User authentication during transactions

Abstract

Image data 250 of a user is received and processed by one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data. Authen

Description

The present invention relates to an apparatus, a method, a registration apparatus, a registration method, a server apparatus and a server method for user authentication. Some transactions, for example, transactions involved in a tax free shopping process, are performed at multiple stages and require the use of information from earlier stages of the process to be provided at a later stage of the process. The invention is set out in the attached claims. The present techniques will be described further, by way of example only, with reference to configurations thereof as illustrated in the accompanying drawings, in which: Figure 1 schematically illustrates a sequence of interactions carried out in a tax free shopping process; Figure 2a schematically illustrates a system comprising an apparatus, a registration apparatus, and a server apparatus according to various configurations of the present techniques; Figure 2b schematically illustrates interaction between apparatuses according to some configurations of the present techniques; Figure 2c schematically illustrates interaction between apparatuses according to some configurations of the present techniques; Figure 2d schematically illustrates interaction between apparatuses according to some configurations of the present techniques; Figure 3 schematically illustrates details of an apparatus according to various configurations of the present techniques; Figure 4 schematically illustrates details of a registration apparatus according to various configurations of the present techniques; Figure 5a schematically illustrates an arrangement of image receiving circuitry according to various configurations of the present techniques; Figure 5b schematically illustrates an arrangement of image receiving circuitry according to various configurations of the present techniques; Figure 6 schematically illustrates details of processing circuitry according to various configurations of the present techniques; Figure 7a schematically illustrates use of a registration apparatus according to some configurations of the present techniques; Figure 7b schematically illustrates use of a registration apparatus according to some configurations of the present techniques; Figure 8 schematically illustrates use of an apparatus according to some configurations of the present techniques; Figure 9 schematically illustrates use of an apparatus according to some configurations of the present techniques; and Figure 10 schematically illustrates use of an apparatus according to some configurations of the present techniques. At least some configurations provide an apparatus comprising image receiving circuitry configured to receive image data of a user, processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data. The apparatus also provides authentication circuitry configured to trigger a lookup in a database using the biometric data in order to identify account data associated with the user, and is provided with transaction circuitry responsive to identification of the account data, to perform one or more steps of a tax refund transaction and to update the account data to comprise transaction data indicative of the tax refund transaction. Many countries offer the opportunity for a user, typically a foreign visitor, to purchase some items tax free on the condition that those items are exported. In order to benefit from such a system and claim a tax refund for purchases, a user may be required to prove that the purchased items are exported. This places a burden on the user who must retain proof of purchase information for each item purchased (potentially at a plurality of stores) and present this information at a customs desk or self-service kiosk at an exit point from a country (territory). In order to reduce this burden, these examples store transaction data in an account that is associated with the user. The account data may be stored in one or more host system servers at a centralised location. During one or more steps of the tax refund transaction the user identifies themselves using facial recognition. The facial recognition is based on image data (which may include video data) of the user which is processed to generate biometric data that forms the basis of a lookup in the database. The user’s account can then be accessed and updated to store details of a transaction (e.g., a purchase by a user or a validation process performed by the user). There are multiple benefits to this system. First, the user is not required to carry specific identifying information, such as a passport, visitor card, or token, in order to associate a tax free transaction with their account. Second, there is improved security. It is difficult to fool facial recognition software, the use of which greatly reduces the likelihood that one person’s account data could be used by a different person (e.g., to falsely claim back tax for another person’s purchase). In some configurations the account data comprises identification data and the authentication circuitry is configured to determine eligibility of the user for the tax refund process based on the identification data; and the identification data comprises information identifying the user and identifying a country of residence of the user, and the determination of eligibility is performed based on a location of a merchant and the country of residence. The user may associate the identification information with their account, for example, on registration. This information can then be provided to a merchant, customs operator, or self-service kiosk, to indicate whether a particular user is eligible for the tax refund process. The eligibility determination may include the step of determining that the user’s country of residence is different to the country in which the merchant is located (a location at which a sale takes place). In some configurations, the identification data may also include a user’s flight details identifying a date of arrival in the country and a date of departure from the country. As a result, the user would not need to carry proof of eligibility for tax free shopping. In some configurations the image receiving circuitry comprises a camera configured to acquire the image data. The camera may be integrated into a merchant system, customs system, or kiosk. Alternatively, a separate camera connected (wirelessly or using a cable) to the merchant system, customs system, or kiosk may be provided. In some configurations the apparatus comprises communication circuitry configured to transmit a request for the image data to a user mobile device, and the image receiving circuitry is configured to receive the image data transmitted from the user mobile device in response to the request. The apparatus therefore need not necessarily be provided with a camera but instead can make use of the user’s mobile device (e.g., a mobile phone or tablet). The request for the image data may be received using an existing application on the user’s mobile or a dedicated application may be provided for communication with the apparatus. The apparatus may also be configured to transmit the request in the form of an email requesting that the user submits the image data. These options result in improved flexibility of the system. In some configurations the one or more steps of the tax refund transaction comprises one or more steps relating to a purchase of goods by the user, and the transaction data comprises information identifying the purchase of the goods. The information identifying the purchase of the goods may include a price of the goods, and / or a tax classification of the goods indicating whether the goods are of a type that can be purchased tax free. The steps relating to the purchase may include the purchase itself and / or may relate to one or more subsequent steps to register the sale as a tax free sale. In some configurations the one or more steps of the tax refund process comprises a validation process performed at a customs station; the validation process comprises retrieving one or more items of stored transaction data each identifying one or more purchases made by the user and determining whether each of the one or more purchases is eligible for a tax refund, and in response to a determination that each of the one or more purchases is eligible for a tax refund, issuing the tax refund; and the account data comprises payment information associated with the user and issuing the tax refund comprises refunding a refund amount to a financial account associated with the payment information. The customs station (validation station) may be a human operated customs station or a self-service kiosk. The customs station may be provided with one or more rules defining a “green channel” situation providing automatic approval for low value items and / or for purchases by travellers from particular countries, and a “red channel” situation, for example, for high value purchases in which a user is required to present the goods purchased to a customs officer for approval. The customs station may be provided in an airport, at a ferry port or any other entrance / exit point of a country (territory). Issuing the refund (e.g., paying the refund to the user) may be carried out at a next opportunity once the determination has been made or may be carried out after a short delay, for example, to allow one or more further checks to be carried out. In some configurations the biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selected to maximise variation in the index resulting from differences between respective facial features of different users. The indexing function may take, as an input, a pre-processed image obtained by performing an aligning, cropping and / or colour balancing process on the image data. The indexing function is designed such that an index (unique string identifying the user) generated for a user will be sufficiently