Biometric authentication in banking is emerging as an alternative to passwords as financial institutions look for stronger ways to protect customer accounts and sensitive financial information. Physical and behavioral characteristics such as fingerprints, eye patterns, voice, and other unique identifiers can provide banks with additional methods for verifying that users are who they claim to be.
For corporate banking customers in particular, the stakes can be significant because compromised credentials may expose accounts containing millions of dollars. Wells Fargo and Barclays are among the financial institutions experimenting with biometric technologies designed to strengthen authentication while reducing many of the security and usability problems associated with traditional passwords.
Banks are increasingly turning to biometrics as a way to improve security and reduce fraud. Biometrics use physical or behavioral characteristics to identify individuals, and banks are now using this technology to verify the identity of customers. For example, banks may use iris scanning or fingerprinting to verify a customer’s identity before allowing them access to their accounts. This can help to prevent fraudsters from accessing customers’ accounts and data. In addition, banks may use biometrics to authenticate transactions, such as when a customer makes a payment using their mobile phone. This can help to ensure that the transaction is being made by the genuine account holder.
This article described recent adoption of biometric technology by Wells Fargo and Barclays for corporate clients:
“As data breaches, ransomware, and other cybercrimes heighten concerns about the security of doing business on the Internet, some banks are rolling out biometric methods of authentication, methods that rely on some unique physical characteristic of the customer, like a fingerprint.
Wells Fargo customers can now use a scan of the veins in their eye to log onto the mobile version of the bank’s Commercial Electronic Office portal, CEO Mobile. And Barclays is about to launch a device that uses finger vein technology to authenticate customers signing into its treasury portal on a laptop or desktop.
“We do think this is the way forward,” said Shameet Shah, head of digital client security for corporate banking at Barclays. “Within our space, security is paramount. You’re protecting clients’ accounts that have millions of dollars or pounds.”
Bank executives say biometric authentication methods avoid some of the problems that companies encounter with passwords, such as employees forgetting them or sharing them with others, or passwords being exposed by data breaches.
“Passwords and security questions are often compromised through malware or routine social engineering tactics,” Brooke Satti Charles, a financial crime prevention strategist at IBM Security, said in an email. “Add to that general password fatigue, where customers may use the same password in many places, and the potential for misuse escalates quickly.
‘These and many other factors highlight a clear need to improve and implement easier, risk-based, unobtrusive user authentication,’ Satti Charles wrote. ‘Physical biometrics and behavioral biometrics offer just this.’ ”
Banks Evaluate Different Biometric Authentication Methods
The problem is that there are many biometrics to choose from. The solutions built into phones don’t satisfy the security needs of banks and others that don’t require new hardware are often not popular with the customer:
“Wells Fargo amped up its back-end efforts to detect fraud and started looking into biometric authentication methods, “knowing that we want to get rid of the password in five years, and biometric is the only way for us to eradicate passwords completely,” she said.
The bank tested one vendor’s face-and-voice authentication method, which worked but wasn’t popular with users. “One thing customers told us was that voice in a self-service setting was less than ideal,” Watson said, noting that customers wanted to multitask but couldn’t do use the voice authentication while they were in noisy environments, like public transit, or sitting in a meeting.
Wells Fargo then partnered with a company that offers the eye vein technology and tested that method. The technology relies on fact that each person has a unique pattern of veins in the white of the eye. During enrollment, the app videos the customer and creates a template of the veins in his or her eye. “Every time the customer comes back to log on to CEO Mobile, we are able to validate them against a template we’ve created when they’ve enrolled,” Watson said.
The eye vein method is “both secure and resonates with customers in terms of how convenient it is,” Watson said.Wells Fargo plans to roll it out late this year to customers with Apple iPhones and then to those with Android phones. Meanwhile, it will continue testing biometric approaches to authentication, in part because no one method will work for all customers, Watson said. “If you’re sight-impaired, you won’t be able to position your phone to be sure it can see your eye,” she noted.
‘We’re not saying to customers ‘You can no longer use a password and an ID’; we’re still making it a choice,’ Watson said. ‘Right now, there’s just one biometric, and it may not work for everyone.’ ”
Banks Look Beyond Passwords for Stronger Authentication
So while eventually the mobile phone will become more secure and capable of supporting a level of authentication that banks can rely on, today they can’t and so other approaches must be found that remediate the ever increasing failure of passwords.
Biometric authentication in banking offers financial institutions a promising way to strengthen account security while reducing their dependence on passwords. However, choosing the right technology involves more than determining whether a biometric method is technically secure. Banks must also consider convenience, accessibility, customer acceptance, and whether additional hardware is required.
The experiences of Wells Fargo and Barclays demonstrate why financial institutions may ultimately need to support multiple authentication options rather than relying on a single biometric technology. As mobile devices become more capable and biometric solutions continue to develop, banks will have more opportunities to combine security with a convenient customer experience. Until then, providing customers with choices while continuing to test new authentication technologies could offer the most practical path toward reducing reliance on increasingly vulnerable passwords.
Overview by Tim Sloane, VP, Payment Advisory Service at Mercator Advisory Group
Read the full story here
