Tencent wants you to pay with your palm. What could go wrong?

Would you want a bottle of soda for just one cent?

Before you say yes, there's a catch: You have to pay by scanning your palm and sharing your information with a Chinese tech giant.

This was the proposition Tencent made to a handful of Chinese consumers recently, as seen in a video posted on Douyin, the Chinese version of TikTok, in late September.

In the video, a person who appears to be a WeChat employee can be heard instructing people to put their hand in front of a recognition device and record their palm prints in exchange for the special soda deal. New feature of WeChat Pay. Everyone is welcome to try our service and support us," the voice says.

The user who later uploaded the video asks when this feature was released, and the voice replies that it started half a year ago but recently came to the Chinese city of Guangzhou.

As it turns out, Tencent, the company that owns the payment system WeChat Pay, has been testing out palm-print payment devices in the country for months, according to social media posts collected by MIT Technology Review.

Supporters of palm-print recognition say the technology is more accurate and more secure than other forms of biometrics, and it's harder to identify a person if their palm-print image gets leaked. So while fingerprint and facial recognition has already been widely used in identity verification scenarios, the technology that distinguishes different palms-including the visible lines and the veins beneath the skin-has quickly become the next frontier of biometrics recognition.

While a lack of training data has slowed the technology's development, it is now almost ready for mass commercial application, say several researchers involved.

I can tell you, very honestly, we've been working on palm-print recognition for over 20 years. It's ready," says David Zhang, a leading scholar in palm-print recognition and a Shenzhen-based professor at the School of Data Science in the Chinese University of Hong Kong. Right now, what I'm focusing on and excited about is the application."

That's where Tencent is stepping in. The new tech is undoubtedly appealing as the company competes with Alipay for dominance. And as China continues to grapple with ongoing zero-covid policies that mean people still wear masks and avoid physical contact, allowing people to pay by waving their hands up to a few inches from the camera seems preferable to facial or fingerprint recognition. So by offering users small cash incentives in exchange for their participation and data, Tencent is one step closer to spreading the use of palm-print recognition through everyday life-and on a truly massive scale.

While Amazon was the first major tech company to officially deploy palm-print scanners in its brick-and-mortar stores in the US (it's spread to nearly 180 locations since 2020), the tech could soon become ubiquitous across China thanks to WeChat Pay's wide adoption in all types of stores; WeChat Pay is already used by over 800 million individuals and 50 million vendors in China.

But even with palm-print recognition's benefits, installation to such a ubiquitous extent would still come with privacy risks for consumers, not to mention practical complications. Indeed, analysts and privacy activists remain skeptical that palm-print recognition should be used in payments-and what would happen if they are.

Retailers get hacked all the time. When most retailers get hacked, at worst you have to change your credit card number. But you can't change your palm print if that gets compromised," says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project (STOP). So we look at this as a way for people to potentially save a couple of minutes in line at the price of their biometric privacy for the rest of their lives."

WeChat's secret trials

In late 2021, Chinese media first reported Tencent was exploring a payment system that relied on scanning users' palm prints. At the time, the company responded that it was only an internal research project and there was no plan to apply the tech in real-life settings.

That has changed a year later, as Tencent has been testing palm-print recognition devices for months in Shenzhen, the city where the company is headquartered, and Guangzhou, another megacity 65 miles away.

As shown in social media videos uploaded as early as July, and which I first reported on earlier this month in my China Report" newsletter, palm-print payment devices for Tencent's WeChat Pay system are already being used in cafes, bakeries, and supermarkets. In most cases, WeChat offers a small discount, often less than 10 RMB ($1.37), for customers to try out the new feature and submit their palm-print data. The tactic is similar to that of Amazon, which offered a $10 credit last year for users who enrolled in its palm-print checkout system, Amazon One.

The WeChat payment devices in these videos are iPad-sized white boxes with a screen showing instructions and a camera capturing the palm data. They are likely still in the trial phase, as they are often shown alongside notes saying trial location for WeChat palm print scan payment" or Internal testing. Please don't tell external people." In one photo posted online, a written warning states that photography of the device is prohibited.

There are other signs that Tencent is close to formally releasing the palm-print payment technology: It recently trademarked several names like (WeChat palm scan)" and WePalm," and secured patents for related camera devices. And within WeChat, the super app used by more than 1 billion people, a new feature was released last month called WeChat palm scan payment," though only those who have registered at one of Tencent's in-store palm-print scanners can access the feature.