close to an index stored in association with that user’s account independent of the user’s environment (e.g., lighting conditions and / or interference from external sources such as rain distorting the image data), whether the user’s face is partially obscured (e.g., the user is wearing glasses), or a style of the user’s hair. In some configurations, the indexing function may be provided by one or more off the shelf facial recognition algorithms that uses still image data and / or moving image data of the user. In some configurations the indexing function comprises performing measurements relating to the one or more facial features, quantising at least one of the measurements into a plurality of bins, and encoding, into the index, information identifying a bin of the plurality of bins closest to the at least one measurement. Typically, measurements of the facial features of a same user will vary slightly based on, for example, image resolution, imperfections in the camera optics, and changes in facial expression of the user. By quantising the measurements, i.e., providing a coarse grained approximation of the measurements, the indexing function is able to neglect such minor variations. In some configurations, one or more filtering operations may be applied to the image data before the measurements are performed and / or one or more filtering operations may be applied, subsequently, to the measurements. The level of quantisation applied to each measurement need not be the same. Some measurements of the user’s face may be more sensitive to noise and environmental factors than others. Measurements that are known to be insensitive to noise may only need to be quantised on a fine scale whilst measurements that are known to be more sensitive to noise may need to be quantised on a coarser scale. The quantisation may be applied on a per measurement basis where each measurement is individually quantised into its own set of bins. Alternatively, or in addition, one or more measurements may be quantised in dependence on one another. For example, a ratio or a sum of two or more different measurements may be quantised in addition to at least one of the individual measurements. In some configurations, the one or measurements are quantised using multivariate statistics. In some configurations the indexing function comprises quantising each of the measurements into a corresponding plurality of bins and encoding, into the index, information identifying a corresponding bin closest to each of the measurements. Whilst, in some configurations, the plurality of bins are identically sized bins, this need not be the case. Rather, in some configurations one or more different sized bins may be provided for a single measurement. In some configurations, the indexing function may encode a confidence factor indicating how close the measurement is to an edge of the bin (quantised region). In some configurations the indexing function comprises encoding into the index, information identifying at least a second closest bin to the at least one measurement. The aim of quantisation is to reduce the sensitivity of a measurement to variance in the image data. However, where a measurement sits close to a quantisation boundary, inaccuracies (e g., rounding errors) may be introduced as a result of the quantisation. In these configurations, the indexing function is sensitive to such inaccuracies and identifies a second closest bin for the measurements. The indexing function may identify, as the closest bin, the bin having a central point that is closest to the measurement. The second closest bin may be identified, for example, as the bin having a central point that is second closest to the measurement. Alternatively, the second closest bin may be a bin other than the closest bin having an edge (maximum or minimum value that would fall within that bin) that is closest to the measurement. In some configurations the plurality of bins may comprise overlapping bins. Such an approach may reduce ambiguity of measurements that fall close to a quantisation boundary. In some configurations the indexing function comprises encoding the information using a hash function. The hash function may be a lossy hash function configured to compress the information generated from the one or measurements. In some configurations the measurements comprise one or more of: a separation distance between two of the one or more facial features; a depth of one of the one or more facial features; a position or shape of one or more facial contours; and a plurality of similarity scores each indicating a similarity between the one or more facial features and a plurality of predefined eigenfaces. The distance between the one or more facial features may include a separation between any combination of the eyes, ears, nose, chin, forehead. Further facial features may include a size or shape of the face and / or the one or more facial features. The measurements may also comprise any number of relative measurements or ratios relating to these features. The term eigenfaces comes from the term eigenvectors which is used to refer to a set of basis vectors in a vector space, a combination of which can be used to generate any vector in that vector space. Similarly, the term eigenfaces is used to refer to a library of facial images which are themselves representative of a much larger set of possible faces. The eigenfaces define a space of possible faces with any face in that space being identifiable as a linear combination of the eigenfaces. Naturally, there may be technical difficulties associated with providing a complete library of eigenfaces that covers the space of all possible human faces. However, the aim of such a method is to find a unique approximation to each human face rather than to accurately reproduce each human face. By providing a library with a sufficient number of different eigenfaces any human face can be mapped onto a nearest face belonging to the space of faces spanned by the eigenfaces. The eigenfaces may comprise image data generated from individual human faces, computer generated faces, composite images generated from any combination of different human faces or computer generated faces, processed / filtered faces, and / or idealisations of facial features. The decomposition into similarity scores may be generated through a statistical / mathematical decomposition of the one or more facial features in order to map the facial features onto a weighted sum of the plurality of eigenfaces. For example, a given face image may be decomposed using a principle component analysis to identify a weighted combination of the eigenfaces (weighted by the similarity scores) that, when summed using those weights (the similarity scores), provide an accurate representation of that face. In some configurations, the decomposition may be based on an initial coarse discretisation of the image data. In some configurations the authentication circuitry is responsive to an indication that the lookup process cannot identify a unique account, to request further identification information, and to trigger a further lookup based on the further identification information in order to identify the account data. Whilst facial recognition algorithms provide an accurate method of identifying users, it may not always be possible to provide such data. For example, there may be situations where it is not possible to verify a user’s identity using facial recognition (e.g., because of particularly poor lighting, the presence of face masks, and / or significant changes in a user’s appearance). In such situations, the original lookup may miss in the database triggering a further lookup of the user’s account data in the database using the further identification information which could be a passport number, payment card information, a unique token, a visitor card, and / or user identification data such as a name, address, date of birth and / or a user defined pin number. In some configurations the authentication circuitry is responsive to identification of the account data by a server to trigger a further identity check. The further identity check may require further information from the user, for example confirmation of a user’s name, address, postcode, date of birth, etc. The further identity check need not be performed for every step of the tax refund process and may, for example, only be required during purchases of items over a predefined value, during a first purchase by a user on entry to a particular country (territory), when a confidence of the facial recognition circuitry is low, and / or at random. The inclusion of the further identity check adds an additional level of security to the tax refund process. In some configurations the user is a customer and the further identity check comprises receiving a photo from the server and prompting a merchant operating the apparatus to confirm that the photo matches the customer. The photo may be stored as part of the account data, for example, uploaded by a user during a registration process. Performing the further identity check in this way provides additional security without requiring the user to remember or carry any additional information and can be performed by the merchant even in situations where the merchant and the customer do not speak a common language. In some configurations the account data comprises password information indicative of a user password; the further identity check comprises requesting a password from the user and sending the password to the server. The user may be required to enter the password directly into the apparatus. Alternatively, the user may receive a notification on their mobile device (e.g., by email or via a dedicated application) prompting the user to go to a website to enter their password. As a further alternative, the user may be required (prompted) to scan a code (e.g., a barcode or a QR code) using their mobile device in order to be directed to the website to enter their password. In some configurations the image data comprises a video stream encoding