Face scan is actually much easier to defeat than CC details.
Nowadays with VISA '3D Secure' and the equivalent on Mastercard you have to validate your legal name attached to the credit card, this is done via third-party which can request details your bank has on file (often your home address or mobile number), and even while those details are not supposed to be shared with the merchant (we know how careful banks are about keeping control of PII), the core detail - your legal name, is confirmed. It is not hard to tie a user to other data via data brokers once you have their legal name, and credit card number, and any other details they may share with the service (email, phone, etc).