[비즈한국] Claims that it is possible to make payments by authenticating someone else's face are spreading regarding Face Pay. Online, anecdotal stories have been shared alleging that during the payment process, the face of a person standing behind the user was recognized instead, resulting in an erroneous payment. However, it has been confirmed that there have been no reports of damages or requests for compensation filed with customer service regarding such payment errors.
According to Toss Bank on the 8th, no reports or complaints have been filed over the past month regarding incidents where someone else’s face, standing behind the person attempting to pay, was recognized and processed. In cases where unauthorized payments or fraudulent transactions actually occur, users can apply for the "Safe Compensation Program" through customer service, but there have been no such compensation requests regarding this issue.
Previously, stories circulated online claiming that during a Toss Face Pay transaction, a customer's face was misidentified, resulting in a payment made by the wrong person. As it is a service that allows payments using only one's face without a separate card or mobile phone, concerns were raised about whether the system might incorrectly identify people nearby as the payer, or whether one's payment method could be used by someone else without their knowledge.
Payment suspended if multiple faces are detected… Additional authentication required if the target is unclear
Face Pay is a service where users register their face and payment method in advance, and then make a payment by showing their face to a terminal dedicated to the merchant. There is no need to take out a physical card or run a mobile phone app. When a user selects Face Pay, the terminal's camera recognizes the face, verifies whether the person is a registered user, and proceeds with the authorization process using the payment method linked to that account.
By default, Face Pay identifies the face that appears largest on the screen as the payment target. Since the person standing closest to the terminal appears largest on the screen, the system prioritizes the person actually attempting the payment.
If the faces of two or more people are captured by the camera at the same time, the payment does not proceed immediately; instead, a prompt appears on the screen to guide the users so that only one person's face is clearly recognized. If, even after that, the system finds it difficult to determine who the payer is or if the facial features are not distinct, it requests additional authentication.
Ways of substituting another person's face using photos or videos are also blocked by separate security technologies. Toss applies liveness detection technology, which determines whether a real person is in front of the camera, to filter out forged or altered faces such as photos or videos. User data, including facial information, is managed through encryption, and the company also operates a system to detect abnormal transactions.
Interest in the safety of facial payments grows as the number of users increases
The controversy surrounding Face Pay is gaining attention because the service is rapidly expanding into everyday payment areas. Following a pilot launch in some parts of Seoul in March of last year, Toss expanded the service nationwide in September of the same year. Recently, the cumulative number of subscribers exceeded 7 million.
The number of available stores is also increasing. As of June this year, the cumulative number of merchants using the “Toss Front” payment terminal, which supports Face Pay, exceeded 370,000. Since then, Toss has partnered with retail POS companies to sequentially introduce Face Pay to approximately 5,000 small and medium-sized supermarkets nationwide, and is expanding usage to chicken franchises and highway rest areas.
Regarding this controversy, a Toss official stated, “We are aware of the fact that such posts have been spreading online,” and added, “We have checked relevant customer inquiries and complaints, but no reports of damages claiming that a payment was made because the person behind the user was recognized have been confirmed.”
The official further explained, “The terminal is designed to judge the face that appears largest on the screen as the payment target by default,” and “If the faces of two or more people enter the frame simultaneously, the system guides the user to step closer, and if it is difficult to identify the payment target, it is designed to require additional authentication.”