Body talk: who’s ready for biometric verification?

Once upon a time, mak­ing a pay­ment with a lit­tle plas­tic card was seen as the height of con­ve­nience. Now you can leave that at home and pay with your phone – and before long, you might not even need that.

Bio­met­ric pay­ment tech­nol­o­gy auto­mat­i­cal­ly iden­ti­fies peo­ple from their face, fin­ger­print or any oth­er unique phys­i­cal char­ac­ter­is­tic. It isn’t a new con­cept: such data has been used as an iden­ti­fi­ca­tion method since the devel­op­ment of fin­ger­print analy­sis for crim­i­nal inves­ti­ga­tions in the 19th cen­tu­ry. In fact, there is evi­dence that fin­ger­prints were used to seal busi­ness con­tracts thou­sands of years ago in ancient Baby­lon, although it’s unlike­ly that they under­stood that a print was unique to a par­tic­u­lar per­son.

But tech­nol­o­gy has mas­sive­ly expand­ed the poten­tial of bio­met­ric ver­i­fi­ca­tion. Where­as fin­ger­print match­ing once occurred in spe­cial­ist labs, it’s become some­thing that mobile phones do for many of us sev­er­al times a day – and that’s not even count­ing oth­er tech­niques, such as facial recog­ni­tion or iris scan­ning.

Pay­ment tech­nol­o­gy has advanced sig­nif­i­cant­ly since the start of the 21st cen­tu­ry, when card pay­ments were still pri­mar­i­ly authen­ti­cat­ed by sig­na­tures. Chip and PIN and con­tact­less are now tak­en for grant­ed with phys­i­cal pay­ments, while online authen­ti­ca­tion meth­ods con­tin­ue to evolve as the tech­nol­o­gy advances. 

But secu­ri­ty remains an issue. How do busi­ness­es ensure that the per­son using a card and PIN is the own­er? Increas­ing­ly, bio­met­rics will pro­vide the solu­tion.

The tech­nol­o­gy is already being used to improve secu­ri­ty when mak­ing finan­cial trans­ac­tions. This is part­ly by default, as phones secured by bio­met­rics are becom­ing a com­mon pay­ment method in them­selves. 

Beyond the phone, numer­ous oth­er bio­met­ric secu­ri­ty meth­ods are being intro­duced. Mas­ter­card and Visa have tri­alled pay­ment cards that can be autho­rised via a fin­ger­print sen­sor built into the card itself. Mas­ter­card is tri­alling pay­ment tech with the Brazil­ian super­mar­ket chain St Marche that lets cus­tomers pay by check­ing their IDs through facial recog­ni­tion. The days of remem­ber­ing PINs and pass­words may be ove. Phys­i­cal mark­ers will be used instead to guar­an­tee that the per­son mak­ing a pay­ment is who they say they are.

There are numer­ous ways that bio­met­ric infor­ma­tion can be a strong indi­ca­tor of someone’s iden­ti­ty. A whole range may come into play in dif­fer­ent pay­ment sce­nar­ios. Bio­met­rics can also be behav­iour­al as well as phys­i­cal, as Mark Nelsen, senior vice-pres­i­dent at Visa, explains. 

“The way you type and swipe on your phone, for instance, is unique to you and can be used to con­firm your iden­ti­ty when mak­ing a pay­ment, with­out you actu­al­ly hav­ing to do very much,” he says. 

But will every­one be hap­py to give up their bio­met­ric data to make pay­ments more con­ve­nient and secure? Ajay Bhal­la, pres­i­dent of cyber and intel­li­gence at Mas­ter­card, says its St Marche facial recog­ni­tion tri­al saw a “strong ini­tial con­sumer response and repeat usage”. 

Accord­ing to the company’s glob­al research, more than two-thirds of con­sumers agree that using bio­met­rics for iden­ti­fi­ca­tion or pay­ments is more secure than PINs, pass­words or oth­er forms of iden­ti­fi­ca­tion. The pan­dem­ic has also had an impact on pay­ments: more than half of in-store pay­ments have become con­tact­less since the Covid cri­sis start­ed. 

Bhal­la believes that “allow­ing card-hold­ers to use their bio­met­ric data to ini­ti­ate a trans­ac­tion is the next step in terms of touch­less pay­ment expe­ri­ences”.

It’s impor­tant that cus­tomers can choose pay­ment meth­ods they’re com­fort­able with, accord­ing to Nel­son, who adds: “Every­one has their own pref­er­ences. The same con­sumer might be hap­py to pay with a bio­met­ric when using their mobile wal­let on pub­lic trans­port, but they might want to pay for a hol­i­day using their phys­i­cal card and a lap­top PC.” 

Although it seems like­ly that most cus­tomers will be hap­py to use these meth­ods, it’s impor­tant for retail­ers to fac­tor in those who may be hes­i­tant about adopt­ing new pay­ment tech­nol­o­gy.

And there are risks for busi­ness­es and their cus­tomers to con­sid­er. “The unique nature of bio­met­rics is also its biggest vul­ner­a­bil­i­ty,” says Prakash Pat­tni, man­ag­ing direc­tor of dig­i­tal trans­for­ma­tion at IBM Cloud for Finan­cial Ser­vices. “Bio­met­ric data is either stored local­ly, per­haps on a mobile, or cen­tral­ly in a data­base. If the data is stolen – for exam­ple, a fin­ger­print is copied – then lit­tle can be done to re-secure it.” 

Poor­ly imple­ment­ed ver­i­fi­ca­tion tech could be a dis­as­ter, so it’s not some­thing to take light­ly. Com­pa­nies need to be sure their cus­tomers can have faith in their sys­tems.

The good news is that the tech­nol­o­gy to secure bio­met­rics is advanc­ing just as quick­ly as the tech­nol­o­gy to read them. Data will nec­es­sar­i­ly be encrypt­ed, but spe­cif­ic tech­niques are also being devel­oped, includ­ing ‘can­cellable bio­met­rics’. This, explains Pat­tni, is “bio­met­ric data that is trans­formed using com­plex algo­rithms that can­not be reverse-engi­neered. It is this bio­met­ric tem­plate that is used for iden­ti­ty ver­i­fi­ca­tion and can be delet­ed and replaced in case of loss or com­pro­mise.” 

Any secu­ri­ty-relat­ed tech­nol­o­gy inevitably involves a lev­el of risk. Mit­i­ga­tion strate­gies will have to evolve along­side the tech­nol­o­gy and as new vul­ner­a­bil­i­ties are dis­cov­ered.

Bio­met­rics are becom­ing an increas­ing­ly big part of our lives, from unlock­ing our phones to nav­i­gat­ing pass­port con­trol. It is a nat­ur­al fit for the pay­ment sec­tor thanks to the secu­ri­ty and con­ve­nience it offers to cus­tomers. But this will work only if com­pa­nies are pre­pared to under­stand the risks, prop­er­ly mit­i­gate them and sup­port any reluc­tant cus­tomers as the tech­nol­o­gy moves from the cut­ting edge to the every­day.