a sequence of sequential images. For example, the video stream may comprise a short section of video recorded by the user which is used an input to the facial recognition algorithms. In some configurations the video stream is a live video stream. In such configurations the one or more facial recognition algorithms may be applied to the live video data which may be captured, for example, using a user facing camera on a user’s mobile device or a dedicated camera provided as part of a point of sale and / or a customs station. Using a live video stream provides an additional level of security because it can be confirmed that the user is actually present for the transaction and the possibility that a pre-recorded image or video has been provided can be ruled out. According to some configurations there is provided a registration apparatus comprising receiving circuitry configured to receive image data of a user, processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data, and control circuitry configured to register a user account by storing account data at a location in a database identified using the biometric data, wherein the control circuitry is responsive to an indication of one or more steps of a tax refund transaction associated with the user, to update the account data to comprise tax refund transaction data indicative of the tax refund transaction. The registration apparatus may be provided as a dedicated apparatus at a point of entrance or point of exit to a country (e.g., an airport or a ferry port). Alternatively, the registration apparatus may be comprised in a user’s mobile device, e.g., a mobile phone, or as part of a merchant operated system enabling a user to register in store. The registration apparatus may generate (create) and / or update the account data by transmitting information to a central server configured to handle registration of account data and updating of account data in response to a transaction. In some configurations the receiving circuitry is configured to receive identification data of the user, and the registration circuitry is configured to include the identification data in the account. The identification data may comprise an image of a passport, a country of residence of the user, an address of a user, a data of birth of a user, a user’s name, and / or banking account details of the user. The identification data may also include a password or pin number to provide an additional level of security in transactions performed by the user. In some configurations the control circuitry is configured to perform, prior to registering the user account, a lookup in the database using the biometric data; and in response to a determination that the biometric data conflicts with existing account data, to modify the existing account data to include a conflict indication and to include the conflict indication in the account data. For an idealised facial recognition algorithm, each person should generate different biometric data. However, off the shelf facial recognition algorithms may not behave in such an idealised fashion and there is a chance (however small) that two or more users may be sufficiently similar in terms of facial features that there is a conflict between users in the database. A more likely scenario is that a same user may attempt to register twice, resulting in conflicting accounts. In these configurations, this can be dealt with at the registration stage by determining whether such a conflict exists and, in that situation, marking both the new user’s account and the existing account with which it conflicts as being conflicting accounts. The manner in which the registration circuitry deals with a conflict may depend on the nature of the conflict. Where the conflict is caused by a same user registering twice, then this can be determined using identification data stored in the accounts, i.e., determining if the conflicting account relates to a user having a same username, address, date of birth, etc. In such situations, one of the conflicting accounts can be deleted removing the conflict. Where the conflict is caused by two different user’s conflicting then the conflict marker can be retained in the conflicting accounts and may trigger further identification data to be presented by those users when they attempt to carry out a transaction. In some configurations there is provided a server apparatus comprising: storage circuitry configured to store a database identifying a plurality of accounts associated with a plurality of users registered for a tax refund service, and control circuitry responsive to receipt, from an apparatus, of a lookup request comprising information indicative of one or more facial features of a user, to trigger a lookup in a database based on the information in order to identify account data associated with the user. The control circuitry is responsive to an indication of one or more steps of a tax refund transaction associated with the user, to update the account data to comprise tax refund transaction data indicative of the tax refund transaction. The server apparatus maintains the database identifying the account data for each of the plurality of users. The database may be stored on a single computer or distributed over a number of physical computers at one or more locations. The server is responsive to requests from apparatuses (at points of sale, at customs stations and / or self-service kiosks) to update account data in the database. The server is also responsive to requests from registration apparatus to generate new account data indicative of a user registering for an account. Whilst, in some configurations, the server may respond to a hit in the database by returning the data, this is not necessary and, in some configurations, the lookup may only require determining a record to be altered by the server based on information included in, or identified by, the lookup request. In such configurations, the account data can be updated at the server without being returned to the apparatus from which the lookup request was received. In general, the server need not provide data in response to the lookups which may require only an update of the account data (although an acknowledgement signal may be provided). In some configurations the control circuitry is responsive to the lookup being unable to identify a unique account, to transmit a request for further identification information to the apparatus; and the control circuitry is responsive to a further lookup request, from the apparatus, comprising further identification information, to trigger a further lookup using the further identification information in order to identify the account data. The further identification information could be a passport number, payment card information, a unique token, a visitor card, and / or user identification data such as a name, address, date of birth and / or a user defined pin number. The further lookup provides an alternative means for a user’s account data to be accessed in the event that the first lookup is unsuccessful. In some configurations the information comprises biometric data generated from image data of the user using one or more facial recognition algorithms, and the lookup is performed using the biometric data. In some configurations the information comprises image data of the user, the server apparatus comprises processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of the one or more facial features contained in the image data, and the lookup is performed using the biometric data. Whilst the lookup is performed using biometric data generated from image data, the image data may be processed at the server or at an apparatus separate from the server. Performing the processing in the server reduces the processing requirement at the individual apparatuses reducing the implementation cost of the apparatuses provided at points of sale and / or customs stations. Performing the processing at the individual points of sale and / or customs stations reduces the load on the server and will reduce latency during busy periods. In some configurations, the server may be capable of receiving biometric data and image data and, in the latter case, performing the image processing itself. Such an approach allows for a reduced complexity device to be provided at points of sale / customs stations where necessary but also allows for reduced latency where more complex point of sale / customs apparatuses are provided. In some configurations the control circuitry is responsive to the lookup identifying a plurality of accounts, to trigger generation of further biometric data from the image data using one or more further facial recognition algorithms different from the one or more facial recognition algorithms; and the one or more further facial recognition algorithms comprise at least one facial recognition algorithm having a higher accuracy than the one or more facial recognition algorithms. The server may implement multiple different facial recognition algorithms, for example, trading off speed and accuracy. In a first instance, the server may be configured to use a high speed algorithm for facial recognition that has a lower accuracy than other lower speed algorithms. In the majority of cases, the high speed algorithm will be sufficient to uniquely identify an account. When this approach fails, the server may switch to a higher accuracy algorithm in order to uniquely determine the user’s account data. This trade off provides a reduced latency in the majority of cases whilst allowing for greater distinction between user accounts. Particular configurations of the present invention will now be described with reference to the accompanying drawings. Figure 1 illustrates an approach to obtaining a refund of tax associated with a purchase. The approach illustrated in Figure 1 includes a user (traveller) 1 receiving a conventional store receipt from a merchant 3 on making a purchase. The store receipt together with the goods is then presented to customs 5. Customs 5 then determines eligibility