Biometric authentication has become an increasingly important component of digital security, but questions remain about its reliability and the risks associated with compromised biometric data. Unlike passwords, physical characteristics such as fingerprints cannot easily be changed, raising concerns about their long-term effectiveness as authentication credentials.
However, focusing exclusively on physical biometrics overlooks the growing role of behavioral biometrics, machine learning, and risk-based authentication. These technologies offer opportunities to evaluate identity continuously and adjust security requirements according to the circumstances of a transaction. The debate highlights an important distinction: while biometrics alone may not provide sufficient protection, combining multiple authentication methods can create a stronger and more adaptable security framework.
The Debate Over Biometric Authentication Security
In this TechTarget article Adam Englander, chief architect for multifactor authentication products at Iovation, indicates that biometrics are stupid. While the article makes several recommendations that are smart, Adam’s concerns regarding biometrics are misguided because they focus exclusively on physical biometrics and fails to address how behavioral biometrics are shifting the industry. We’ll look at his good recommendations after we review his misguided focus on physical biometrics:
Englander argued that physical biometrics have an inherent weakness: unlike passwords, fingerprints and other biological characteristics cannot easily be changed after a security breach. As computing power advances, compromised biometric credentials could become increasingly vulnerable.
“There’s no way to get more swirls on your thumb,” Englander said, emphasizing that users cannot simply reset their fingerprints if the underlying biometric data is stolen.
Behavioral Biometrics Address Limitations of Physical Authentication
It strikes me as odd that Iovation is unaware of the inroads behavioral biometrics are making, given the markets broad adoption of them in products such as ThreatMetrix. Then there is the statement “…there is no way to increase the complexity of a biometric factor like a fingerprint” which ignores enhanced sensors that now including blood veins and other factors that greatly increase complexity and accuracy. Still, Mercator agrees that physical biometrics should be reserved for when a high-risk transaction demands a challenge.
Multifactor Authentication Strengthens Biometric Security
The article next makes several smart recommendations and I hope Englander recognize that these very recommendations can make biometrics very smart, not stupid:
Englander recommended combining biometrics with knowledge-based credentials, such as passwords, and possession-based factors, such as security tokens. He argued that using all three categories provides stronger protection because the other credentials can be replaced if biometric information is compromised.
“All these things together by themselves aren’t super secure but if you put them together they’re fantastically secure,” Englander said.
Mercator urges use of multifactor and fully expects that this concept will ultimately also incorporate more than one biometric, perhaps behavioral that doesn’t require a challenge for a low-risk transaction, behavioral and a fingerprint challenge for higher risk and perhaps even voice or face recognition added for very high-risk situations.
FIDO and Machine Learning Enable Risk-Based Authentication
MFA supports Englander’s other recommendations which includes support for FIDO and adoption of machine learning (ML). Regarding this latter use case, Englander recognizes that ML can operate on the backend to gauge the risk associated with a transaction so an appropriate challenge can be issued, he apparently hasn’t considered how ML will be deployed in the FIDO environment to manage the collection and analysis of behavioral biometric information:
Englander also recommended decentralizing biometric credential storage to reduce the risks associated with large-scale data breaches. He pointed to the FIDO Alliance’s WebAuthn API as an approach that could support secure authentication without relying on centralized biometric databases.
Additionally, he advocated using machine learning to evaluate transaction risks and determine the appropriate level of authentication. High-risk activities, such as financial transfers, could require additional verification, while routine, low-risk interactions might proceed without another authentication challenge.
The debate over biometric authentication illustrates why security strategies should extend beyond any single identification method. Physical biometrics have limitations, particularly when sensitive credentials are compromised, but behavioral biometrics and adaptive authentication offer additional ways to evaluate identity and detect suspicious activity.
Combining biometric technologies with multifactor authentication, machine learning, and decentralized credential storage can help organizations strengthen protection while minimizing unnecessary friction for legitimate users.
Ultimately, the most effective approach is likely to be risk-based authentication that adjusts security requirements to the circumstances of each transaction. Rather than treating biometrics as inherently secure or insecure, financial institutions can evaluate how different authentication methods work together to reduce fraud and protect customer information.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
