Pay With Your Face, Bank With Your Voice: How Far Has Device-Free Payment Come?

At the end of September 2026, Revolut began trialling Pay with Smile in the UK, a service that lets shoppers approve payments using facial recognition, without a bank card or phone. Taking this as our starting point, we look at where face- and voice-based biometric authentication stands today at the checkout and in banking, what business and privacy questions it raises, and which UX problems need solving before users will trust it.

Revolut is rolling out the feature alongside Revolut Register, its new point-of-sale system for hospitality businesses; merchants pay a 0% processing fee on these transactions. The first three-day trial ran from 24 to 26 September at the Bloomsbury, Chelsea, and Soho branches of London coffee chain Kiss the Hippo, where customers paying with their face could get a coffee for £1.

Paying with your face is not a new idea, but Revolut's approach differs from earlier attempts in several ways. It is also worth looking at voice payment, which has developed very differently.

How Does Pay with Smile Work?

Users have to switch the feature on separately, either in the app or at the terminal the first time they pay. After that, all they need to do is look into the camera of a compatible terminal – despite the name, no smile is required: the system compares the camera image with the selfie the customer already took when opening their account, as part of the know-your-customer (KYC) process. The payment then goes through Revolut Pay.

This points to one of the solution's main advantages: no new face scan is needed, either at the merchant or in another app – switching the feature on in the Revolut app is enough. With earlier face-payment systems such as Poland's PayEye or the US-based PopID, users had to register their face in a separate app, and the provider had to win over every user one by one. Revolut has tens of millions of customers whose facial images it has already verified, so it skips this step entirely.

According to the company, authentication is end-to-end encrypted and takes place within Revolut's own systems; merchants store no biometric data. The system also checks that a real, live person is in front of the camera. Customers who pay with their face earn triple RevPoints.

Why Can It Be Free for Merchants?

The 0% fee looks generous at first, but the explanation is simple. With a conventional card payment, the merchant pays a fee that is shared between the card-issuing bank, the acquiring bank, and the card scheme. In the EU and the UK, interchange fees on consumer cards are capped by law at 0.2% for debit cards and 0.3% for credit cards. The merchant's total cost is usually higher, since acquirer and scheme fees come on top.

Pay with Smile bypasses this chain. Because both the shopper and the merchant bank with Revolut, the payment is an internal, on-us transaction: the money moves within Revolut's own system, with no card network involved. A transaction like this costs Revolut next to nothing, so waiving the fee means no real loss of revenue.

The aim is to replace checkout setups that are often pieced together from several separate systems with a single, unified payment system

The revenue comes from elsewhere. The zero fee only applies to merchants using Revolut Register. The dual-screen POS system, which also has a built-in eSIM, lists at £699 plus VAT, although the first terminal is offered at half price until the end of the year. Merchants who install it are likely to use Revolut for their other banking services too. According to Alex Codina, General Manager of Merchant Payments at Revolut Business, the aim is to replace checkout setups that are often pieced together from several separate systems with a single, unified payment system.

Account-to-account (A2A) payments are becoming serious competitors to cards, and the card schemes are responding. In June 2025, Visa launched its own A2A service in the UK, initially for bills and subscriptions, with card-style buyer protection and dispute handling.

Revolut Isn't the First

Device-free biometric payment has a history going back more than two decades, with plenty of failures along the way. US company Pay By Touch offered fingerprint payment from 2002 and at its peak was in several hundred grocery stores, but it filed for bankruptcy protection and shut down the service in 2008.

China was the first market where paying with your face went mainstream. In 2017, Alipay launched its Smile to Pay service at a KFC restaurant in Hangzhou, where customers could pay at the self-service kiosk by having their face scanned and entering their phone number for added security. The technology has since spread widely across the country. In China, however, state and commercial digital identity are closely intertwined, so the situation isn't comparable to Europe's.

PayEye combines iris and facial recognition, and in June 2024 it launched a pilot with Mastercard in five stores of the Polish retailer Empik (source: Mastercard)

In the West, the major card schemes have focused on standards instead. Mastercard launched its Biometric Checkout Program in 2022. Rather than offering its own hardware, it sets common rules for biometric checkout solutions that participating banks, merchants, and technology companies must follow. One of the programme's partners comes from Central and Eastern Europe: Wrocław-based PayEye combines iris and facial recognition, and in June 2024 it launched a pilot with Mastercard in five stores of the Polish retailer Empik. This was the programme's first trial in Europe.

These systems all face the same problem, though: users have to be persuaded one by one to register their biometrics, and merchants have to be persuaded to buy specialised terminals. Revolut doesn't have the first problem, since its customers are already on board. It still has to convince merchants to choose Register, and the zero fee and the half-price terminal may help here.

You Can't Replace Your Face

The launch has also drawn criticism from privacy groups. UK campaign group Big Brother Watch warned that while a passport can be replaced, a face cannot, and leaked facial data can be used to get around identity checks and to create deepfakes. The group also pointed out that in September, Revolut had handed over some customers' data, including facial data, to a fraudster. According to Pay with Smile's privacy notice, Revolut deletes the facial data generated from the checkout photo immediately after identification, but keeps the photo itself for fraud prevention and to investigate disputes. This falls under the company's general data retention rules, which state that in the UK data is generally kept for up to seven years after the customer relationship ends.

In the UK, biometric data used for identification counts as special category personal data. Processing it for commercial purposes typically requires explicit consent, and according to guidance from the Information Commissioner's Office (ICO), consent is only freely given if shoppers can choose another, non-biometric payment method without being disadvantaged.

