They are definitely not doing identification (1:whole_database) for payment, that would be ridiculous.

I'm sure they are matching against very small subset. Most likely they are getting data from mobile phone operators on who's currently around the entrance