and validates the store receipt. The tax authority 7 then accepts the validated receipts, processes the tax refund, and makes payment to the user 1. The payment to the user 1 may be in any suitable form, for example by crediting the amount of the tax refund onto a payment card, by giving cash to the user 1 or by a transfer of funds into an account of the user 1. For example, the user 1 may wish the payment to be made directly into a bank account. The user 1 provides the bank account to the tax authority 7 in order for the payment to be processed and completed. Overall, the process of requesting an obtaining a tax refund comprises four steps: 1. Purchase of the goods by the user 1; 2. Presenting the relevant information to customs 5; 3. Determining the eligibility of the user 1 for a refund; 4. Refunding tax paid by the user 1. The above system requires a large amount of information (e.g., paperwork or data) to be collected and stored. This requires that the user either keeps track of the information themselves (e.g., by retaining receipts) or that the user carries identification information (e.g., a passport or some other token linked to an account) with them when they make purchases in order for their receipt information to be associated with their account. In either case, the user is required to retain at least some physical information which places an administration burden on the user. In addition, because any receipt can be presented for a refund, there is a temptation for collusion between merchants and users. Also, once outside a shop, there is the potential for “receipt buying” in which domestic customers sell their receipts to users (either by directly selling the physical receipt or by offering to make a purchase using the user’s token in order for that purchase to be recorded on the user’s account). The user 1, potentially with only a small chance of being asked to present the goods for inspection, can potentially make a claim on all the receipts the user 1 is able to gather. Accordingly, the risk of fraud for refunding on receipts where the goods are never exported or intended for export is wide open. The inventors have realised that the possibility of fraud can be reduced by identifying the user through facial recognition. Facial recognition can be integrated into the system at one or more stages of the TFS process and requires that the user performing that stage of the process (e.g., making a purchase and storing details of that purchase in their account) is the user with whom the account is associated. In addition to reducing the chance of fraud, the invention also eliminates the requirement that the user has to carry identifying information (e.g., a passport or token). As a result, the convenience of the TFS process is also increased. Figure 2a shows a high-level overview of a system according to some embodiments of the present invention. The figure shows a merchant apparatus 23, a server apparatus 24, a database 25, a validation apparatus (customs apparatus) 26 and a user registration apparatus 27 connected via a network 22. In this system, a user 1 is able to register their details using the registration apparatus 27 including providing image data depicting the face of the user 1. Upon registering, the registration apparatus 27 triggers a user account to be created storing account data relating to the user 1. The account data is stored at a location in the database 25 that is identified by biometric data that has been generated from the image data using one or more facial recognition algorithms. When the user 1 purchases goods from the merchant 3 for which he or she intends to apply for a tax refund, the purchase is carried out and data relating to the purchase is recorded in the account of the user 1 which is identified using facial recognition algorithms. The merchant apparatus 23 at the merchant’s location identifies the user using image data (a picture or video) of the user 1. Biometric data identifying one or more facial features of the user is generated from the image data and transmitted along with payment amount information indicating the cost of the goods purchased, to the server apparatus 24. The server apparatus 24 receives all of this information and uses the biometric data to locate the account data that has the same biometric in the database 25. In practice it is unlikely that there will be a perfect match between the lookup data and biometric data stored in the database 25 so some mitigation techniques will be described later. Finally, the user is able to make use of a validation apparatus 26 to transmit a request (comprising biometric data of the user) to the server 24 which, when the user’s account data is registered, responds by providing data relating to the purchases made by the user so that so that a customs validation process can be performed and, if successful, a tax refund can be issued. The details registered by the user 1 include identification information and (optionally) payment information. For example, the identification information could include a name, address, passport number, date of birth, country of residence, contact details of the user 1 (e.g. telephone number, email address, etc.) or any combination of these. The payment information could, for example, include one or more of a credit or debit card number or bank account details (e.g. account number and sort code). In systems that include payment information, the exact payment information provided may be system dependent, but is sufficient for a payment to be effected. In some examples, the merchant interface 23 also sends purchase information to the server, indicating, for example, the type of goods purchased, the tax due for the goods or information identifying the merchant 3 or the tax region / location of the merchant 3. Figures 2b-2d schematically illustrate a sequence of exemplary interactions between the apparatuses illustrated in figure 2a. The illustrated interactions are indicative of some typical tax free shopping flows. Figure 2b schematically illustrates interactions between a registration apparatus 27, a server apparatus 24, and a database 25 during a registration processes performed by a user wishing to make use of a tax free shopping process. In the illustrated configuration, it is assumed that the database does not contain any existing biometric data that would overlap (i.e., be the same as) that provided by the user. The user provides the registration apparatus 27 with image data 270 and account data 272. The image data 270 is an image of the user’s face, and the account data 272 may comprise a user’s name, address, country of residence, etc. The registration apparatus 27 generates biometric data, from the image data, indicative of one or more facial features of the user and, at step 260, transmits the biometric data and the account data to the server apparatus 24. The server apparatus 24 performs an initial lookup in the database using the biometric data in order to determine whether that a user having that biometric data is already registered. At step 264 the database transmits an indication that there is no biometric data in the database that corresponds to the biometric data provided by the registration apparatus 27 (i.e., the user is not already registered and there are no other accounts with the same biometric data). At step 266, the server triggers a new entry to be created in the database storing the account data 272 at a location indexed using the biometric data. At step 268 the server apparatus transmits an acknowledgement to the registration apparatus indicating that the account has successfully been created. Figure 2c schematically illustrates an interaction between a merchant apparatus 23, a server apparatus 24, and a database 25 during a purchasing transaction performed by a customer (user) making a purchase of one or more items for which a tax refund can be obtained. In the illustrated example, it is assumed that the user has already registered with the system and therefore has an account stored in the database 25. The user takes the items that they wish to purchase to the merchant and indicates that they wish to purchase the items tax free. The merchant operates the merchant apparatus 23 to obtain image data 220 of the user’s face. At step 200, the merchant apparatus 23 transmits the biometric data over the network 22 to the server apparatus 24. The server apparatus 24 receives the biometric data and, at step 202 triggers a lookup of the data in the database 25. At step S204, the database 25 returns account data that is identified using the biometric data to the server apparatus. At step 206, the server apparatus indicates, to the merchant apparatus 23, that the biometric data has hit in the database. Subsequently, at step 208, the merchant apparatus 23 transmits information indicative of the items purchased to the server apparatus 24 which, at step 210, stores the information to the database 25. It would be readily apparent to the skilled person that in some alternative configurations the information indicative of items purchased could be transmitted along with the biometric data in step 200 rather than being transmitted as a separate step. Figure 2d schematically illustrates an interaction between a validation apparatus 26, a server apparatus 24, and a database 25. In the illustrated example, it is assumed that the user has already registered with the system and therefore has an account stored in the database 25. Furthermore, it is assumed that the user has made one or more purchase of items that are eligible for tax free shopping and that information indicative of those purchases (e.g., receipt data) is stored in the database 25. The process begins when a user accesses a validation station (or self-service kiosk) in an airport and wishes to validate their purchases before leaving the country. The validation station 26 obtains image data 250 of the face of the user. The validation station performs image processing to generate biometric data indicative of one or more facial features of the