The application underlying the discussed decision concerns a method and system for managing secure electronic payments using biometric authentication (fingerprints), a PIN code, and a stored facial image of the user, allowing transactions without physical money, cards, or mobile devices. The critical feature at issue was the display of a stored facial image of the user to the seller for identity verification, including the sequencing of this display only after biometric authentication and, for transactions exceeding 30 euros, also after PIN verification, which the appellant argued was a safety measure preventing unauthorized third parties from viewing sensitive personal data. The Board of Appeal considered this data protection requirement to be non-technical under the established Comvik approach and found all requests to lack inventive step over a combination of prior art documents D1 and D3.
Here are the practical takeaways from the decision: T 1613/22 (Secure payment/GRE-LAB) of 12 December 2025, of the Technical Board of Appeal 3.5.01.
Key takeaways
The invention
The Board of Appeal summarized the invention as follows:
The invention concerns the management of secure electronic transactions. The system comprises at least one payment device (“terminal”) connected to a server storing user-specific information, including biometric data, a PIN, account data and a picture of a user’s face, all provided during a registration phase. When users want to make a payment, they provide their biometric data (for example, fingerprints) to the payment device. For transactions exceeding a predefined threshold, a PIN is also required. The data are compared with those stored on the server. If the check results are positive, the picture of the user’s face is retrieved from the server and displayed to the seller as a further identity check before authorizing the transaction. In this way, it is possible to perform authentication during a transaction without requiring users to carry cards, cash or mobile devices. The method thus enables fully dematerialized payments with multi-factor authentication combining biometric verification, a knowledge factor (PIN), and visual identity confirmation by the seller.
-
Claim 1 of the Fourth Auxiliary Request
Is it patentable?
The Examining Division’s position
The Examining Division refused the application on the grounds of a lack of inventive step of claim 1 of all requests in view of D1 (US 2015/046328 A1). The Examining Division identified the characterizing features of claim 1, namely the acquisition and storage of a picture of the user’s face and the display of that picture before authorizing a transaction, as the distinguishing features over D1. It argued that systems providing a seller (e.g. a POS clerk) with a registered image of a customer in the context of a payment transaction in order to verify the customer’s identity were already known, and cited D5 (US 2006/069922 A1) as an example thereof. In addition, the Examining Division raised objections of added subject-matter (Article 123(2) EPC) against all auxiliary requests and a lack of clarity (Article 84 EPC) against auxiliary requests 2 to 8 then on file.
The Appellant’s arguments
The appellant argued that neither D1 nor D3 discloses displaying the stored image of the user’s face after the user’s identity has been verified by means of biometric data and after the PIN has been checked. This argument was raised during the examination proceedings in the letter of 15 November 2021 and maintained on appeal. The appellant specifically argued that the feature of displaying the image only after successful authentication constituted a safety measure, ensuring that images of a registered user were not seen by third parties who may have illegally obtained a transaction number. The appellant thus contended that the sequencing of authentication steps, including the conditional display of the facial image based on the transaction amount, represented a meaningful security improvement over the prior art that should be recognized as contributing to inventive step. In a letter dated 12 June 2025, the appellant withdrew its request for oral proceedings.
The Board’s analysis
Main request
The Board agreed with the parties that the distinguishing features over D1 were the acquisition and storage of a picture of the user’s face and the display of that picture before authorizing the transaction. However, the Board departed from the Examining Division’s reasoning based on D5, noting that D5 stores the picture on the user device rather than on a central server, and therefore even a combination of D1 and D5 would not arrive at the claimed subject-matter. Instead, the Board relied on D3 (US 7523067 B1), which discloses a central server storing user-related authentication information including a picture of a user’s face and displaying said picture to a shop assistant for authentication. Since both D1 and D3 concern user authentication in the context of transactions and both disclose combining several authentication methods, the Board found it obvious to add the facial recognition process of D3 to D1 as a further safety measure.
First, second, and third auxiliary requests
The Board found that the amendments in the first and second auxiliary requests (specifying the central unit/server is remote from the payment device and replacing “central unit” with “server”) did not further limit the claimed subject-matter beyond what was already implicit in the main request. The third auxiliary request’s additional feature of the method being carried out “in a dematerialized mode without using physical money, such as banknotes/coins, or credit cards or telephone” was found to be anticipated by D1, which even explicitly mentions avoiding the use of cash or cards.
Fourth, fifth, and sixth auxiliary requests
These requests added the qualification that the image is displayed after authentication and, if the payment exceeds 30 euros, also after the PIN verification. The Board’s analysis proceeded as follows:
- D3 already discloses carrying out additional authentication checks for particularly expensive transactions. The definition of the exact monetary threshold (30 euros) is non-technical and cannot contribute to inventive step.
- The Board acknowledged the appellant’s argument that neither D1 nor D3 discloses displaying the stored image after biometric and PIN verification. In D3, the image appears to be displayed at the beginning of the authentication procedure.
- However, the Board noted that the image is shown to the shop assistant, not to the party requesting the transaction, making it unclear whether it would even be visible to an unauthorized third party.
- Critically, the Board considered the requirement of avoiding the unauthorized display of sensitive personal data (the user image) to be a non-technical requirement. Pursuant to the established Comvik approach, this can be treated as a “given,” i.e. a requirement provided to the skilled person for implementation.
- It would then be obvious to the skilled person to implement this requirement by executing the picture-based identification only after verifying the user’s biometric credentials, especially considering that D1 already discloses displaying a user’s name after fingerprint verification.
Conclusion
The Board dismissed the appeal, finding that claim 1 of all requests (main request and first through sixth auxiliary requests) lacked inventive step over a combination of D1 and D3 (Article 56 EPC). The core distinguishing features of the main request, namely the storage and display of a facial image for identity verification, were found obvious in light of D3’s disclosure of the same concept in a transaction authentication context. For the fourth through sixth auxiliary requests, the additional feature of sequencing the image display after biometric and PIN verification was found to implement a non-technical requirement (data protection/privacy) under the Comvik approach, which the skilled person would have implemented in an obvious manner. The specific monetary threshold of 30 euros was likewise deemed non-technical. The application was therefore refused.
More information
You can read the full decision here: T 1613/22 (Secure payment/GRE-LAB) of 12 December 2025, of the Technical Board of Appeal 3.5.01.

Patrick is a European patent attorney at BARDEHLE PAGENBERG. He specializes in software patents in Europe both from a prosecution and litigation point of view.





