Someone who knows this stuff better than me maybe can answer this: wouldn't this be relatively easy to spoof with a high-resolution photo of someone's palm?

For that matter, I'm sure I leave palmprints everywhere, could someone spoof my hand and start using it to authenticate as me?

Biometrics are good for authentication but have generally been poor for identification.

Perhaps they should combine the hand scan tech with a PIN to do basic multi-factor authentication and act as a safeguard against accidental misidentification?