Facial recognition has been heralded as a secure way to confirm your identity on your phone or at payment terminals, and with features like Face ID on your iPhone, it sometimes seems like the tech really is more secure than other options. But the tech isn’t infallible, as public facial recognition terminals can still be fooled with just a mask, as some recent experiments have shown.

An AI company, Kneron, shared a video with The Verge of tests it ran at facial recognition terminals in China where it appeared to fool the systems. Kneron asked us not to publish the video, so we will describe what we saw — and it looked pretty convincing. In two examples, a tester approaches AliPay and WeChat terminals at shops in China while wearing a 3D mask of his face, and the facial recognition system identifies the mask as his face, allowing the purchase. In another example, the same person feeds his ID card into a train station turnstile while wearing his mask, and the turnstile’s facial recognition system accepts the mask as his face.

There are definitely limitations to this type of test, though. The video only shows one person making attempts with their mask, and it’s unclear if that one mask worked in every single attempt, or if another mask would work for each one of these tests as well.

It’s also worth noting that none of the systems were relying entirely on facial recognition for identification. Both the AliPay and WeChat terminals required the person to enter digits of the phone number associated with their identity, and at the train station, you have to present a physical ID card before the facial recognition system even starts scanning. Also, you might hope another human would intervene if a person pulled out a mask of another human’s face while trying to pay for groceries?

Apple’s Face ID has been directly tested against 3D masks, by the way — when the company announced it in September 2017, the company said it had worked with professional mask makers to help train the neural networks used by Face ID. But, says Kneron, Apple (and Huawei) use structured light sensors in their facial recognition systems, while the tech the company fooled uses simpler single RGB sensors. Kneron also notes that the components it makes were also not fooled by their tests.

But the fact that some facial recognition systems apparently can be fooled with just a mask is a good reminder that facial recognition technology has a long way to go before we can trust it to be as secure as it has promised to be. And there are also thorny issues like regulation that are still being figured out.

Update, 17 Dec, 13:00PM ET: Updated to note the difference between Apple, Huawei, and Kneron facial recognition systems, and the technology the researchers were able to trick.