Wise: user reports facial verification loop despite accepted SMS code – what UK data law requires

A user reports around 20 prompts with no account access after an accepted text message. What UK data protection law says about facial checks.

A Wise user says his SMS confirmation was accepted, yet he was repeatedly asked to reposition his face in front of the camera and was not granted access to his account. He objects to a biometric check carried out against his will. Public guidance from UK and other regulators sets out the standards such checks are measured against.

SMS accepted, still no access

Closer to the camera, then further away, then another attempt: that is how the user, speaking to Net Trends on 5 November 2026, describes his login process. He says he received around 20 prompts. Although his SMS confirmation had been accepted, he had still not been able to access his account after several minutes. He objects to the digital measurement of his face and describes the process as harassment.

The complaint is about more than a malfunctioning camera. Someone who needs access to an existing financial account is under practical pressure. The editorial question is: what genuinely usable route is left for someone who does not want to consent to automated facial analysis? A repeating sequence of failed capture attempts does not answer that question.

What the user’s own footage shows

The screenshots document a prompt to retake a selfie. The roughly 39-second video also shows a “No, verify manually” option. Alongside the automatic option, the screen states that the face scan may be stored for up to a year. The manual route shown can reportedly take up to one working day. These details come from the on-screen text visible in the video, not from any confirmation of how this specific case was resolved.

A blanket claim that Wise offers no manual route at all would therefore be inaccurate. What remains open is whether that route actually worked in this case, what data processing actually took place, and when access was eventually restored.

Wise’s own notice on face scans and consent

Wise sets out face scans, consent and fraud prevention in its own biometric data notice. Wise: Biometric Data Processing Notice. Wise, which is headquartered in London and authorised by the UK Financial Conduct Authority (FCA) as an electronic money institution, describes two-step verification as an additional account safeguard. Wise: two-step verification.

An accepted SMS confirmation on its own proves neither that any further check is unlawful, nor that biometric processing against a declared refusal would be lawful. These are two separate questions.

What UK data protection law requires

Under the UK GDPR, biometric data used to uniquely identify a person is a “special category” of personal data under Article 9. The UK’s data protection regulator, the Information Commissioner’s Office (ICO), has published dedicated guidance on biometric data and biometric recognition, which calls on organisations to consider data protection by design, to be able to justify why biometric recognition is necessary and proportionate, and to offer an alternative where consent is relied on and a person does not want to take part. ICO: Guidance on biometric data.

The European Data Protection Board sets a comparable standard across the EU, requiring a non-biometric alternative where consent under Article 9 GDPR is the legal basis. EDPB: Guidelines 3/2019, paragraph 86. These are general standards, not a finding against Wise. What matters in any individual case is the applicable legal basis, the purpose of the processing and how the process was actually carried out.

Public complaints and counterpoints

On Reddit, reports of rejected selfies sit alongside comments describing trouble-free checks. Reddit: rejected selfies and mixed experiences. Another Reddit post complains about a missing manual option despite having withdrawn biometric consent. Reddit: Manual Verification Gone. Hacker News has documented complaints about failed selfie checks since 28 October 2023. Hacker News: user account, 28 October 2023.

Such posts are personal, independently unverified accounts. They show that these difficulties are discussed publicly; they do not establish how common the problem is, nor do they prove a current global outage or the technical process in this particular case.

Wise has not yet been approached by Net Trends about this individual case. The company pages reviewed are general publications, not a case-specific statement. The user’s criticism is reported as such; no legally established data protection breach is alleged.

Sources and status

• Wise: Biometric Data Processing Notice
• Wise: two-step verification
• ICO: Guidance on biometric data
• EDPB: Guidelines 3/2019, paragraph 86
• Reddit: rejected selfies and mixed experiences
• Reddit: Manual Verification Gone
• Hacker News: user account, 28 October 2023

Research and data as of 5 November 2026.

Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. The report is based on image evidence supplied by the affected user, his account, and linked primary sources. Forum posts are unverified personal accounts. The user’s face, account links and unedited private footage are not published. This is a country adaptation based on an article from Net Trends, researched for the United Kingdom.