition payments, therefore, still worth it?

Consumer caution

Facial recognition technology has been widely adopted around the world, especially in Asia. Even in Singapore, supermarket chain Sheng Siong has used facial recognition CCTV technology to catch shoplifters and identify customers whose payments have failed.

Facial payments, however, are widely available only in China and South Korea. China has had the technology in place since 2017, and in cities like Beijing and Chengdu, commuters taking public transport can scan their faces at selected gantries to pay their fares.

In South Korea, meanwhile, facial payments gained traction only recently through services like Toss and Naver. As at mid-2026, Toss’ FacePay had more than six million registered users – over 10% of the population – and has recently expanded beyond its initial concentration in convenience stores, cafes and restaurants into department stores and cinemas.

Yet, many consumers remain hesitant about using it. One media report highlighted that while the number of stores accepting facial payments has risen to 15% of all credit card merchants, their share of the total domestic card payment volume remains in the single digits.

Another news report highlighted rumours circulating of facial payment terminals misidentifying someone’s face and deducting money from a different account, while consumers cited fears of their biometric information being leaked. The method also remains complementary even in China, the pioneer in facial payment, despite a decade of development and aggressive pushes by dominant players Alibaba and Tencent Holdings.

An annual report published in August from the Payment and Clearance Association of China highlighted that just 23% of consumers used biometric payment regularly.

When taking public transport, just 7.4% of consumers used facial recognition as a means of payment, compared with 43.7% using QR codes and 38.2% using near-field communication.

For many consumers across Asia, there are plenty of cashless payment options available, whether it is scanning a QR code or tapping their phone. Going hands-free therefore offers them only a small incremental convenience – and to them, it’s not worth the security risk.

Heightened risk

This risk is heightened especially when we consider the rapid development of artificial intelligence and deepfakes. Two alarming capabilities come to mind.

The first is its hacking capacity, which the recent OpenAI-Hugging Face incident – where some OpenAI models escaped their training environment, went rogue and hacked into open-source platform Hugging Face – highlights.

The decoding capabilities of AI are also advancing rapidly. An Enigma message from World War II that remained unsolved for 83 years was recently deciphered with the assistance of OpenAI’s GPT-6 Astra.

These highlight the increasing cybersecurity risks AI models pose that could make it easier for a data breach to happen.

AI is also increasingly able to convincingly reproduce human appearance, expression and behaviour, heightening the potential risk of deepfakes spoofing facial recognition systems.

San Francisco-based company Tavus recently released its new Griffin model, designed for real-time full-duplex video interaction.

A study conducted by the company found that 48% of 54 participants believed they were speaking to a real person after a one-minute video call with its Griffin-Lite AI model, compared with 2.4% for Tavus’ previous system. The model scored 3.83 on Nvidia’s VideoFDB benchmark, just 0.09 points below the human reference point. This means that the AI-generated interaction is approaching the level of naturalness observed in real human interactions.

There is no doubt these developments could heighten the risk of one’s biometric data being compromised. But facial recognition payment technology is far more advanced and secure than regular facial recognition technology, like what we would use to enter our offices.

Features include 3D depth sensing to map facial contours and infrared sensing, which works across lighting conditions and helps tell real faces apart from flat images or masks. Liveness detection technology also ensures that the facial data captured belongs to a real, physically present living human, rather than a deepfake.

So far, the risk of security breaches in facial recognition payments remains contained. To date, among the major facial recognition payment companies, there have been no serious events involving large-scale exposure of facial data or widespread unauthorised transactions on a global scale. Consumer concerns, therefore, might be misplaced. The risk of a data breach is a real one, and likely to increase as AI develops. But the breach is far more likely to come from a regular facial recognition system than a payment one.

Still worth it?

In an age of rapid AI development and deepfakes, we should no longer assume that our biometric data will be safe forever. The old saying that “seeing is believing” may no longer hold.

But the technology behind these facial recognition payments is not easily fooled, and there are some instances where convenience and the need for hands-free payment can still outweigh the potential security risk.

These could include going to supermarkets, for instance, when one has bags of groceries to load and carry, or taking public transport, where large numbers of people need to be cleared quickly at gantries during peak hours.

Keeping facial recognition payment to physical stores and in-person transactions – where deepfakes can’t be used – might be the best balance to strike. Capping transactions to a certain amount might also give consumers a measure of psychological safety.

Ultimately, with or without facial payments, we should be more vigilant about our biometric data. It’s unlikely that consumers will use facial payments to pay for everything. But for some of life’s smaller transactions, the convenience of going hands-free may be worth the trade-off.

Tiger Tong advises on China strategies at DeLorean Partners.