A modern payment system would require at least touch/Face ID on every transaction.
Higher amounts would require 2FA, pre-authorization, delays, cool-downs etc.