My original comment said I doubted it was used as a primary means of identification. I have no doubt that they use it as a second factor, but using it as the only factor (ie. based on a face scan alone, determining who to bill) is doubtful.

For what it's worth, I can confirm that I've seen my girlfriend use facial recognition to identify and authenticate herself and authorize payment via Alipay at a self checkout at a grocery store, using a camera on the self checkout machine. She probably got a message on her phone once she did, but there was no second factor.