The recent announcement that Amazon has started using palm scanning payment technology shone a light on the rise of biometric technology – and whether or not consumers are ready to let their bodies be part of transactions.

The Amazon One scanner - on trial in its Seattle stores - registers an image of the user's palm, letting them pay by hovering their hand in mid-air. "In most retail environments, Amazon One could become an alternate payment or loyalty card option with a device at the checkout counter next to a traditional point of sale system," the company stated, adding that it is in talks with several other interested parties.

However, be it palm, face eye or pulse scanning, the main hurdle to widespread roll-out of these technologies is people actually being willing to use them.

Stuart Sharp, vice president of solution engineering at OneLogin, stated: "The main challenge for them will be user-acceptance in using biometrics as a component in the multi-factor authentication mechanism, as well as bringing awareness and understanding on how they are meeting privacy requirements for storing sensitive personally identifiable information centrally on the cloud.

“Amazon need to be transparent with their users about the controls applied to meet security and privacy requirements,” he continued, adding that tech leaders should endeavour to use device-based biometric authentication whereby the data is confined to the end-user’s device, as “this reduces the risk of compiling all the user’s sensitive data in one package and creating the perfect bullseye for cyber criminals”.

Privacy concerns

Javvad Malik, security awareness advocate at KnowBe4, agreed that the biggest concerns around this type of payment system will be how personal data is used to identify and track individuals.

“While convenience is good for merchants and customers, it shouldn't be done at the expense of privacy – these are areas where there needs to be serious consideration of allowing a big tech company to have access to another extremely valuable dataset of information that can be monetised.”

However, a survey last month of 2,100 consumers by Juniper Research and Okta found that for less than £100, a majority of UK consumers would be prepared to exchange their purchase history (63 per cent) and location data (62 per cent) – although most drew the line at biometric data (67 per cent).

Another study, conducted among 2,000 UK adults on behalf of Equifax at the end of 2019, found that 71 per cent would be happy to completely replace traditional security methods to access their mobile phones in favour of fingerprint ID, facial recognition or eye retina patterns.

Respondents were more wary when it came to using biometrics to withdraw cash (46 per cent), start their car (45 per cent) or unlock their front door (41 per cent) though.

The research also revealed that fingerprint verification was considered the most secure form of biometric verification (31 per cent), with 30 per cent expecting it to become the most prevalent in the next decade – followed by facial recognition (18 per cent) and retina patterns (17 per cent).

Kevin Freiburger, director of identity programs at payments tech firm Valid, stated that regulation and education are critical to mass adoption.

“Many regulators and the population at large do not understand the technology and its use cases – that drives various concerns that are often not applicable in the context where biometric applications are used.

“Outright bans will not work because the technology is here and it has staying power,” he added, noting that many of the issues found within the criminal domain do not cross over into civil applications.

Bans in certain states and cities typically derive from concerns regarding civil liberties and data privacy, usually citing problems with using biometrics because the matching algorithms do not perform equally across segments of the population - age, gender, skin tones - which are concerns that need to be mitigated within a criminal use case of biometrics, explained Freiburger.

He noted that almost all new mobile devices come with biometrics embedded. “These are great examples of biometric use cases in a civil context - I think we’re on an s-shaped growth curve and it’s still early in the development phase for the technology - we aren’t even close to the maturation phase yet.”

Michel Roig, head of payments and access at Fingerprint Cards, explained that in terms of security, a leading myth about biometrics is that when a fingerprint is registered to a device, it is stored as an image of the actual fingerprint, which could be stolen and used across applications.

“In reality, biometric data is stored as a unique template per device in binary code, which makes hacking considerably more challenging and rewards limited per device.

“While the internet may be rife with videos of gummy bear and cello tape-based spoofs tricking biometric systems, the reality today is far different,” Roig continued. “Modern capacitive sensors have many advanced technological defences, such as improved image quality and matching algorithms.”

The race to acceptance

There are, of course, various different forms of biometric technology competing for the widest adoption from banks, merchants and consumers.

Juniper Research analysis suggested that mobile-based biometrics will authenticate $2 trillion worth of remote and in-store payments in 2023 - up from an estimated $124 billion in 2018 - with the fastest growth coming from biometrically-verified mobile commerce transactions, which will represent 57 per cent of biometric transactions in 2023, up from 28 per cent in 2018.

The same report estimated that around 90 per cent of smartphones can support facial recognition, while 80 per cent support voice-authentication, with a forecast that more than 1.5 billion mobile devices will use software-based biometrics by 2023.

As for biometric cards, one area being explored by issuers is fingerprint recognition for contactless card payments in place of PINs. Retailers are keen on this technology, as it means terminals don’t need to be upgraded. Like facial recognition, the customer’s fingerprint scan on the sensor is compared with their fingerprint data securely stored in the card.

