How ATMs Can Use Biometrics to Combat Fraud
Back to the future at your local ATM
Iris-scanners and biometric fingertip readers sound like something out of a spy-thriller, but these devices have already been adopted by financial institutions in international markets. More than 15 million citizens use the technology in Japan alone. Banks in Mexico, South America, Africa, and the Middle East are also moving toward the new technology due to its popularity with rural consumers who aren’t accustomed to carrying bank cards (but apparently don't mind having a machine scan their bodies).
In the current market, Western banks and financial institutions are already set to integrate biometric technology with mass market banking.
Biometrics to Combat Fraud
Consumer liability for fraudulent charges and the cost of implementing biometric technology remain the top reasons why U.S. banks haven't yet adopted the ATM biometrics. In Japan, legislation requiring banks to pay for fraudulent charges led to more than 80,000 biometric ATMs being installed since 2006. In the United States, consumer reluctance and privacy concerns have been cited among the main drawbacks, but a recent survey shows consumers in all age groups overwhelmingly vote for biometric scanning as the preferred authentication method for ATM withdrawals.
According to industry numbers from Javelin Strategy & Research, one-tenth of fraud cases in 2009 involved unauthorized ATM withdrawals. ATM skimming devices that capture card data and PINs are not the only security threat; at the annual Black Hat information security conference, noted hacker and security specialist Barnaby Jack hacked into the ATM’s rootkit, gathered card data, and emptied the ATM’s cash reserve. Fortunately, the security guru also revealed safeguards that could easily be implemented to prevent the same type of attack.
Traditionally, access to a checking account has been with a debit/ATM card and PIN. But with every new data breach (as well as increasingly hard-to-detect skimmers), thieves have more ways to steal money. Cards with smart chips should slow that trend, but tech-savvy thieves are not going to give up easily.
Even with high-tech cards, there's still a risk of somebody besides the authorized account holder using a card; it might happen because you share your card (and PIN) with a "trustworthy" friend, or because a card is lost or stolen and the PIN is easy to find. Because PINs are hard to remember, they are often kept with cards, which of course defeats the purpose entirely.
With biometric technology, banks can be sure that only the authorized account holder can make withdrawals. And consumers might enjoy knowing that there's no need to remember a code—your body has everything needed to complete the transaction. In fact, some banks are even looking at card-free transactions (or at least using a chip in your phone instead of a plastic card).
ATMs of the Future
Today’s biometric scanners go far beyond basic fingerprint recognition. According to security experts, fingerprints can easily be lifted and replicated. In Poland and Japan, consumers are already using Hitachi's infrared scanners that capture the unique pattern of capillaries in the finger and hand. The most secure biometric technology uses a device designed to perform an iris scan based on more than 2,000 unique measurement points. According to developers, people and pets all over the world will be connected to a system that uses iris scan identification within the next decade.
But we don't need to wait that long. Finger scanners already authenticate customers, sometimes by reading the vein patterns in a finger instead of an old-fashioned fingerprint. If you've recently done business with a teller or accessed a safe deposit box, there's a good chance you've left some kind of biometric record with the bank.
If biometric security is so great, why don't we have it everywhere? Again, some consumers are uncomfortable with having their bodies scanned, and having that information stored with numerous financial services companies.
In addition, the technology needs to function properly—especially when it comes to ATMs. An ATM is a self-service machine, and it'll never get used if it's cumbersome to get authenticated. Consumers might not understand how to interact with the machines (or they might not want to put their eyes within a few inches of the machine), and machines need to be almost 100% reliable. In the past, ATMs with fingerprint readers have had problems with "well-worn" fingers, and they don't work when they're dirty.
Vein and iris scanners are more reliable, but it is costly to outfit machines with new technology.