Credit card networks and issuers are testing and rolling out cards that use fingerprints and facial recognition as identification to verify payments.
Will chip-and-fingerprint replace chip-and-signature or chip-and-PIN to verify that it’s really you charging that dog toy or diamond ring?
It appears so. Visa is testing a contactless biometric payment card that uses fingerprints scanned at payment terminals.
Chase is using Voice ID to tell if it’s really you calling with a question about your account, and Discover customers now can sign into their accounts with Face ID on an iPhone X.
And Mastercard plans to use fingerprints and facial recognition to authorize contactless payments across Europe by April 2019.
These are just some ways a growing number of banks are experimenting with using biometrics for authentication.
“Financial institutions realize they need to be much more focused on the consumer and what they want,” says Stephen Migliore, industry director and global lead for cyber security at Unisys.
Here’s a look at how card issuers and banks are using biometrics for authentication:
Visa puts payments at your fingertips
“You take your card out, pay for something at that point of sale and put your finger over the fingerprint sensor,” explains Mark Nelsen, senior vice president of risk products at Visa. “Payment information would go to the merchant and the card would verify that the genuine owner is using that card.”
The pilot test of the biometrics-based credit card was recently completed at Utah-based Mountain America Credit Union and the Bank of Cyprus.
The card has a self-charging fingerprint scanner built in and works on existing payment terminals.
The goal of the fingerprint card is to reduce card fraud at payment terminals. Card-present fraud, while not as prevalent as with online purchases, still causes consumers headaches and costs card issuers millions of dollars each year.
Paul Kobos, senior vice president of banking and payments for digital security company Gemalto, points out that biometrics such as fingerprints provide not only security, but also convenience.
“Using a fingerprint rather than remembering a PIN [is easy],” he says. “You get the security with ease of use.”
Should consumers be concerned about sharing a fingerprint with their bank? “It’s stored on the card so that eliminates fears from consumers with [banks] having a central database,” Kobos says.
See related: Video: Digital fingerprints can be hacked, too
Your voice tells Chase it’s really you
“Similar to a fingerprint, Voice ID uses your unique voiceprint to verify you,” Chase says on its website. “It’s easy, fast and secure.”
More than 100 physical and behavioral characteristics – such as pitch, accent, shape of your mouth and vocal tract – are used to create your voiceprint.
But what if you’re sick or your voice changes? Chase says that, in general, the voice recognition system still will work if you are suffering from a common cold, illness or slight changes in your voice.
If a voiceprint is not readable, such as if there is too much noise in the background, old-fashioned security questions can still provide positive verification.
See related: Credit card companies may be analyzing your voice
Your smile can unlock your Discover account
Discover’s cardholders and bank customers can log into the mobile app with a quick look at their iPhone X.
“Face ID provides Discover customers with an added security convenience at sign-in that requires no more than a quick glance at their iPhone X,” says Szabolcs Paldy, vice president of e-business for Discover, said in a news release.
Paldy wrote in an emailed statement that Discover hasn’t ruled out using facial recognition to verify purchases or in other ways in the future.
“We are open to incorporating Face ID into new solutions where it provides improved experience and enhanced security,” he said.
Mastercard plans biometric payments across Europe
Mastercard says the shift to fingerprint and facial recognition to authorize payments is being driven by the second Payment Services Directive (or PSD2) legislation in the European Union requiring two-factor authentication.
Europe may just be the start of Mastercard’s rollout of biometric payments.
“We feel the days of using static information [such as passwords or PINs] is over,” says Bob Reany, Mastercard’s executive vice president for identity solutions. “That information is widely known. Consumers widely struggle with it.”
See related: Abolish the password? Card issuers are working on that
How soon will we have biometric credit cards?
Because biometrics-enabled cards cost more to produce than traditional credit cards, Kobos predicts that U.S. banks will initially provide them to their higher net worth customers.
“We hope people start asking for them and banks start issuing them on a more broad scale,” he adds.
For now, outside of pilot tests by the card networks, Nevada-based tech engineering company SmartMetric Inc. is one of the companies producing biometric cards, and those are only available through certain banks.
In addition to cards with fingerprint scanners, experts foresee other ways to verify identity, such as Fitbits and other wearables.
“It’s a small leap to see how those types of technologies can be used to verify your identity,” Migliore says. Behavioral biometrics, such as the distinctive way you hold your phone or type in your bank password, or even physical biometrics like your heart rhythm, could also play a role in fraud prevention.
Whether fingerprint, voice verification, facial recognition or a scan of your iris is used to verify your identity, the days of relying on PINs and passwords are likely waning.
“In the future, biometrics is going to be the next big wave,” Reany predicts. “We’ll have a future wave where we get that second factor (of identification) through the Internet of Things and things like that.
“Biometrics will be part of the picture for a very long time,” he says.