At the end of last year, Nets launched a pilot programme testing facial recognition as a payment method. Around 1,000 people signed up to participate in the pilot in a co-working space, which linked their face with their employee ID card, enabling them to pay in local shops and restaurants with their face.

In April 2018, Nets also launched a finger vein payments pilot at Copenhagen Business School. That was in collaboration with British firm FinGo, which has since completed trials with Costcutter at Brunel University as part of a cashless push across campus.

Simon Binns, chief commercial officer at FinGo, said that more than 1,300 users signed up in the first month, which he argued demonstrates consumer demand.

“As for retailers, biometrics plays directly into a number of ambitions we’re seeing from the big players – they’re looking for automated, secure solutions to reduce friction and improve the overall customer experience,” he commented. “They’re also looking for ways to reduce fraudulent activity, to play a part in the shift away from cash, and to combine payment at self-checkouts with additional services such as loyalty schemes and age verification.”

Binns said that there’s a knowledge gap though, with most people not knowing they have a unique vein pattern, let alone that they can be connected with payment, identity and loyalty in a secure way.

“All biometrics tend to be grouped together, and we find there’s not a great deal of awareness of vein pattern technology within retail and other sectors,” he continued, adding: “The problem you have when you group them together, is that people default to thinking about fingerprint - which has been criticised for being unreliable - or face recognition which has hit the headlines with privacy concerns and user experience issues.”

Retina scanning, or iris recognition, uses individual patterns in the eye that can’t be replicated. However, the challenge is remaining in one position while taking the scan, along with problems with camera resolution. Similarly, voice recognition can be time consuming and potentially embarrassing in-store.

Electrocardiogram (ECG) authentication effectively turns the consumer’s heartbeat into a unique key, which could allow retailers to know their customer better and personalise in-store experiences.

One company looking to bring biometrics in-store is Hungarian startup PeasyPay, which lets users take photos to create digital profiles with their palms and faces through an app, before registering bank card details on an integrated payment gateway.

The actual in-store payment process is implemented by using a special point of sale (PoS) machine, equipped with cameras and facial recognition software that scans customers’ faces and palms and compares them to the existing biometric template.

PeasyPay’s product leader Csaba Körmöczi explained that there were some issues from the merchants’ side, in terms of registering for the payment gateway being “a little bit difficult and time consuming”.

He also noted that from a regulatory point of view, some countries handle biometric authentication-based systems in line with the General Data Protection Regulation (GPDR), but others have more strict data protection legislations. “In these cases not all market segments are available, so the usage of our system is a little bit restricted.”

Already being trialled across continental Europe, the company is due to start a pilot soon, helping pay taxi drivers’ entrance fee to Glasgow Airport.

“We think that Asia - mainly China - and North America - mainly the US - will have a massive increase in the biometrics in retail, and of course we hope that Europe will be able to catch up as well,” Körmöczi added.

Pandemic payment push

Vince Graziani, chief executive of Norwegian fingerprint recognition specialist IDEX Biometrics, said that the pandemic has accelerated the shift towards a cashless economy – even among those who were previously sceptical.

“Touch-free payments have quickly become second nature, tapping cards instead of using cash or punching in a PIN to minimise the spread of Coronavirus,” he stated, adding that public safety messaging, combined with retailers pushing for contactless, has done in months what would have taken years.

“There has been very little push-back from both retailers and regulators, in fact many have encouraged consumers to use contactless payments for hygiene reasons, following the World Health Organization’s advice.”

Graziani said that biometric payment cards have garnered more attention through various trials, but in order for the technology to be widely accepted, major card issuers now need to leverage the technology more widely.

Obviously he has a vested interest in fingerprint cards winning the race to acceptance, but Graziani did point out that with most authorities requiring mask wearing during the COVID crisis, facial recognition software has been dealt a significant blow.

Roig from Fingerprint Cards also argued that fingerprint data is more easily collectable and measurable than vein biometrics, enabling a simpler user experience and more advanced processing algorithms, which help improve security.

“Fingerprints are a biometric identifier that largely remains permanent across a person’s lifespan, unlike facial biometrics, for example, which are far less stable and require updates over time,” he stated.

“Biometric payment cards were already high on the agenda as we entered 2020, but there’s no doubt the pandemic has thrown new momentum behind the technology,” concluded Roig.

“Close collaboration with the payments ecosystem also means the technology is bank-approved and in line with leading testing and certification standards - including recent accreditations from Mastercard and Visa - so as prices continue to fall and early adopter banks roll-out, we expect several to follow in close succession to avoid losing market share.”

Share Story: