Five years ago, biometric payments seemed ready for the American mainstream. Backers predicted that financial institutions and retailers soon would use fingerprint, palm, vein, iris or facial scans to verify consumers’ identities for ATM and point-of-sale transactions.
But everything changed in 2007 with the bankruptcy of Solidus Networks Inc., which did business as Pay By Touch, a San Francisco-based startup that had raised $300 million and grabbed headlines in the biometric payments processing industry.
Suddenly, a cloak of invisibility enveloped the subject of biometric payments in North America. It remains today.
Though banks are deploying biometric ATMs in such places as rural India and South America, and some retailers are accepting biometric payments in other parts of Asia, the U.S. seems reluctant to jump-start a new biometric-payments movement. However, with America’s growing use of biometrics to control access at airports and to buildings, computers and cash registers, some observers believe U.S. interest in biometric payments might reemerge.
Reflecting upon the abrupt demise of biometric-payment trials since Pay By Touch’s, Nick Holland, a senior analyst with the Boston-based Aite Group LLC, notes that “no one’s really dabbled with it since.”
Looking back half a decade, the payments industry now has a clear picture of what went wrong: North Americans have no good reason to replace cards with biometric scans, and the industry sees little need to strengthen security by using a scan to confirm a card user’s identity, observers say.
Moreover, biometrics faced the “classic chicken-and-egg problem,” says Paul Grill, a partner at Maryland-based First Annapolis Consulting. Should promoters try to sign up so many merchants for biometric payments that consumers would encounter scanners everywhere they turned? Or should the industry attempt to win over so many consumers merchants would scramble to join the revolution?
No one ever really answered those questions adequately, he says.
On the other hand, merchants liked at least one aspect of biometrics, Grill notes. Biometrics processors settled transactions over the automated clearinghouse networks, reducing the amount merchants paid in fees compared with credit or signature-debit card transactions, he says.
But the ACH scheme would not generate enough funds to underwrite the rewards consumers had come to expect from their cards. “It would require the involvement of the major issuers, major acquirers and the payments networks to make that happen,” says Grill.
Besides, either merchants or biometrics vendors would have to bear the expense of replacing perfectly good card-payment terminals with scanners capable of interpreting algorithmic representations of fingerprints, Grill says. Moreover, someone would have to pay to integrate the new scanners into retailers’ point-of-sale and inventory systems, he adds.
Installation costs aside, the maintenance expenses could become significant, especially for big-box retailers operating 20 or more checkout lanes on a 24-hour basis, says Anil Jain, a Michigan State University computer science and engineering professor.
Some consumers also worried they could fall victim to fingerprint theft and then appear to be the perpetrators of the resulting fraud, Grill says.
Consumers also hesitated to surrender their personal information, including Social Security and bank-account numbers, to a long list of retailers, any of which might mishandle the sensitive data, Grill says.
For some consumers, a retailer’s request for a fingerprint even raised ideological questions touching on a fundamental right to privacy many Americans hold sacred, analysts say. That concern appears especially strong in the United States and Canada, according to European-based observers.
The technical community also acknowledges that fingerprint technology lacks the infallibility the public attributes to it, says Aite’s Holland. “It’s not 100% accurate,” he says. “There are obviously a lot of shades of gray.”
Because the type of biometrics used for payments in the United States relied on algorithms produced from various points of a fingerprint, it used a scoring system instead of “it is or it isn’t,” Holland says. A biometric system set for precision tends to reject a few scans it should accept, which annoys customers, he says.
The only thing worse than refusing legitimate scans is to accept fraudulent ones, says Michael Schuckers, associate professor of statistics in the Department of Mathematics, Computer Science and Statistics at St. Lawrence University, Canton, N.Y.
“It’s not that big a deal if it doesn’t accept me and it says ‘Put that fingerprint down again,’” says Schuckers. “It’s a bigger deal if my fingerprint just went to pay for a car and it came out of someone else’s account.”
Those problems arise or abate, depending on how the system is set up, says Schuckers. For biometric systems to make quick decisions on acceptance or rejection, most focus on “minutia” instead of storing the entire fingerprint image, Schuckers says.
Accuracy Versus Speed
Minutia formerly signified trivial detail, but in biometrics it refers to the small details with big implications. It includes ridge splits, or bifurcations, and ridge ends, Schuckers says.
“If you look at your finger, there are places where the ridges stop,” he says. If the minutia of the two fingerprints line up–one at the scanner and the other in the database–that constitutes a match.
