Wink

Face, palm and voice matching at checkout is model work from end to end. Its payment gateway and network, which merchants can own or rent, is a second business that stands without models.

Authentication finishes in under a second without a person, which a checkout queue demands, and combining face, palm and voice keeps one weak reading from deciding. What happens to an unrecognized customer, whether card fallback is automatic and what recourse exists at the till after a wrong match are not described.

Speed and scale figures say nothing about correctness, and no false match rate, false rejection rate or presentation attack result is published. Javelin's 2025 scorecard placement is a market assessment rather than a technical evaluation.

More than 220,000 merchants, over 400 million transactions a month and more than $4.8 billion a year are stated. Riskified backs a zero chargeback guarantee, putting an independent party's money behind Wink's fraud decisions.

Biometric data is shared only with the merchant through which a person enrolled, stored as encrypted templates rather than raw images, a categorical containment commitment. Training across merchants on templates or transactions is not addressed.

Written consent comes before any biometric collection, and data is destroyed within seven business days of a withdrawal, per the privacy policy updated April 1, 2026. Processors appear only by category, for data that cannot be reissued after a breach.

A stated aim to comply with the PCI Data Security Standard, SOC 2 Type II and ISO 27001 is not a certification held, and the homepage names none. Gateways handling hundreds of millions of transactions a month are expected to show a current attestation.

Retention limits of three years for Illinois residents and one year for Texas residents track the states with dedicated biometric privacy statutes. Card networks supervise gateways through their own programs, yet no registration or network listing for Wink is shown.

One to many matching compounds the demographic error differentials face recognition already carries, palm recognition is little studied across populations, and voice varies with accent and age. A false match charges the wrong person's account, and Wink publishes nothing on demographic performance for any modality.

Wrong fraud decisions cost the merchant nothing under a zero chargeback guarantee. Enrollment is voluntary and a card still works if a match fails, but a person falsely matched to another customer's payment has no described route.

Qualcomm supports on device processing and Vouched serves agent commerce, alongside the terminal makers that host the biometric layer. The models appear to be Wink's own, while cloud hosting, security and support providers are listed only by category.

Integration reaches down the payments stack, into Fiserv's Clover point of sale, SUNMI terminals and Elo kiosks among others, including outdoor units for parking and transit.

Checkout biometrics are processed at the edge on partner terminals, templates sit on Wink's servers or merchants' encrypted edge devices, and personal information is stored in the US. Edge processing limits what face and palm data leaves the store.

Merchants can own the payment gateway outright or rent it, but the biometric layer carries no price. Whether it is charged per enrolled customer, per authentication or inside processing fees is not said.

Buyers are payments infrastructure, acquirers, processors and terminal makers, plus the merchants behind them, across retail, parking and transit. Banks deploying it for their own customers do not appear in the material.