user. At step 230 the validation apparatus 26 transmits the biometric data to the server apparatus 24 which, at step 232, triggers a lookup in the database 25 to identify account data associated with the user. At step 234 the database 25 returns an indication of a hit to the server apparatus 24 including account data of the user. At step 236 the server apparatus 24 transmits the account data of the user (including receipt data indicating transactions that have been performed by the user) back to the validation apparatus 26. The validation apparatus 26 performs verification processing at step 238. For example, the verification station may be provided with one or more rules defining a “green channel” situation providing automatic approval for low value items and / or for purchases by travellers from particular countries, and a “red channel” situation, for example, for high value purchases in which a user is required to present the goods purchased to a customs officer for approval. Once the purchases have been approved, either through the automatic processing, or through approval by a customs officer, at step 240 the validation apparatus 26 transmits the result of the verification to the server apparatus which updates the database 25 to indicate that the purchases have been approved and, at step 244, triggers a refund process. The flows described in relation to figures 2b-2d above relate to a subset of possible tax free shopping flows. It would be readily apparent to the skilled person that there are numerous possible tax free shopping flows that are carried out in different territories in line with the local laws and regulations. The precise nature of the tax free shopping flow is unimportant and the use of facial recognition based on image data can be integrated into existing flows at various points. Specifically, where an existing tax free shopping flow requires that a user identifies themselves in order for data to be linked to their account, the present techniques can be applied as a method for the user to identify themselves. In the above configurations the identification of the account data of the user 1 using facial recognition is performed for each stage of the process, i.e., the purchasing and validation steps of the tax free shopping process. However, in alternative configurations, facial recognition may only be used in a subset of transactions. For example, facial recognition may be used during the steps of purchasing in all or a subset of stores. However, alternative identification methods may be used for the step of validation, for purchases in other stores, and / or for purchases over a certain value. Alternatively, facial recognition may be used during the step of validation but alternative identification methods may be used for purchases in store. In some configurations, the user may also be able to login to their account, e.g., using a mobile device, using facial recognition in order to view and maintain their account details. Figure 3 schematically illustrates details of an apparatus 30 according to some configurations of the present techniques. The apparatus 30 is provided with image receiving circuitry 32, processing circuitry 34, authentication circuitry 36, and transaction circuitry 38. The apparatus 30 is arranged to communicate, e.g., via a network, with a database 42. The database 42 stores account data 44 associated with a plurality of users. Each set of account data 44 is identified using biometric data. The image receiving circuitry 32 is configured to receive image data 40. The image data 40 is passed to the processing circuitry 34 which is arranged to perform a facial recognition process using one or more facial recognition algorithms in order to generate biometric data that is indicative of one or more facial features contained in the image data. The processing circuitry 34 passes the biometric data to the authentication circuitry 36. The transaction circuitry 38 is configured to perform one or more steps of a tax refund transaction and provides data to the authentication circuitry 36 indicative of those steps. The authentication circuity 36 triggers a lookup in the database 42 using the biometric data. If the lookup in the database 42 hits, i.e., identifies an entry corresponding to the biometric data provided by the authentication circuitry 36, then the database 42 may record an data indicative of the transaction in the database 42 and may return an indication to the authentication circuitry 36 indicating that the biometric data has resulted in a hit in the database 42. If the lookup in the database 42 misses, i.e., fails to identify an entry corresponding to the biometric data provided by the authentication circuitry 36, then the database 42 may return an indication to the authentication circuitry 36 indicating that the lookup has missed. Figure 4 schematically illustrates details of a registration apparatus 50 according to various configurations of the present technique. The registration apparatus 50 comprises image receiving circuitry 54, processing circuitry 56 and control circuitry 58. The registration apparatus is coupled (able to communicate with) the database 42 storing account data 44 for a plurality of users. The image receiving circuitry 54 is configured to receive image data 52 from a user and account data, e.g., identification information, from the user. The image receiving circuitry 54 is arranged to pass the received image data to the processing circuitry 56 which is arranged to perform a facial recognition process using one or more facial recognition algorithms in order to generate biometric data that is indicative of one or more facial features contained in the image data. The processing circuitry 34 passes the biometric data to the control circuitry 58. The control circuitry 54 is responsive to receipt of the biometric data to register a user account by storing the account data in the database 42. The control circuitry 58 transmits the biometric data to be used as an identifier to identify a location in the database at which the account data is to be stored. In the configurations illustrated in figures 4 and 5, the apparatus 30 and the registration apparatus each communicate directly with the database 42. In some alternative configurations, the apparatus 30 and the registration apparatus communicate with the database 42 via a server apparatus that maintains the database. Figures 5a and 5b schematically illustrate image receiving circuitry according to various configurations of the present techniques. Figure 5a schematically illustrates image receiving circuitry 60 comprising camera circuitry 62. The camera circuitry 62 comprises a charge coupled device CCD arranged to receive an optical image of a user which is converted into digital data and output to the image receiving circuitry 60. The camera may be configured to capture still image data and / or video data (including live video data). Figure 5b schematically illustrates an alternative configuration in which image receiving circuitry 68 is provided with communication circuitry 66 configured to communicate with a user mobile device 64. The user mobile device 64 comprises camera circuitry 69 which comprises a charge coupled device CCD configured, under the control of the user, to receive an optical image of a user which is converted to a digital signal and output as image data to the user mobile device 64. The camera may be configured to capture still image data and / or video data (including live video data). The user mobile device 64 transmits the image data to the communication circuitry 66 which outputs the image data to the image receiving circuitry 68. Figure 6 schematically illustrates further details of processing circuitry 70 configured to convert image data 72 into biometric data 84 according to various configurations of the present technique. The processing circuitry 70 is provided with pre-processing circuitry 86, a plurality of sets of measurement circuitry 74 including measurement circuitry 1 74(1), measurement circuitry 2 74(2), ..., and measurement circuitry N 74(N). The processing circuitry 70 is also provided with decomposition circuitry 76, a library of eigenfaces 78, first combination circuitry 80 and a plurality of sets of quantisation circuitry 82 including quantisation circuitry 1 82(1), quantisation circuitry 2 82(2), ..., and quantisation circuitry M 82(M) The processing circuitry is also provided with second combination circuitry 84. The pre-processing circuitry 86 is configured to receive image data 72 and to perform one or more pre-processing steps including performing filtering, cropping, scaling, aligning and colour balancing on the image data 72 to generate pre-processed image data. The pre-processed image data is routed to the measurement circuitry 74 and the decomposition circuitry 76. Each of the blocks of measurement circuitry 74 is arranged to perform a measurement relating to one or more facial features present in the image data. In the illustrated configuration, the N blocks of measurement circuitry 74 output N different measurements to the first combination circuitry 80. The decomposition circuitry 76 receives the pre-processed image data and eigenfaces from a library of eigenfaces 78 and is arranged to perform a principal value decomposition to identify a weighted combination of eigenfaces that approximates the pre-processed image. The weights (similarity scores) are output by the decomposition circuitry 76 to the first combination circuitry 80. The first decomposition circuitry 80 is arranged to receive the measurements from each of the blocks of measurement circuitry 74 and the series of weights from the decomposition circuitry 76. The first combination circuitry 80 is configured to generate one or more combinations of the received measurements and weights which are passed to each of the sets of quantisation circuitry 82. The quantisation circuitry 82 is arranged to quantise the inputs received from the first combination circuitry 80 into a plurality of bins. In other words, the quantisation