Biometric payments are gaining traction as retailers look for faster, more convenient ways to identify customers at checkout. Amazon’s Amazon One palm recognition system is one of the highest-profile examples, promising a contactless payment experience in exchange for storing a customer’s biometric data. However, the technology also raises important questions about privacy, security, and the long-term value of biometric identity. As biometric payments become more common, consumers and businesses must weigh the convenience of frictionless authentication against the risks of centralized biometric data collection.
This should be an academic exercise to test the value consumers place on their biometric identity, but Amazon really is offering a $10 credit for a picture of your palm. What are the risks? This article indicates that the image of your palm is “encrypted and secured in the cloud,” which creates a huge honeypot guaranteed to attract state-funded hackers, and Amazon is just as vulnerable to hacking as anyone else, as was done here.
If hackers get your palm picture what good is it to them? That depends. Does the picture include the fingerprint I use to open my phone? Does it include palm vein information that could be used to hack Fujitsu’s palm reader used in Hyosung ATMs and in banks and credit unions? Storing biometrics in their original form at a central location is a terrible idea that consumers know nothing about:
“What is the lowest amount you would sell your personal palm print for to a third-party? Amazon is offering $10 in promotional credit to anyone who scans their palm at a checkout-free store and links it to their Amazon account.
In late 2020, the company introduced “Amazon One” as a “free, contactless service that lets you use your palm to pay, enter, or identify yourself.” This works because palm prints are like fingerprints in that everyone’s print is unique. As such, the palm prints can be scanned using Amazon’s “proprietary imaging and computer vision algorithms” to capture an image that is then tied to a user’s Amazon account.
While this could save time in stores or at events while also being contactless and COVID-safe, allowing Amazon to collect your palm print is cause for at least some concern, whether it be over privacy issues or security, or both. First and foremost, the company has been oddly pushy about biometrics in the past, like when Amazon wanted delivery drivers to agree to biometric surveillance. Beyond this, the company has a not-so-great track record of keeping data secure, provided it is not being sold outright.”
Biometric payments have the potential to simplify authentication and improve the checkout experience, but they also introduce new security and privacy considerations. Unlike passwords, biometric identifiers cannot simply be changed if they are compromised. As retailers continue to expand biometric payment programs, success will depend on balancing convenience with robust data protection, transparent privacy practices, and consumer trust. The future of biometric payments will likely be shaped as much by confidence in how biometric data is handled as by the technology itself.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group