If Revolut launched the service in the EU, it would also have to comply with the AI Act. The regulation classifies remote biometric identification as high-risk, but not biometric verification, which only confirms that someone is who they claim to be. Technically, Pay with Smile is identification: the terminal doesn't know who is standing in front of it, and the system searches for the shopper's face among the customers who have switched the feature on. It can hardly be called remote, however, since shoppers choose this payment method themselves and take an active part in it.

Voice: Command or Identifier?

Besides the face, the voice could also let us pay without reaching for a card or phone. With voice payment, however, two different things often get lumped together. In the first case, the voice is a command: the user says what they want, and the system uses the account linked to the device and the usual authentication. In the second, the voice is an identifier: voice biometrics analyses the unique characteristics of a voice, such as vocal cord vibration, the shape of the mouth, and the speaking pace, to create a voiceprint and identify the speaker from it.

At the checkout, voice payment has not caught on so far, for obvious reasons. Saying a payment instruction out loud while waiting in line, within earshot of others, is awkward, and background noise makes speech recognition harder too.

Voice biometrics has, however, proved its worth elsewhere – in telephone banking. According to a 2021 announcement from HSBC UK, its Voice ID system prevented almost £249 million of attempted fraud in a single year. The advantage is that customers don't have to remember passwords or answers to security questions: they simply say a short phrase, and the system recognises them by their voice.

Its weaknesses have long been known too. In 2017, a BBC reporter's twin brother imitated his voice and got into the reporter's HSBC account on the eighth attempt. A far bigger problem today is AI voice cloning. A lifelike copy of someone's voice can be made from just a few seconds of public audio, such as a social media video. ASVspoof, an international research challenge, has for years measured how well voice authentication systems filter out machine-generated or manipulated speech. In July 2025, speaking at a Federal Reserve conference, OpenAI CEO Sam Altman warned financial institutions that AI had already fully defeated voiceprint authentication.

The prevailing view among security experts today is that voice biometrics alone is not enough for high-risk financial transactions: it can only be used safely in combination with other authentication methods and analysis of user behavior.

Voice as an Interface

Voice-based financial services still have a future, but the role of voice is changing. Voice is increasingly used to operate services rather than to identify users. Banks' digital assistants accept requests by voice and in writing, and AI-based systems handle increasingly complex tasks. Transactions, however, usually have to be approved elsewhere, for example in the mobile app, because in well-designed solutions the language model only interprets intent, while execution stays within a pre-audited, closed system. A Hungarian example is K&H Bank's digital assistant Kate, which takes instructions in writing and by voice: to make a transfer, customers only need to say who they want to pay and how much, and then approve the order themselves.

Voice is most useful where the screen is impossible or hard to operate by hand, for example, while driving, or for users with visual or motor impairments.

Accessibility is also an important issue with face payment, except that there the camera can be the barrier. The terminal camera is mounted at a fixed height, which can be a problem for wheelchair users, while clothing that partly covers the face or a facial injury can make recognition less reliable. International testing has also shown that the accuracy of facial recognition algorithms can vary with age, gender, and skin tone. Other payment methods are therefore needed not only for legal reasons but also so that everyone can use the service.

Where Does the User Need to Decide?

The main promise of device-free payment is speed, yet even here, users have to make conscious decisions at certain points. The UX question is where those points should be, and where the process can be left to the system.

With face payment, the first of these points is intent. A glance on its own doesn't mean someone wants to pay. That's why Revolut has shoppers first tap the Pay with Smile button on the terminal screen and only then look into the camera. According to Mastercard's announcement, PayEye calibrates its terminals so that an accidental glance doesn't trigger a payment.

The second point is consent. Revolut asks for permission twice: once in the app, when the feature is switched on, and again at the till. Users can pause the feature or revoke it entirely, and the two mean different things. When it is paused, the facial data is kept; when it is revoked, the company deletes the data and the user has to register again to use the service. The interface has to make this difference clear, otherwise users may believe they have deleted their data when they have only paused the service.

It's important that an accidental glance doesn't trigger a payment (source: Revolut)

The third point is the balance between convenience and security. Revolut also recommends setting a four-digit Pay with Smile code, separate from the app passcode, which the company says speeds up payment. The code is optional, so users decide for themselves whether to take an extra step at registration in exchange for faster payments.

The fourth is error handling. If recognition fails, the shopper isn't left stuck at the till. Register immediately offers card, phone, or Revolut Pay instead. And if they feel the system rejected them by mistake, they can request a human review through the in-app chat.

Voice interfaces have to answer different questions, the most important being what can be said out loud. Kate, for example, never reads out personal data: it only shows it on screen and tells the user so. It only replies by voice when spoken to; otherwise it communicates in writing. It handles one request at a time, and if a sentence is too long or complex, it asks the user to rephrase it more briefly. Before a transfer, it shows a summary that the user can check and edit. Only text transcripts of conversations are kept, not the audio recordings.

What Could Come in the EU?

Pay with Smile is currently only available in the UK, and Revolut has not said when it might launch in other countries. In the EU, however, it would start from an unusually strong position: a large share of its customers live in the EU, and it already has their account-opening selfies. If Register comes to the EU, these customers could pay with their face without any separate registration.

EU regulation partly points in this direction. A political agreement on the new Payment Services Regulation (PSR) was reached in November 2025, and the regulation will require providers to also offer a strong customer authentication method that doesn't depend on a smartphone. This could work in favour of phone-free solutions as well. At the same time, GDPR consent rules and the AI Act impose strict conditions.

Revolut's move shows that payment is becoming less and less tied to a physical device, whether a card or a phone. At the checkout, it is no longer just payment methods that compete: providers are fighting to lock in both the merchant and the shopper. Shoppers, for their part, have to decide which provider they trust with their biometric data.