Making a payment using a part of your body is no longer science fiction. These are exciting days in the world of biometrics and payments. Visa and MasterCard are both working on specifications that will impact consumers globally.

Let’s take a quick tour around the global world of biometric payments:

• In Nigeria, biometric data is captured by the government and centralized, enabling banks to verify the customer’s identity
• More than 80,000 biometric ATMs are in use across Japan identifying accountholders via palm or finger vein scanning
• In 2013, Citibank introduced biometric ATMs in Singapore, Malaysia and the Philippines, and they’re also live in Brazil and Poland
• More than 400,000 USAA customers have opted in to use fingerprint, face or voice recognition with the company’s mobile app
• Barclays is using finger vein readers to authenticate key corporate banking customers.

Many other financial services companies and fintech providers are on the cusp of transitioning to biometrics. UK’s digital Atom Bank says it plans to use biometrics for authentication, and France’s Groupement des Cartes Bancaires card scheme reports to be evaluating modality options.

The Mobey Forum’s Biometrics Workgroup found that consumers have adjusted quickly to the concept, particularly on mobile devices. The introduction of Touch ID on iPhones has them not just accepting of biometrics, but seemingly eager for it.

Blink and buy

“Two things have kind of converged,” says Bob Reany, senior vice president of Identity Solutions at MasterCard. “One is that passwords suck and people are fatigued. The other is that there’s a nice substitute at the tip of our fingers.”

Reany says technological advances have delivered safe and simple solutions enabling a biometric payments boom. Smart phones and other devices are penetrating the market with touch screens, microphones and high-resolution cameras.

Look no further than MasterCard’s pilot in the Netherlands last summer for proof that password fatigue is real. Volunteers had no qualms about using biometrics to make purchases. In fact, registration for the pilot maxed out within a day and enrollment surged past the planned 750 participants. ABN AMRO Bank was so happy with the results of the trial that it has continued offering biometric payments online for its customers.

“We just finished two pilots, one in the U.S. and one in the Netherlands, and we’re helping people make safer and simpler payments using biometrics in place of a password,” Reany says.

To keep transactions as secure as possible, the MasterCard is taking a multi-layered approach. “We know about device identification, geo location, forensics and analytics on behaviors. So you take everything that we already have, and you add another layer on top of that which would be a biometric authentication.”

Say you’re ready to buy something on a merchant website, and you’ve already signed up for your bank’s mobile biometric payments option. “As a cardholder, that’s just another tool that your bank would offer, that MasterCard facilitates,” Reany says.

You hit the pay button, and a message goes from the merchant through MasterCard to the bank. “At that point, we would have sent a notification back to the person’s phone saying ‘hey, are you really trying to buy something?’ You press the phone once to say ‘yes,’ and then it says hold your phone up. You hold your phone up to your eye level, you blink your eye, and you never press another button. The blink triggers the fact that the consumer is verifying themselves and that they’re alive. Then we do a quick facial recognition match and give the approval,” Reany says. “Just blink and buy, it’s really that quick.”

The pilots focused on Internet purchases, where fraud is prevalent. They used three modalities: voice recognition, facial recognition and fingerprint. “We don’t believe in just one biometric modality. We like to be able to plug in more as technology advances, giving choices to both our banks and consumers,” Reany says.

EMV and biometrics

Visa is actively working to add the security and convenience of biometrics  –  palm, voice, iris and face  – to chip card transactions. The organization’s new specification provides a framework for biometrics to be used as a cardholder verification method with EMV chip payments. That means the users of 3.3 billion EMV chip cards around the world may soon be forgetting their PINs. The specification supports match-on-card biometric authentication, so the biometric isn’t exposed or stored in any central database.

“There is increasing demand for biometrics as a more convenient and secure alternative to signatures or PINs, especially as biometric technologies have become more reliable and available,” said Mark Nelsen, Visa senior vice president of Risk Products and Business Intelligence. Building the biometric option on top of the EMV chip standard provides a common, interoperable foundation, he explains.

Visa has offered to contribute the technology to EMVCo, the global body that manages the EMV specifications and works to facilitate interoperability and acceptance of secure payment transactions worldwide.

Visa is pursuing what it sees as strong interest in biometric solutions in South Africa and other developing countries. It began a proof of concept trial last fall with Absa Bank, a subsidiary of Barclays Africa Group. Cardholders are using fingerprint readers at select Absa ATMs instead of passwords.

“The movement towards added security is already happening. We’ve added the processors onto the cards, and I think biometrics will be the next step,” says Todd Mozer, president and CEO of Sensory, a licensing company focused on voice and vision technologies.  “It’s not just having that smart card. It’s also knowing who you are when you do the transaction. It’ll be quite natural for the mobile phone to come more into play for products like Square, where you might as well use the camera and the microphone that’s there for doing a biometric.”

A significant challenge is the lack of a standardized approach to biometrics for mobile payment. “Google’s got their approach, Apple has their approach and a number of others are coming out as well. A clear standard will have to emerge that everybody at some point adopts,” Mozer says.

The future of biometric payments

MasterCard plans to launch biometric payments in North America sometime in 2016, and a global expansion will follow in 2017. By mid-year, U.S. financial institutions will be able to participate in MasterCard Identity Check, a suite of solutions that leverages advanced technologies to prove a consumer’s identity and simplify online transactions.

MasterCard is also eyeing wearables and the role it can play in payments. “We think that there’ll be scenarios where people don’t want to do anything to authenticate themselves,” Reany says. “They’ll want to put their watch or wristband on in the morning, and they’ll authenticate themselves once and walk around all day and things will just happen. Their car doors will unlock, their PCs will get logged onto and they’ll buy stuff.”

For now, the immediate focus seems squarely on biometrics. The company already offers a contactless tap and pay system using near field communication (NFC) that can be used with a fingerprint on a mobile device to authenticate a user. But Reany has loftier hopes for buyers at brick and mortar stores. “At some point, you’ll walk up to a grocery store, grab the things out of the aisle, and you’ll be able to check out without having to go through a lane. We call that in-aisle shopping.” Reany says the store of the future will be possible thanks in large part to biometrics. “They won’t have a clerk there, yet they’ll simply verify your identity and check you out.”

---

Related articles:

As Canada’s payment cards go to EMV, will fraud migration push U.S. banks to join the smart card world? Breaking down voice biometrics Mientras las tarjetas de pago en Canadá migran a EMV, ¿se sentirán presionados los bancos de Estados Unidos a unirse al mundo de las tarjetas inteligentes a causa de la migración del fraude?