circuitry 82 receives fine grained measurements and outputs coarse grained measurements. The outputs of the sets of quantisation circuitry 82 are fed into the combination circuitry 84 which generates the biometric data 84 by combining the coarse grained measurements from the quantisation circuitry. It would be readily apparent to the skilled person that any number of sets of measurement circuitry and quantisation circuitry could be provided. Furthermore, whilst in the illustrated configuration, discrete circuit blocks are illustrated for each functional block of circuitry, it would be readily apparent to the skilled person that the circuitry could be provided as any number of functional blocks that interact to provide the described functionality. Furthermore, one or more of the functions described in relation to the circuitry blocks of figure 6 may be provided by hardware implementing one or more program instructions configured to control the circuitry to perform the functions described in relation to figure 6. In alternative configurations, the measurement circuitry 74 or the decomposition circuitry 76 may be omitted. Figures 7a and 7b schematically illustrate the generation of biometric data in order to register accounts of two users. Figure 7a schematically illustrates the generation of biometric data 712 for a first user. The user provides image data that includes an image of their face fi which is passed to measurement circuitry 702. In the illustrated configuration, it is assumed that the pre-processing steps carried out by pre-processing circuitry 86 have already been performed such that the image data 700 is cropped, scaled, filtered and aligned. The measurement circuitry 702 takes a sequence of raw measurements from the image data 700. In particular, the measurement circuitry 702 measures a height of the face H(fi), a width of the face W(fi), a separation distance between the eyes xi(fi), and a separation distance between the eyes and the mouth X2(fi). The raw measurements are likely to be subject to image variation and image noise and are therefore passed to quantisation circuitry 704 which is arranged to generate quantised versions of the combinations of measurements. The quantisation circuitry 704 is provided with three individual quantisation units: quantisation 0 706, quantisation 1 708, and quantisation 2 710. Each of the quantisation units takes an input combination of the raw measurements and outputs a quantised version of that combination. Quantisation unit 0 706 takes the combination of inputs H / W, the height of the face divided by the width of the face. This quantity is illustrated on the x axis of the mapping function illustrated in quantisation unit 0 706. The quantisation unit maps the continuous input H / W to a quantised variable Qo. The mapping function is a piecewise constant mapping such that a range of values of H / W are mapped to a same value of the quantised variable Qo. Quantisation unit 1 708 takes the combination of inputs the eye separation divided by the width of the face. This quantity is illustrated on the x axis of the mapping function illustrated in quantisation unit 1 708. The quantisation unit maps the continuous input to a quantised variable Q±. The mapping function is a piecewise constant mapping such that a range of values of are mapped to a same value of the quantised variable Qi. Quantisation unit 2 710 takes the combination of inputs the eye-mouth separation divided by the width of the face. This quantity is illustrated on the x axis of the mapping function illustrated in quantisation unit 2 710. The quantisation unit maps the continuous input ~ to a quantised variable Q2. The mapping function is a piecewise constant mapping such that a range of values of are mapped to a same value of the quantised variable Q2 The mappings implemented by the three quantisation units are different from one another. Quantisation unit 0 706 and quantisation unit 1 708 provide a relatively coarse quantisation between the input combination of raw measurements and the output quantised value with equal sized quantisation bins (regions over which an input value is mapped to a same output value). In contrast, quantisation unit 2 provides a relatively fine quantisation between the input combination of raw measurements and the quantisation value with variable sized bins. The output quantised variables for the face fi are concatenated to provide the biometric data 712 comprising ¢2( / 1) calculated for the face fi. The biometric data 712 is combined with the account data 714 for the user and a raw image 716 of the face fi and is transmitted to the server apparatus for storage in the database. Figure 7b schematically illustrates the same process carried out for a different face fz provided by a second user in image data 720. The image data 720 is provided to measurement circuitry 702 which takes a same set of raw measurements as described in relation to figure 7a. The raw measurements are again quantised using quantisation circuitry 704 as described in relation to figure 7b. In the illustrated example, the second face f2 is different to the first face fi in that the distance between the eyes xr is smaller, i .e., xi(f2) <xi(fi), and the width W of the second face fa is smaller than the width of the first face fi, i.e., W(fz)<W(fi). As a result, the combined measurement quantised by quantisation unit 0 702 for the second face f2 is larger than for the first face fi, i.e., H(f2) / W(fz)> H(f2) / W(f2) resulting in a larger quantised parameter ¢0( / 2) than for the first face fi. The second quantisation parameter is based on the eye to eye separation distance xt and the face width W. As both these parameters are smaller for the second face fz than for the first face f।, the visible variation in the parameter is smaller than in the case of the combination used by quantisation unit 0 706. In the illustrated configuration, this results in a same quantised value being generated by quantisation unit 1 708, i.e., QtCA) = ¢1( / 1)- The third quantisation parameter Q2 is based on the eye to mouth separation distance x2 and the face width W As a result, the combined measurement quantised by quantisation unit 2 706 for the second face fz is larger than for the first face fi, i.e., %2(f2) / W(fz)> x2(f2) / W(fz) resulting in a larger quantised parameter ¢2( / 2) than for the first face fi. The generated biometric data 722 for the second face fz contains parameters Q0(A)< ¢1( / 2), ¢2( / 2) which are different to those obtained for face fi. The biometric data 722 is combined with account data 724 provided by the second user and a copy of the second image data 726 and is transmitted to the server apparatus for storing in the database. Figure 8 schematically illustrates a method of triggering a lookup in the database performed by an apparatus according to various configurations of the present techniques. In the illustrated configuration it is assumed that plural user’s including the first user and the second user are already registered in the database 808. For each registered account the database 808 stores biometric data, account data and an image of the user. When a user performs a transaction in a TFS process, image data 810 of the face of the user fi is provided to measurement circuitry 800. The measurement circuitry 800 generates the same measurements as described in relation to the registration process illustrated in figure 7a. In particular, the measurement circuitry 800 generates measurements of a height of the face H(fi), a width of the face W(fi), a separation distance between the eyes xi(fi), a separation distance between the eyes and the mouth X2(fi). The measurements are then provided, in combination to quantisation unit 0 802, quantisation unit 1 804 and quantisation unit 2 806 to quantise the measurements in order to generate biometric data 816 to be used in a lookup in the database 808. It is noted that the image data 810 used in to generate biometric data 816 may differ (e.g., through variation in optics, lighting, etc.) from the image data 700 that was used in the registration process for the first face. This is, to some extent, mitigated through the use of ratios as the combined parameters there may still be some variation present in the combined parameters —, , and —. This variation could potentially result in 1 W’ W’ W r J inaccuracies in the lookup process and could cause the biometric data 816 to miss in the database 808. This is overcome through the quantisation process and is illustrated by way of the zoomed in box 818. In particular, it can be seen that the measured value of will result in the same quantised value Qo even if the parameter is smaller by a first amount 814 or if the parameter — is larger by a second amount 812. Through the quantisation process expected variations in the biometric data for a same user can be eliminated such that the biometric data 816 is representative of the face fi. The biometric data 816 can then be used to perform a lookup in the database 808 to identify the account data of the user. In particular, the biometric data 816 matches the stored biometric data in the database 808 that is associated with the fi account data, i.e., the account data of the first user, and is different to the stored biometric data that is associated with the f2 account data and the £n account data. In response to the lookup, the fi account data is returned including the image data stored in the database 808 to enable an operator to perform a further check of the user’s identity on receipt of the returned data. In alternative configurations the recording of the image data in the database 808 may be omitted. Alternatively, or in addition, the user may be prompted to provide a pin code or password in response to the data being returned from the database 808. In further alternative configurations, the raw measurements, the combined parameters used for quantisation, and the quantisation levels (bins) used during the quantisation process may be defined differently. Figures 9 and 10 schematically illustrate