You wave your hand over a camera.
At this point I presume they collect such biometrics whether I like it or not; they have cameras everywhere.
A grainy image of your palm from a surveillance camera capture is not going to expose biometric data. Your hand needs to be close enough to make out the detail required. Then tying that to your identity is very hard and takes manhours, not something you can replicate at scale. You’re giving them your palm print/vein scan tied to your identity on a plate. It’s very irresponsible.
Isn't it a deep vein scanner? Much harder to spoof than still images or even video.