> I'd be very surprised if refund fraud was the only POC that this facial recognition data was used for.

The only conceivably legal POC.