Compared with Amazon, which has hundreds of Whole Foods and other retail stores in the US, Tencent has the potential to execute a quicker and wider push of palm-print recognition payment, since almost every store and vendor in China has adopted WeChat Pay (or its rival Alipay) during China's fintech revolution. The company sells devices similar to credit card readers that help vendors scan and process QR codes from customers, which is currently the most popular way to make a payment without cash. However, it already has some biometric recognition payment setups: One Tencent device, Frog Pro, which looks like a McDonald's self-serve kiosk but with a sophisticated camera on top to enable payment by facial recognition, was released in 2019 and retails for 1,999 RMB ($276).

Biometrics recognition payment has a giant window of opportunity when the era of 5G and multi-screens comes, because the devices can help [fintech companies] connect with vendors and users," says Wang Pengbo, a Beijing-based senior finance analyst at BoTong Analysys. That's an important reason why payment giants are placing facial recognition payment devices in stores in advance [of wide adoption of the technology]." He suspects they may be laying the groundwork now for palms in the same way.

Wang says the introduction of a novel way to pay also serves Tencent's goal to compete with Alipay, which currently holds onto a larger share of payments in the Chinese payment market.

The quest to improve tech that recognizes palm prints

It's unclear whether Tencent's devices that were captured on social media are meant only for testing the functionality of palm-print recognition technology or also intended for collecting data to help fine-tune it. None of the relevant videos indicate that customers are being told about how their data will be used. Tencent did not respond to a list of detailed questions sent by MIT Technology Review.

But it is likely that the company (as well as Amazon) is doing the latter-essentially paying users to give it data that can be used to improve its proprietary recognition algorithms. Amazon One's terms and conditions, for instance, say the company stores palm signatures to provide, personalize, and improve the Service." Amazon didn't respond to questions on how it handles users' palm-print data.

A lack of this exact kind of data hampered palm-print recognition technology for years. Unlike faces, people don't put photos of their palms online, let alone the veins inside their palms. Instead of relying on public images-like the millions of photos of celebrities and ordinary people that powered the supercharged growth of facial recognition technology-researchers need to manually collect data from experiment participants to enhance their computer vision algorithms. This process is much more costly and time-consuming. As a result, while there are open and free databases of more than 100,000 individuals' faces, the largest public database of palm photos today involves only 600 individuals.

You can't download much palm-print data from the internet. I think that's why research on facial recognition has dominated this field," says Kai Zhao, a postdoctoral researcher at the University of California, Los Angeles, who previously worked at Tencent's AI research lab YouTu. Zhao estimates that 95% of the research in biometric recognition focuses on facial recognition.

Nevertheless, he and other researchers have focused on improving palm-print recognition algorithms over the years, crafting different ways to get over the barriers.

Zhao developed a method to use synthetic models to generate fake palm-print data-creating massive datasets that resemble creases in palms without using real palm photos. While the data isn't collected from real people, it can still be used to improve the recognition algorithm, according to a paper Zhao submitted to the European Conference on Computer Vision in 2022. Once we have generated about 200,000 to 300,000 images, the precision rate will be close to 100%. That's a clear improvement," he says. Previously, the precision rate for palm-print recognition algorithms trained on small samples of real photos was about 98%.

Meanwhile, Zhang, from the Chinese University of Hong Kong, has remained focused on real world data. One of the first academics in the world to research palm-print recognition, starting in the late '90s, Zhang says that his team has developed its own device to scan palm prints and it has managed to collect information from more than 10,000 people. While the data is not currently publicly available, he says the team plans to publish an academic paper soon.

Palm-print recognition combines [the advantages of identifying] the minutiae in fingerprints, the texture in irises, and the geometric information in faces," Zhang says. His team's research has found that, when comparing biometrics collected from the same group of individuals, the precision rate of palm-print recognition is 10 times higher than that of fingerprints or faces.

The shaky ground for adopting biometric-based payments

The proposal of palm-print recognition payment seems simple: With it, there's no need to bring a wallet, credit card, or even a cellphone to complete an in-store purchase. But there are many practical and ethical challenges to that promise.

First of all, the QR code system works very well already and is quite convenient. It's not like people go anywhere without their phones," says Martin Chorzempa, senior fellow at the Peterson Institute for International Economics and author of a new book, The Cashless Revolution.

This is the same reason why even as both WeChat Pay and Alipay have pushed for the adoption of facial recognition payment for years, the idea has failed to become very popular. An April 2022 survey of some 58,000 Chinese mobile payment users shows that 95.7% of them choose QR code as their primary payment method. And 20.2% of all those surveyed find the use of biometrics in payment unacceptable.