configurations in which biometric data of the user cannot be identified in the database and show how occurrences of this can be mitigated. In the example configurations illustrated in figures 9 and 10, the first user wishes to register a transaction as part of the account data held in the database 808. However, in the illustrated configuration, the user’s face f™ is obscured by a pair of glasses. As a result, the image data 910 fed into the measurement circuitry 800 is noticeably different to the image data . The differences between the modified face f™ in the image data 910 and the user’s face recorded in the database 808 are sufficient that the measurements H^”1), W( / / n), xiQ / ”), and ) are different from H(fi), W(fi), xi(fi), an X2(fi). In particular, the presence of the glasses in the image data 910 results in a variation in the distance between the eyes xif / ”') xi(fi) and the distance between the eyes and the mouth xjf / ”1) #= X2(fi). In the illustrated configuration these differences are sufficient that the quantisation process cannot compensate for the differences resulting in a variation in the quantised parameters Qi(Am) * QAfi) and Q2(Am) ¢2( / 1)- The output biometric data 916 is therefore different to the biometric data used to identify the first user in the database 808. A lookup based on the biometric data 916 in the database 808 will therefore miss and the user’s account data cannot be identified. The example configurations illustrated in figures 9 and 10 each deal with the miss in the database 808 in a different way. In the example illustrated in figure 9 the database 808 contains, for each account, a hash of an alternative index 924. The hash of the alternative index 924 is a string of data unique to the account and is generated at registration based on a hash of information provided by the user, e.g., a passport number. When the first user is unable to access their account from the image data, an indication of a miss in the database is returned to communication circuitry 920 which prompts the user to provide the alternative index. The alternative index is passed from the communication circuitry 920 to hash circuitry 922 which generates a hash of the index value and transmits the hash value to trigger a lookup in the database 808 based on the alternative index 924. In the illustrated configuration, the user provides alternative index Ii which causes the hash #Ii to be generated by the hash circuitry 922. The lookup based on the alternative hash value results in a hit in the database 808. In order to reduce the possibility of fraud in such a situation, the biometric data 916 is compared to the stored biometric data that is associated with the hit in order to determine a similarity score indicating how close the biometric data 916 is to the stored biometric data. When the similarity score is above a minimum similarity threshold 930, it is assumed that the biometric data is sufficiently close to the stored biometric data and the account data 926 is returned. In the example illustrated in figure 10 the database 808 is arranged to store alternative biometric data 1024. In addition, the lookup is arranged to identify entries that are “close” to the biometric data 916. In particular, the initial lookup in database 808 may identify entries for face fi and face f2 as being close to the biometric data 916. This is achieved by combining the biometric data using a mapping function G^Q) 1037 that maps the more significant portions of each of Qo, and Q2 to the more significant portion of G (Q) and that maps the less significant portions of each of Qo, Qr, and Q2 to the less significant portion of G(Q). For example, if Qo = Qoo, Q01, Q1 = Q10, Qlt, and Q2 = Q20’ Q21, where Qi0 is the most significant portion of Q, for i =0,1,2 and Qtl is the least significant portion of Qt, then G(Q) = QOo> Qw> Q2o> Qoi> Qn> ¢12- As a result of this mapping, faces that are close, i.e., those whose quantised facial measurements only differ in terms of the least significant bits of the measurement, are located close to one another in the database. The initial lookup in the database 808 is a two part lookup that first identifies account data for which the more significant part of G (i.e., Qoo, Q10, Q2o) matches the biometric data stored in the database 808. These entries are entries that are considered to be “close” to the biometric data 916. Once the “close” entries are considered, a second lookup based on the less significant part of G (i.e., QOi <Qu> ¢21) is performed to identify the specific entry from those that are “close”. In the illustrated configuration, the initial lookup identifies a pair of entries 1035 as being “close” to the biometric data but the second part of the lookup misses and no entry is identified. As a result, an auxiliary lookup is triggered based on the alternative biometric data. However, the auxiliary lookup is restricted to the pair of entries 1035 that were identified as being close to the biometric data 916. The alternative biometric data 1024 is generated by the server apparatus using a different, higher accuracy facial recognition algorithm 1026. In the illustrated configuration, the higher accuracy facial recognition algorithm 1026 comprises contour measurement 1028, which generates measurements of contour width, contour length, contour separation and contour position which are passed to quantisation circuitry 1030. Because the alternative biometric data 1024 is generated on the server, this step can be done in the background once a user has registered and can include much higher accuracy methods that may require significant additional processing resources and / or take longer than the facial recognition algorithms described in relation to figures 7a, 7b and 8. When the first user is unable to access their account from the image data, an indication of a miss in the database is returned to trigger the measurement circuitry 800 to pass the image data 910 to be used to generate alternative biometric data in order to perform an auxiliary lookup. The image data 910 is passed through an instance of the higher accuracy facial recognition algorithm 1036 which includes an instance of the contour measurement circuitry 1038 and the quantisation circuitry 1040. The contour measurement circuitry 1038 and the quantisation circuitry 1040 generate auxiliary biometric data which can be used to perform a further lookup in the pair of “close” entries 1035 that were identified in the database 808 based on the alternative biometric data which returns the user’s account data 1040. The particular format of data and arrangement of circuitry provided in the illustrated configuration is intended for exemplary purpose only. In alternative configurations, the instance of the higher accuracy facial recognition algorithm 1036 may be provided be provided using the same circuitry (processing elements) that are used for the higher accuracy facial recognition algorithm 1026. Furthermore, whilst the alternative biometric data 1024 may be stored in the database 808, in some alternative configurations, a second database may be provided that is indexed by the alternative biometric data in order to return the biometric data. It would be readily apparent to the skilled person that the higher accuracy facial recognition algorithm could be provided using any high accuracy facial recognition algorithm using, for example, any of the techniques described above. Whilst the use of the mapping function 1037 has been illustrated in combination with the higher accuracy lookup, it would be readily apparent that the mapping function could be used in absence of an auxiliary lookup or in combination with the auxiliary lookup method illustrated in figure 9. By way of brief overall summary there is provided an apparatus and method, the apparatus comprising image receiving circuitry configured to receive image data of a user. The apparatus is also provided with processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data. The apparatus is also provided with authentication circuitry configured to trigger a lookup in a database using the biometric data in order to identify account data associated with the user. The apparatus is also provided with transaction circuitry responsive to identification of the account data, to perform one or more steps of a tax refund transaction and to update the account data to comprise transaction data indicative of the tax refund transaction. In the present application, the words “configured to..are used to mean that an element of an apparatus has a configuration able to carry out the defined operation. In this context, a “configuration” means an arrangement or manner of interconnection of hardware or software. For example, the apparatus may have dedicated hardware which provides the defined operation, or a processor or other processing device may be programmed to perform the function. “Configured to” does not imply that the apparatus element needs to be changed in any way in order to provide the defined operation. In the present application, lists of features preceded with the phrase “at least one of’ mean that any one or more of those features can be provided either individually or in combination. For example, “at least one of: [A], [B] and [C]” encompasses any of the following options: A alone (without B or C), B alone (without A or C), C alone 5 (without A or B), A and B in combination (without C), A and C in combination (without B), B and C in combination (without A), or A, B and C in combination. Although illustrative configurations have been described in detail herein with reference to the accompanying drawings, it is to be understood that the invention is not 10 limited to those precise configurations, and that various changes, additions and modifications can be effected therein by one skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, various combinations of the features of the dependent claims could be made with the features of the independent claims without departing from the scope of the present 15 invention.

