I believe Apple UX guidelines mandate some sort of explicit confirmation before taking any action after authenticating the user with Face ID, but I've unfortunately also seen many apps not really conform to that.
> IIRC just looking at the confirmation if i wanted to buy something in the app store via face id was enough to confirm it.
Apple themselves are generally good about asking for explicit confirmation, but annoyingly in a way nobody else can replicate: They repurposed double pressing the power button, which is otherwise the Apple Pay secure attention sequence, for exactly one non-Apple-Pay action – buying something in the App Store (or iTunes store etc.)
> IIRC just looking at the confirmation if i wanted to buy something in the app store via face id was enough to confirm it.
Apple themselves are generally good about asking for explicit confirmation, but annoyingly in a way nobody else can replicate: They repurposed double pressing the power button, which is otherwise the Apple Pay secure attention sequence, for exactly one non-Apple-Pay action – buying something in the App Store (or iTunes store etc.)