Payments3 min readUpdated October 15, 2026

What Is a Biometric Payment?

Biometric payment meaning: where the fingerprint or face is checked, why the merchant never sees it, SCA inherence, Visa CDCVM rules and GDPR Article 9.

Nick Bonnassies, CMO at Tagada · checked against 4 sources

Article summary

TL;DR

A biometric payment is a payment the customer approves with a fingerprint, face scan or another body trait. In phone wallets and passkeys, the trait is checked on the customer's own device, and only a signed confirmation goes to the bank or website. In Europe, the biometric counts as the inherence factor of strong customer authentication.

With Touch ID, Apple says fingerprint data never leaves the device and is not sent to Apple. With passkeys, FIDO says the server only sees that the check succeeded.
The merchant never receives the fingerprint or face. It receives a payment token or an authentication result.
Under PSD2 strong customer authentication, a biometric is the inherence factor, 'something the user is'.
Visa calls on-device verification CDCVM, and some Visa regional rules require issuers to support biometric authentication.
Under GDPR, biometric data processed to uniquely identify a person is a special category of data.

Want to go further? Ask

On this page

You pay with Face ID, a fingerprint on your phone, or a passkey on a website. Each time, a body trait replaces the PIN or password. Here is where that trait is checked, how it fits payment rules, and what a merchant actually receives.

What is a biometric payment?

A biometric payment uses a fingerprint, face, iris, voice or vein pattern to approve a payment. The key point for "biometrics in a payment system" is where the match happens. In the most common setups, it happens on the customer's device, not at the merchant or the bank.

Apple says Touch ID data "never leaves the device. It's not sent to Apple, nor is it included in device backups."1 For passkeys, the FIDO Alliance says "the server only sees an assurance that the biometric check was successful."2

Where it is used	Where the trait is checked	What the merchant gets
Apple Pay, Google Pay in a store or app	The phone or watch	A payment token and cryptogram
Passkey sign-in or payment passkey	The phone or laptop	A signed confirmation
Card with a fingerprint sensor	The card	A chip payment verified by the card
Bank app approving a 3DS challenge	The phone, inside the issuer's app	The 3DS result

Biometrics in SCA and card network rules

In Europe, strong customer authentication needs two factors among knowledge, possession and inherence. A fingerprint or face is inherence, "something the user is". A wallet bound to one phone and unlocked with Face ID combines possession and inherence.

Card networks call this on-device check CDCVM. Visa defines it as "An Issuer-approved, Visa-recognized method for verifying a Cardholder using the Cardholder's payment device. Examples include Mobile Payment Devices or Cards enabled with biometric elements (for example: requiring a fingerprint)."3 The other methods are in cardholder verification method.

Visa also asks some issuers to support biometrics. In Australia, effective October 24, 2026, an issuer must support "Biometric authentication for transactions performed with biometric-enabled devices" (Visa Core Rules, April 2026, section 7.9.2.1). In Canada, a Visa Secure issuer that supports step-up or challenge-based authentication must also support biometric authentication (section 10.15.2.6).3

GDPR defines biometric data as data from "specific technical processing" of physical, physiological or behavioral traits "which allow or confirm the unique identification" of a person (Article 4(14)). Article 9(1) puts "biometric data for the purpose of uniquely identifying a natural person" in the special categories whose processing is prohibited unless an exception, such as explicit consent, applies.4

For an online store using wallets and 3DS, the biometric stays with the device. You never receive it. What you do control is whether shoppers can use these flows: offer Apple Pay and Google Pay, and run 3DS2 so issuers can approve in their app. Other signals you may collect, such as a device fingerprint, follow different rules. For 3DS and SCA in practice, see our guide to payment authentication.

How Tagada helps

Wallets and 3DS2 at checkout

Tagada's checkout offers Apple Pay and Google Pay. TagadaPay includes native 3DS2, device intelligence, and a rules engine. Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply for processing

Updated on October 15, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Does the merchant store my fingerprint or face?

Not when you pay with a phone wallet or a passkey. The match is done on your device. Apple says Touch ID data never leaves the device, and FIDO says the server only sees an assurance that the biometric check was successful. The merchant receives a payment token or an authentication result, never the biometric itself.

What happens if the biometric check fails?

The device offers another way to unlock, usually the device passcode or PIN. FIDO passkeys use the same process people use to unlock their device, for example biometrics, PIN or pattern. If that also fails, no payment approval is sent.

Can biometric data be stolen?

A fingerprint or face cannot be changed like a password, which is why device makers keep it local. Apple says Touch ID data is stored encrypted, can be read only by the Secure Enclave, and is not included in device backups. Systems that keep templates on a server carry more risk and, in the EU, fall under GDPR Article 9.

Sources

Checked October 15, 2026

TagadaPay

Offer wallets and 3DS2 at checkout

Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.

Apply for processing See pricing

01Tell us what you sell and how
02Underwriting reviews your business
03Process through TagadaPay alongside your other processors