FacePay: Building Region-First Biometric Payments at 99.9% Accuracy

Most payment innovation is a few percentage points faster, a few percentage points cheaper, slightly less awful. Once in a while a change makes the customer stop looking at the terminal entirely. Biometric payment is one of those — done well, the act of paying disappears.

I led FacePay at Carrefour (Majid Al Futtaim Retail) end-to-end, from the business case to the regional first launch. We landed at 99.9% recognition accuracy and a sub-three-second checkout. Everything in this post is what you don't see in the press release: the trade-offs, the where-it-could-have-gone-wrong moments, and the decisions that made it feel routine to customers from day one.

The right problem to solve.

It is tempting to frame biometric payment as a speed product. Speed matters, but the deeper customer problem is cognitive load at the wrong moment. By the time a shopper reaches the terminal they have already made dozens of small decisions — what to buy, what to skip, what brand. The last thing the experience should ask of them is a wallet, an unlock, a tap, a wait. FacePay's real job is to remove that final stack of micro-decisions, not to shave seconds for their own sake.

That framing changed how we built it. Speed was a constraint, not the target. The target was "customer doesn't think about paying." Anything that broke that — a fallback prompt, a confidence-too-low retry, a confused agent at the lane — was a P0 issue.

99.9% accuracy is a floor, not a goal.

The first instinct on a biometric system is to optimise for accuracy in isolation. That instinct is incomplete. The metric that matters in production is accuracy under store conditions: harsh ceiling lighting, masks in respiratory seasons, glasses, hijabs, beards growing in over a quarter, twins, weight changes, makeup, after-work tiredness, lift-pickup angles, and the specific mix of ages and ethnicities that walk through your stores in your countries.

Lab benchmarks won't tell you the right number. We invested early in:

• In-store test panels across age ranges, lighting profiles, and accessory cases. Not actors — real shoppers, consented, paid for their time.
• A confidence-tier policy. High-confidence matches authorise straight through. Mid-confidence asks for one trivial confirmation. Low-confidence falls back to card with no friction spike. The system never refuses a paying customer over a model quibble.
• A drift dashboard. Recognition quality measured per-store, per-camera, per-time-of-day. A camera tilt or a new ceiling light kills accuracy fast — and silently — without this view.

Privacy is the product. Treat it like one.

A biometric system that loses customer trust loses the business case in a single news cycle. The product team's job is not to "comply with privacy" as a checklist; it is to make privacy a design constraint that bends the architecture.

What that meant in practice for FacePay:

• Opt-in only, with a clear, plain-language consent flow. No dark patterns. The flow can be exited at any step without penalty or hidden state.
• Template storage, not photos. The system stores a mathematical template, not an image. The template is useless to a camera and to a human.
• One-tap deletion. The customer can delete their enrolment from their account at any time and get a confirmation that it's gone. The deletion path is not buried two settings screens deep.
• Edge-first inference. As much as possible runs at the lane, not in the cloud. Less data on the wire, less data at rest, less surface to defend.
• Independent privacy review before launch and on a recurring cadence afterward — not just internal sign-off.

None of this slows the experience. All of it is what makes the experience trustworthy enough to use a second time.

Sub-three-second checkout — where the seconds went.

A three-second budget sounds generous until you list what has to happen: detect a face, capture a frame at usable quality, run liveness, run match, look up payment instrument, authorise with the acquirer, return result, print receipt. Anything that touches the network is a candidate for blowing the budget.

The architectural moves that bought back time:

1. Pre-authorise on approach, not at scan. The lane knows a customer is queued before they reach the camera. Speculative payment-method look-ups happen ahead of the match, which means by the time we have a confident face match the financial half of the transaction is already warm.
2. Liveness on-device. The check that determines is this an actual person never leaves the lane. Round-trip latency to a cloud liveness service kills the budget on its own.
3. Async receipt. The customer sees "paid" and walks. The receipt finishes printing while they are picking up their bag. The visible flow ends earlier than the technical flow.
4. Failure paths planned for the same budget. A fallback to card has to also feel under three seconds. If the failure path is slow, customers remember the failure mode and stop trusting the happy path.

Going first in the region — what nobody tells you.

Being region-first is a marketing line and an operational hazard. The regulators have not seen this pattern before in retail. The acquirers have not contracted for it. Internal legal does not have a precedent playbook. Customers have not built intuitions for it.

The four moves that turned "first" from a risk into a moat:

• Engage regulators early, with a working demo. Not a deck. A demo. They get to ask hard questions in person and you get to absorb their concerns before architecture freezes.
• Co-design with payments partners, don't bolt them on. Their fraud rules and tokenisation patterns matter to your latency budget and to your enrolment flow. Treat them as a first-class design partner.
• Ship in the smallest credible footprint. One flagship store, one lane, one customer cohort. Learn loudly. Then scale.
• Communicate to customers like they have never seen this before. Because they have not. Signage at the lane, a visible team member at launch, a one-page explainer in the app, a phone number for confused first-timers. The cost is small. The trust dividend is large.

Honest mistakes worth naming.

We treated enrolment as a footnote. The first enrolment flow was technically correct and emotionally cold. People hesitated at the consent step in a way the prototype never showed, because the prototype was used by people who already knew what we were trying to do. We rewrote the flow to be warmer, slower at the consent moment specifically, and more explicit about what is stored and what is not. Conversion to enrolment improved materially after that pass. Enrolment is the hardest part of the funnel, and we under-respected it on the first round.

We over-relied on lab metrics for a single quarter too long. The drift dashboard existed but it took us a beat to make it the first dashboard the team looked at every morning. After that became the routine, in-store accuracy issues got caught the same day instead of the same week.

What I'd tell a peer building this in 2026.

Treat biometrics as an identity-and-trust product, not as a payments product. The hard problems are consent design, drift in production, privacy as architecture, and giving customers a confident off-ramp. The payment leg of the stack is well-understood and increasingly commoditised. The trust leg is where the differentiation lives, and it is where the cost of a mistake is highest.

Sub-three-second checkout and 99.9% accuracy are achievable in 2026 with current models and current edge hardware. They are not what wins. What wins is being the team that the regulator, the legal partner, the payments partner, and the customer all trust to do this the boring careful way.

Building biometric payments and want a sounding board before architecture freeze? Send me a note.