Claims

1. An apparatus comprising:image receiving circuitry configured to receive image data of a user;processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data;authentication circuitry configured to trigger a lookup in a database using the biometric data in order to identify account data associated with the user; andtransaction circuitry responsive to identification of the account data, to perform one or more steps of a tax refund transaction and to update the account data to comprise transaction data indicative of the tax refund transaction, whereinthe biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selected to maximise variation in the index resulting from differences between respective facial features of different users.

2. The apparatus of claim 1, wherein the account data comprises identification data and the authentication circuitry is configured to determine eligibility of the user for the tax refund process based on the identification data; andthe identification data comprises information identifying the user and identifying a country of residence of the user, and the determination of eligibility is performed based on a location of a merchant and the country of residence.

3. The apparatus claim 1 or claim 2, wherein at least one of:the image receiving circuitry comprises a camera configured to acquire the image data; andthe apparatus comprises communication circuitry configured to transmit a request for the image data to a user mobile device, and the image receiving circuitry is configured to receive the image data transmitted from the user mobile device in response to the request.

4. The apparatus of any preceding claim, wherein the one or more steps of the tax refund transaction comprises one or more steps relating to a purchase of goods by the user, and the transaction data comprises information identifying the purchase of the goods.

5. The apparatus of any preceding claim, wherein the one or more steps of the tax refund process comprises a validation process performed at a customs station;the validation process comprises retrieving one or more items of stored transaction data each identifying one or more purchases made by the user and determining whether each of the one or more purchases is eligible for a tax refund, and in response to a determination that each of the one or more purchases is eligible for a tax refund, issuing the tax refund; andthe account data comprises payment information associated with the user and issuing the tax refund comprises refunding a refund amount to a financial account associated with the payment information.

6. The apparatus of any preceding claim, wherein the indexing function comprises performing measurements relating to the one or more facial features, quantising at least one of the measurements into a plurality of bins, and encoding, into the index, information identifying a bin of the plurality of bins closest to the at least one measurement.

7. The apparatus of any preceding claim, wherein the indexing function comprises quantising each of the measurements into a corresponding plurality of bins and encoding, into the index, information identifying a corresponding bin closest to each of the measurements.

8. The apparatus of any preceding claim, wherein the indexing function comprises encoding into the index, information identifying at least a second closest bin to the at least one measurement.

9. The apparatus of any preceding claim, wherein the indexing function comprises encoding the information using a hash function.

10. The apparatus of any preceding claim, wherein the measurements comprise one or more of:a separation distance between two of the one or more facial features;a depth of one of the one or more facial features;a position or shape of one or more facial contours; anda plurality of similarity scores each indicating a similarity between the one or more facial features and a plurality of predefined eigenfaces.

11. The apparatus of any preceding claim, wherein the authentication circuitry is responsive to an indication that the lookup process cannot identify a unique account, to request further identification information, and to trigger a further lookup based on the further identification information in order to identify the account data.

12. The apparatus of any preceding claim, wherein the authentication circuitry is responsive to identification of the account data by a server to trigger a further identity check.

13. The apparatus of claim 12, wherein the user is a customer and the further identitycheck comprises receiving a photo from the server and prompting a merchant operating the apparatus to confirm that the photo matches the customer.

14. The apparatus of claim 12 or claim 13, wherein:the account data comprises password information indicative of a user password; the further identity check comprises requesting a password from the user and sending the password to the server.

15. The apparatus of any preceding claim, wherein the image data comprises a video stream encoding a sequence of sequential images.

16. The apparatus of claim 15, wherein the video stream is a live video stream.

17. A method compri sing:receiving image data of a user;processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data;triggering a lookup in a database using the biometric data in order to identify account data associated with the user; andperforming one or more steps of a tax refund transaction and to update the account data to comprise transaction data indicative of the tax refund transaction, whereinthe biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selected to maximise variation in the index resulting from differences between respective facial features of different users.

18. A registration apparatus comprising:receiving circuitry configured to receive image data of a user;processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; andcontrol circuitry configured to register a user account by storing account data at a location in a database identified using the biometric data, wherein the control circuitry is responsive to an indication of one or more steps of a tax refund transaction associated with the user, to update the account data to comprise tax refund transaction data indicative of the tax refund transaction, whereinthe biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selectedto maximise variation in the index resulting from differences between respective facial features of different users.

19. The registration apparatus of claim 18, wherein the receiving circuitry is configured to receive identification data of the user, and the registration circuitry is configured to include the identification data in the account.

20. The registration apparatus of any of claims 18 to 19, wherein the control circuitry is configured:to perform, prior to registering the user account, a lookup in the database using the biometric data; andin response to a determination that the biometric data conflicts with existing account data, to modify the existing account data to include a conflict indication and to include the conflict indication in the account data.

21. A registration method comprising:receiving image data of a user;processing the image data using one or more facial recognition algorithms to generate biometric data indicative of one or more facial features contained in the image data; andregistering a user account by storing account data at a location in a database identified using the biometric data, wherein the account data is configured to store tax refund transaction data indicative of one or more steps of a tax refund transaction associated with the user, to update the account data to comprise tax refund transaction data indicative of the tax refund transaction, whereinthe biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selected to maximise variation in the index resulting from differences between respective facial features of different users.

22. A server apparatus comprising:storage circuitry configured to store a database identifying a plurality of accounts associated with a plurality of users registered for a tax refund service; andcontrol circuitry responsive to receipt, from an apparatus, of a lookup request comprising information indicative of one or more facial features of a user, to trigger a lookup in a database based on the information in order to identify account data associated with the user,wherein the control circuitry is responsive to an indication of one or more steps of a tax refund transaction associated with the user, to update the account data to comprise tax refund transaction data indicative of the tax refund transaction,wherein at least one ofthe information comprises biometric data generated from image data of the user using one or more facial recognition algorithms, and the lookup is performed using the biometric data, orthe information comprises image data of the user and the server apparatus comprises processing circuitry to process the image data using one or more facial recognition algorithms to generate biometric data indicative of the one or more facial features contained in the image data, and the lookup is performed using the biometric data; andwherein the biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial features and is selected to maximise variation in the index resulting from differences between respective facial features of different users.

23. The server apparatus of claim 22, wherein:the control circuitry is responsive to the lookup being unable to identify a unique account, to transmit a request for further identification information to the apparatus; and the control circuitry is responsive to a further lookup request, from the apparatus, comprising further identification information, to trigger a further lookup using the further identification information in order to identify the account data.

24. The apparatus of any one of claims 22-23, wherein:the control circuitry is responsive to the lookup identifying a plurality of accounts, to trigger generation of further biometric data from the image data using one or more further facial recognition algorithms different from the one or more facial recognition algorithms; andthe one or more further facial recognition algorithms comprise at least one facial recognition algorithm having a higher accuracy than the one or more facial recognition algorithms.

25. A method of operating a server comprising:storing a database identifying a plurality of accounts associated with a plurality of users registered for a tax refund service;in response to receipt, from an apparatus, of data lookup request comprising information indicative of one or more facial features of a user, triggering a lookup in a database based on the information in order to identify account data associated with the user; andin response to an indication of one or more steps of a tax refund transaction associated with the user, updating the account data to comprise tax refund transaction data indicative of the tax refund transaction,wherein at least one of:the information comprises biometric data generated from image data of the user using one or more facial recognition algorithms, and the lookup is performed using the biometric data, orthe information comprises image data of the user and the server processes the image data using one or more facial recognition algorithms to generate biometric data indicative of the one or more facial features contained in the image data, and the lookup is performed using the biometric data; andwherein the biometric data comprises an index derived using an indexing function and the indexing function is selected to minimise variation in the index resulting from changes in orientation and environment of the one or more facial featuresCMand is selected to maximise variation in the index resulting from differences between respective facial features of different users.

Images