In an ATM system, someone has to decide how many points of information to use when comparing the two fingerprints, Schuckers says. Checking eight minutia takes less time than nine, for example. For the sake of speed, financial institutions would choose fewer data points than typically would apply for criminal investigations, he notes.
“It comes down to how much are folks willing to give up in terms of time versus error rate,” Schuckers says. “There is a trade-off there.”
Weather can interfere with biometric scans, too, says Schuckers. “Dryness seems to affect these systems quite a bit,” he says, noting that poses problems for outdoor scanners in winter when the cold air cannot hold much moisture.
Some systems need regular cleaning to maintain accuracy, cautions Schuckers. “You can imagine,” he says, “how folks come in with not-quite-clean hands and use the system. That’s going to leave a residue behind, and that’s going to affect performance.”
If the fingerprint database resides inside the terminal, the process becomes simpler than when the terminal goes online to retrieve biometric data, Schuckers says. The Internet step can create lag time, even at near the speed of light, and require encryption for security, he says.
However, no amount of encrypting can guard against all biometrics-related crime. In Asia and South America, where biometric ATMs are becoming more common, criminals have cut off parts of victims’ fingers and used them to access accounts, says Schuckers.
And in Mexico, where one bank registered prints from two of each customer’s fingers to have a “spare” in case of a cut or other injury, an executive enrolled his own fingerprint as the backup print for a number of bank depositors, then helped himself to funds from his customers’ accounts, says Jain.
To further complicate biometrics, especially in emerging nations, many rural users might not have “good-quality fingerprints” because manual labor can wear down ridges, and cuts and calluses also can interfere with scans, says Jain. “That’s a big problem for using fingerprints for a certain section of the population,” he says.
Glitches also occur when a user improperly places a finger on the scanner, says Jain. Users might push too hard, swipe the finger too quickly or too slowly, use a finger that is too wet, or one covered with a bandage, he says.
ATM makers struggle with the ergonomic challenges of designing machines that steer users toward proper finger positioning, says Mark Grossi, chief technology officer at NCR Corp. and head of the Duluth, Ga.-based company’s labs in Scotland. “We go to all sorts of lengths to create the right physical
encapsulation of the reader to reduce the opportunity to put your finger the wrong way on the sensor,” he says. “You’d be surprised at how many people point at the sensor with the finger tip rather than the flat part of the finger.”
More Use In India
Partly because of those design efforts, biometric ATMs are gaining some traction in rural parts of emerging nations, especially in India, where much of the population is illiterate or might have trouble remembering a personal identification number, analysts say.
Still, some observers take issue with the business case behind that rationale for biometrics in developing countries.
“If you can’t remember your PIN number,” notes Matt Simester, director of the London office of Westbury, N.Y.-based Auriemma Consulting Group, “should you really have a card? Why would you want to give a card to someone who can’t control their finances? How can they read a statement?”
On the plus side, biometric scans can relieve consumers of the need to keep a card in their wallets, but some question how big an advantage that represents, Holland says. “How inconvenient is it to swipe a card or to carry a card with you?” he asks rhetorically. “The only place I can see where Pay By Touch would have had any real likelihood of success would be in nudist colonies.”
Clothing–or lack of it–aside, biometric scans could enhance security if issuers used the technology to augment cards instead of to replace them, says Holland. But with fraud rates steady over the past several years, not many industry professionals have felt a need for the added precaution, he says.
Plus the industry is finding it easier and more cost-effective to upgrade the cards themselves than to undertake the costly switch to biometric payment terminals, says Holland.
Biometrics does little or nothing to prevent deception in card-not-present transactions conducted on the Internet or by phone–the very type of fraud now on the rise, says Simester. “If it was a way of reducing fraud with very reliable technology,” he says of biometrics, “then I’m surprised it isn’t being implemented more quickly or isn’t higher up on the strategic agendas.”
Moreover, biometrics does nothing to ease the everyday challenges financial institutions and retailers face with ATMs or at the point of sale, such as speed of transaction or any other aspect of the consumer experience, Simester says.
Drawbacks also often occur with biometrics, others concede. In Japan, for example, ATM deployers have enhanced security by using biometrics to authenticate smart card transactions, while addressing the issue of speed by storing the biometric data on the card instead of in a centralized database, says Jim Pettitt, director of ATM security portfolio strategy for North Canton, Ohio-based Diebold Inc. However, those fixes increase costs, he notes.
A Payments Comeback?
Despite all the objections to biometric payments, the technology is becoming more widely accepted for travel and border security in the United States, analysts say. Once biometrics becomes familiar at customs desks and airport check-in, it could spread to payments, they contend.