The idea that biometrics recognition provides convenience for consumers is an efficiency delusion," argues Cahn of STOP. Replacing traditional cashiers with self checkouts with biometrics recognition, like Amazon did, only offloads more work to buyers. This isn't for the convenience of the customers. This is for the convenience of the store that wants to fire employees and have even more tracking of our decisions," he says.

The biggest barrier to adoption, though, may be the concern of privacy invasion and data security, which comes with any use of biometrics. People around the world, including in China, have become increasingly aware of the risks of giving out their biometrics to companies and governments, no matter what advantages are promised in exchange.

On the security front, researchers and companies working on palm-print recognition say it's relatively more secure than facial recognition in a few ways: Palms have more details to tell one person from another, preventing misidentification; it's harder to scan a person's palm, usually curled up, without their consent; and in the case of a data breach, it's harder to match palm data with a person's identity, unlike an instantly recognizable face.

But those benefits seem marginal when people can choose to opt out of any form of biometrics payment and instead stick with more traditional methods. Chinese social media users have already responded to the news of WeChat Pay's palm-print recognition trials with suspicion and snark. Under one video of a WeChat Pay palm-print scanner device posted on Douyin on November 1, the top comment asks: So they have finished collecting all other biometrics and moved onto palm prints? Irises will be next, and then DNA." It has more than 103,000 likes.

At the end of the day, no matter how safe a database is or how much effort companies and governments put into data protection, there's no guarantee that leaks and hacks won't happen. Users also have no insight into how the data will be used internally or sold to external data brokers until it's too late.

Oftentimes, what few rules companies impose on the ways that they can use our biometric data can evaporate in a heartbeat if the corporate unit that owned that data is sold off or the company goes bankrupt," says Cahn. Suddenly it will be a free-for-all for our biometric data."

The future of palm-print recognition in China

In some ways, the pandemic and China's strict zero-covid policies provide both the right time and right place for palm-print recognition tech to grow.

As Chinese people continue to wear masks in public spaces, it creates an obstacle for facial recognition. Plus, the requirement for enhanced cleaning and less surface contact begs for contactless payment options (and precludes fingerprints). So palm-print recognition devices that scan and recognize patterns from a distance of a few inches would seem to be an ideal alternative.

Payment companies aren't the only ones who've noted the tech's potential. Since the two main advantages of palm-print recognition are its high accuracy and high anti-fraud capability, I think it should be used in areas that need maximum confidentiality," like banks and military systems, says Zhang.

Other Chinese companies are already trying to figure out their own ways of commercializing the new technology. Sheng Yanqiao, director of the biometrics intelligence department at the Shanghai-based AI company DeepBlue Technology, says the use of palm-print recognition is helpful to smaller, closed communities like a school or a gym, where an internal system is needed to authenticate members and complete services. The company sells several palm-vein recognition products.

The classic application scenario is the swimming pool in a gym," Sheng says. If you lose your locker bracelet when you are swimming, you won't be able to get your clothes." He argues that verifying palm veins is the best authentication method in this situation, since people may have privacy concerns with facial recognition cameras in locker rooms, and fingerprints are hard to recognize once soaked in water.

Governments, too, are now stepping into this space. On October 28, the city of Shenzhen debuted a new subway line that allows certain demographic groups (seniors, veterans, and people with disabilities, among others) to register their palm-vein information and use it to swipe" into the subway station for free. (The same line also allows anyone to pay subway fare through facial recognition.)

The government collection of palm-print data of course creates clear potential for additional abuses by the Chinese surveillance state. In fact, Melux, another Chinese palm-print recognition tech company that built the devices used in the Shenzhen subway line, was founded by Xie Qinglu, who also built a data processing system called YISA OmniEye for China's mass policing surveillance infrastructure Skynet. The company publicly says its palm-print scanners, which will be part of an unnoticeable governance" system, have already been used for local government offices, public services, customs, financial services, and more. Melux did not respond to an interview request by MIT Technology Review.

The thing that I'd worry about is, we've seen how QR codes have gone from something that generate a lot of financial freedom for the Chinese, to something that you have to scan anytime you go anywhere so the government can lock you down for covid controls," says Chorzempa, noting there's a real fear of the nascent palm-print recognition tech repeating that trajectory from payment tool to surveillance tool. It can be a slippery slope. Once something becomes ubiquitous and convenient, then it also becomes an [alluring] tool for the government to increase social control."