[비즈한국] Claims that it is possible to make payments by authenticating with another person's face have been spreading regarding Face Pay. Online, anecdotal stories have been shared claiming that during the payment process, the face of a person standing behind the user was recognized instead, leading to an accidental payment. However, it has been confirmed that there have been no reports of damage or requests for compensation submitted to the customer service center regarding such payment errors.
According to Toss on the 8th, it was found that no reports of damage or complaints claiming that a payment was made because a person behind the user was recognized have been received over the past month. If a payment by someone else or a fraudulent payment actually occurs, users can apply for the 'Safe Compensation System' through the customer service center, but there have been no compensation requests related to this either.
Previously, stories circulated online claiming that during the Toss Face Pay process, someone else's face—rather than the actual user's—was recognized, leading to a payment. As it is a service that allows payment using only one's face without a separate card or mobile phone, concerns were raised about whether the system might incorrectly identify bystanders as the payer, or if one's own payment method could be used by others without their knowledge.
Payment is put on hold if multiple faces are detected… Additional authentication if the subject is hard to identify
Face Pay is a service that allows users to make payments with their registered payment method by simply showing their face to a merchant-exclusive terminal after pre-registering their facial information and payment method. Users do not need to take out a physical card or run a mobile phone app. When a user selects Face Pay, the terminal's camera recognizes the face, verifies the registered user, and proceeds with the authorization process using the payment method linked to that account.
By default, Face Pay determines the payment target based on the face that appears largest on the screen. As the person standing closest to the terminal appears largest on the screen, the system prioritizes identifying the user who is actually attempting the payment.
If the faces of two or more people are captured by the camera at the same time, the payment does not proceed immediately; instead, the system displays a prompt on the screen to encourage only one person's face to be clearly recognized. If the system still finds it difficult to determine who the payer is, or if the facial features are not clear, it will request additional authentication.
Attempts to replace one's own face with photos or videos are also blocked by separate security technology. Toss applies liveness detection technology to determine if a real person is in front of the camera, filtering out photos, videos, or other forged/falsified facial representations. User data, such as facial information, is encrypted and managed, and a system to detect abnormal transactions is also in operation.
As the number of users grows, interest in the safety of facial payments increases
The attention surrounding the Face Pay controversy stems from the fact that the service is rapidly expanding into everyday payment areas. After a pilot launch in parts of Seoul in March of last year, Toss expanded the service nationwide in September of the same year. Recently, the cumulative number of subscribers exceeded 7 million.
The number of stores where the service can be used is also increasing. As of June this year, the cumulative number of merchants for 'Toss Front,' the payment terminal that supports Face Pay, surpassed 370,000. Following this, Toss partnered with retail POS companies to sequentially introduce Face Pay to over 5,000 small and medium-sized supermarkets nationwide, and is also expanding its use to chicken franchises and highway rest areas.
Regarding this controversy, a Toss official said, "We are aware that such posts have been spreading online," and added, "We have checked related customer inquiries and complaints, but no reports of damage claiming that a payment was made because a person behind the user was recognized have been confirmed."
The official further explained, "The terminal basically determines the payment target as the face recognized most prominently on the screen. If two or more faces appear at the same time, it is designed to guide the user to step closer, and if the payment target is difficult to identify, it is designed to require additional authentication."