“As more and more people travel and biometrics becomes more accepted–for example identification at airports and through major transit areas,” says Simester, “people will just get more used to it.”
Fear of terrorist attacks may convince Americans to embrace biometrics for travel and then accept it in commerce, agrees NCR’s Grossi. “We’re seeing a change in society, where people are willing to trade a little bit of privacy for security,” he says.
“Point of entry rather than point of sale” is how Schuckers describes the situation. American consular officials stationed abroad capture fingerprint or iris scans when granting visas to foreign nationals, Schuckers says. When the visitors enter the United States, the biometric scan verifies that the visa was issued for that individual, he says.
Biometrics is creeping into American life in other ways, too, says Jain. For example, cashiers at Meijer Inc. supermarkets in his home state of Michigan identify themselves to the POS system by scanning a finger when they begin their shifts, he says.
A similar practice is preventing bartenders from looting the pubs and taverns of Europe and is spreading to the United States, says NCR’s Grossi. The system takes on particular importance in large, dark, noisy and confusing nightclubs with large staffs, he says.
Some American banks are using biometrics to identify employees with responsibility for sizable funds transfers, says Tapen Sinha, a visiting professor at Georgia State University and a professor at the University of Nottingham in the United Kingdom. While in the United States, he has been working on security issues with the Federal Reserve Bank of Atlanta and has had first-hand experience of the need for greater security.
“Banks don’t want to play up these numbers,” Sinha says, “but there was a case last year where somebody moved $40 million from a U.S. bank to the Philippines, and the money just disappeared.”
On a smaller scale, tourists entering Walt Disney World in Orlando, Fla., insert a ticket into a turnstile and place a finger on a sensor, Jain says. The system links the fingerprint and ticket, preventing guests from sharing their tickets with anyone else, he says.
Eventually biometrics will become part of the fabric of life, analysts predict. Already, Jain is becoming accustomed to biometrics because he uses a finger sensor to log onto his laptop computer.
And then there is the fun factor. Several years ago, Jain took his children to an orthodontist who used a fingerprint scanner to log in patients. Won over by the system’s high-tech charm, the children pronounced it “very cool.”
Jain himself seems impressed because the system delighted the kids at a cost of “only a few hundred bucks.”
Biometrics Worked: 'It Was A Good Product,' Store owner Says
When the company known as Pay By Touch filed for bankruptcy in 2007, one of the 3,000 stores using its biometric authentication and payment service was West Seattle Thriftway, a 32,000-square-foot upscale independent grocery store in West Seattle, Wash. The relationship made Paul Kapioski, who owns the food store, a witness to the end of an era.
Analysts and scientists agree that not much has happened with biometric payments in the United States since the bankruptcy of Solidus Networks Inc., the company that did business as Pay By Touch. “That’s been dead and gone for some time,” Kapioski says of the short-lived movement to replace card readers with fingerprint readers.
But to hear him tell it, the technology was good while it lasted and still may have a future.
Published reports say his Thriftway store installed the scanners in 2002, but enough time has passed that Kapioski cannot confirm the year with certainty. He does remember distinctly that he got just one week’s notice to turn off the machines before Pay By Touch stopped servicing them.
“We wish personally that the company would have stayed in business,” he says today. “It was gaining a lot of momentum.”
During the five or six years the scanners graced all 13 of the store’s checkout lanes, they accounted for as many as 10% to 15% of electronic transactions, Kapioski says, noting the customer base for biometrics still was growing when the end came for Pay By Touch. Shoppers appreciated the convenience of placing a finger on the reader to pay instead of searching through a wallet or purse, Kapioski says.
“It was a nice convenience,” he adds.
Reports from 2007 pegged the number of Pay By Touch users at 3.5 million.
The Thriftway store benefited, too. The scanners reduced charge-backs almost to zero, and they drastically decreased the number of checks returned to the store for nonsufficient funds by intimidating would-be check kiters, Kapioski says.
“The element of people out there who were involved in fraud would see the finger-image reader, and they would shy away from the business,” he says.
Kapioski would do it again if someone else offered fingerprint scanning, but only after checking vendors’ capitalization. He has no desire to familiarize his customers with another payment method, only to have it disappear after becoming a comfortable piece of the shopping experience.
“Someday, it should work,” he says of biometric payments. “It was a good product.”
To reach its full potential, biometric payment requires the synergy of multiple stores, and Kapioski would like to see more sign on than did in the past. “You need to be able to use it at our store and down the street at the hardware store and the drug store—then it really becomes something,” he says.