At that point your requiring about as much effort to authorize the transaction as you would be to enter a card number.

Also not sure how secure that would be , how difficult would it be for a would be attacker to find out who was in the images?

I imagine a reverse image search could be fruitful.