The Problem
Facenex explored a way to pay at a merchant terminal using a face scan and PIN. The system needed to authenticate the user quickly, resist spoofing and work with the merchant's existing payment processor.
What We Built
Facenex is a facial recognition payment system. The end user walks up to a merchant's PoS terminal and is authenticated by a face scan and PIN. The system then authorises the charge. The flow did not require a card, wallet or phone.
How It Works
- Enrolment — users register their face and set a PIN via a mobile app. Face templates are stored as encrypted vector embeddings, never as raw images.
- Transaction — at the PoS, the merchant enters the amount. The user looks at the camera and enters their PIN.
- Authentication — the system extracts a face embedding from the live camera feed, matches it against the enrolled template, and verifies the PIN. Two-factor: something you are (face) + something you know (PIN).
- Authorisation — on successful authentication, the charge is processed through the payment gateway. The design targeted a flow under 3 seconds.
Architecture
- Biometric pipeline — face detection (Haar cascades / SSD), alignment, embedding extraction (deep neural network), and vector matching (cosine similarity against enrolled templates).
- Liveness detection — the system checks for blink rates, head micro-movements, and depth cues to prevent photo/video spoofing.
- PIN hardening — PINs are hashed with bcrypt and salted. Rate limiting prevents brute force. After 3 failed attempts, the account locks.
- PoS integration — the terminal software runs on Android with a React Native frontend. It communicates with the backend via encrypted WebSocket for real-time authentication.
- Payment gateway — Facenex integrates with existing payment processors. It handles authentication; the gateway handles the money movement.
What We Learned
Face matching, liveness checks and PIN verification share the same time budget. Improving one part can increase latency or reject more legitimate users. Facenex combined on-device detection with server-side matching and PIN verification to work within that constraint.