In the film Minority Report, Tom Cruise undergoes dangerous eye replacement surgery in order to hoodwink the countless retina scanners of the year 2054. Such surgery might not (yet) be an option in 2015, but we certainly have not been made to wait another 40 years for a world rife with biometrics.<\/p>\n
Biometrics refers to technology whereby a person\u2019s identity is verified by their biological attributes \u2013 facial structure, voice patterns, retinas and fingerprints.<\/p>\n
Biometric authorisation spans the width of the economic spectrum. Those who own the latest iPhone make use of a fingerprint scanner whenever they unlock it.<\/p>\n
On the other side of the poverty line, the South African Social Security Agency (SASSA) possesses the fingerprints and voice data of its roughly 15 million social grant beneficiaries, who will have received a biometrically verified annual sum of R410 billion by the end of the financial year.<\/p>\n
A fraud-infested, security-inhibited part of most of our lives \u2013 in dire need of biometric salvation \u2013 is banking.<\/p>\n
Existing call-centre verification questions \u2013 requesting ID numbers, and mothers\u2019 maiden names \u2013 are tedious and relatively easy to work around: personal data is often unknowingly accessible on social networks or can be bought and sold on the black market. It is frightfully easy for criminals to pretend they\u2019re you.<\/p>\n
Private banking titan Investec has announced that it will soon offer real-time biometric verification to its clients. Instead of answering the conventional questions, the software will recognise your voice to verify your identity.<\/p>\n
\u201cThe voice, like a fingerprint, is unique \u2013 it doesn\u2019t change. The technology has matured very nicely. The first couple of times [that you call], we build a voice print for you, and in the future when you call we compare it to the existing voice print,\u201d says Craig West, head of Investec\u2019s Global Client Support Centre. \u201cEvery bank worries about security. If you\u2019re not who you say you are, the technology will know.\u201d<\/p>\n
The reasons for using biometrics are twofold: \u201cOne reason is to improve the client experience. The second is to enhance security.\u201d West adds that these two factors are closely linked. Consumers\u2019 experience will be enriched, since they can authenticate their calls simply by \u201cutilising a normal discussion\u201d.<\/p>\n
This technology is unfortunately not yet available for the bankers\u2019 most vulnerable sphere: online banking.<\/p>\n
Internet banking has been susceptible to fraudsters because its geographic possibilities are as endless as the Internet\u2019s, and because it makes use of \u201cstatic\u201d values \u2013 values that do not change \u2013 for passwords. If a criminal learns your pin or password, he enjoys unlimited access until you become aware of the breach \u2013 often long after you can remedy it.<\/p>\n
Johan Gerber, group head of Processing Product Management at MasterCard, explains how the industry is trying to combat this: \u201cWe want to get to a point where we use dynamic values, not static values.\u201d This method of using an ever-changing keyword to gain access is called tokenisation.<\/p>\n
Banks have implemented procedures that use these dynamic values. Absa sends to your registered mobile number a randomly generated TVN or RVN (Transaction\/Random Verification Number) that you are required to enter when adding a new beneficiary or paying one for the first time. It also sends you an SMS-notification when your Internet banking account is being accessed.<\/p>\n
Most of the other retail banks use similar cellphone-centred verifications, such as confirmation based on responding to a text message alert.<\/p>\n
These methods of tokenisation have reinforced banking security since their introduction, but most of them are based on the out-dated assumption that you are banking from a computer.<\/p>\n
Internet banking and cellphones are no longer mutually exclusive. According to Ernst and Young\u2019s Global Commercial Banking Survey of 2014, 66% of African users use mobile devices for banking. If someone has both your phone and passwords, you are completely exposed.<\/p>\n
Biometric authentication is then a strong candidate to combat these weaknesses. Its appeal lies in its simplicity. Additional security measures typically retard the process of payment or log-on, to the detriment of the consumer\u2019s experience.<\/p>\n
\u201cNormally, if you increase consumer experience you increase risk exposure, but biometric verification flips this whole thing on its head. It places no burden on the consumer,\u201d says Gerber.<\/p>\n
This authorisation will assist other sectors at risk. Per the 2014 Card Fraud Statistics of the South African Banking Risk Information Centre (SABRIC), losses due to credit card fraud were 23% higher in 2014 than in 2013. Card security would be bolstered by biometric authorisation.<\/p>\n
MasterCard recently completed its testing of a beta-version mobile app with voice and facial recognition used by a test group of employees in an e-commerce environment. Its success rate was 98%.<\/p>\n
This means only 280 out of the 14 000 transactions were unsuccessfully verified.<\/p>\n
Biometrics itself is not foolproof. According to an article by Tom Olzak, author of Enterprise Security: A Practitioner\u2019s Guide, the biometric crux is to find the right balance between false positives and false negatives.<\/p>\n
A system that is too lenient in accepting a reading might grant unpermitted access. Conversely, if the security is too strict, even the valid entrants could be rejected.<\/p>\n
Unless it works faultlessly, users will refuse the technology. If there is no work-around, companies will lose business.<\/p>\n
The consequences for consumers of erroneously granted biometric access are graver still: astronomical fraudulent credit card charges and purged savings accounts.<\/p>\n
Banking and card security systems must be universal. The same credit card is often used in various countries. If one card transaction is subject to biometric authorisation in one place, this needs to work everywhere. \u201cWe set standards at global level,\u201d Gerber explains.<\/p>\n
\u201cWe are in discussions as an industry with banks in order to put a road map in place for the South African market,\u201d says Gerber.<\/p>\n
Republished with permission from Moneyweb<\/strong><\/a><\/em><\/p>\n Beware of these card skimming devices at ATMs<\/strong><\/a><\/p>\nMore on banking security<\/h3>\n