|
Biometrics: Ready for Prime Time?
BY LAURI GIESEN
The industry experiments with employee, in-branch and online authentication, but questions about customer acceptance persist.
|
SYNOPSIS | Early biometric deployments are focused on authenticating employees. Usage for retail customers lags, driven by concerns about cost and customer acceptance. Applications thus far are limited to managing access to safety deposit boxes and authenticating customers in teller lines. Solutions providers now offer a wide range of products, including fingerprint and iris scans, voice recognition and, soon, devices that monitor keyboard usage.
Financial institutions are serious about their need to make absolutely certain that the customers visiting their branches, phoning their call centers, using their ATMs or accessing their bank services through home computers are who they say they are. Experts contend that there is no means of authentication better than biometrics — the identifying of people based on their physical characteristics.
But biometrics have yet to be deployed in a full-scale way by the financial services industry. The cost of implementation and the potential for customer resistance have given financial institutions pause.
Interest has revived recently, however, as banks conduct pilots and explore limited use of the technology to discover how best to use the analysis of fingerprints, hand prints, faces, retinas, voices, blood veins and other body parts to identify both customers and employees. In the last several months, several technology companies that had focused on retailers or other industries have introduced offerings tailored to bank applications.
The most pervasive use of biometrics today appears to be associated with employees rather than customers. In a recent report, Boston-based Celent LLC predicts that 2006 will see a major rollout in the use of biometrics by banks for employee-related applications. Retail applications involving branch customers are unlikely to occur before 2008, while remote use of biometrics in retail applications, including ATMs and online banking, is not expected to begin in earnest before 2009, according to Celent.
Celent’s forecasts jibe with a report from Boston-based Aite Group LLC, which predicts that 35% of financial institutions in the U.S. will use some form of biometrics by 2009. That compares to between only 5% and 7% today, with most of the current activity occurring with credit unions.
Experts expect that heightened concerns about financial fraud, combined with improvements in the technology’s reliability, will encourage more banks to join retailers, government agencies and other industries that have led the way in applying biometrics. In order for that to happen, banks need to learn more about the cost, use and customer issues associated with biometrics.
Here’s a look at various ways in which institutions are becoming familiar with biometrics today.
Authenticating Employees
Today, there’s no consensus on how to best use biometrics for financial applications. Some banks are more interested in identifying their employees than their customers — either for time-and-attendance purposes or for limiting employee access to sensitive data centers. This preference is dictated by cost issues (fewer employees to authenticate than customers), as well as the fact that banks don’t have to be concerned about negative customer reaction, experts says.
The use of biometrics for employee time-and-attendance validation is becoming popular, according to Ariana-Michele Moore, senior analyst for Celent. Because most banks currently use old-fashioned punchclocks, employees can sometimes arrive for work late or leave early and have their friends punch in or out for them. A biometrics solution enables branches to take a fingerprint or hand print when the employee actually arrives or leaves, thereby recording the exact time.
“In most cases, employees are only misrepresenting their time by 15 minutes or so, but even that can really add up for a bank with thousands of branch employees,” Moore says.
Fingerprint authentication systems that can be integrated to a door entry typically cost about $700 to $1,000 per branch unit, according to Colin McLaughlin, manager of premium sales for Bellevue, Wash.-based Saflink Corp., a developer of biometric technology that is currently in use with employees at about 100 financial institutions. The payback would depend upon the amount of fraud, the hourly wages paid and the number of employees per branch.
Another application is in controlling employees’ access to secured information. This can involve either access to data centers or computer databases that contain sensitive information. In the former case, employees who are authorized to enter a data room will use body parts to identify themselves. Iris scans are often used for this because of their high reliability, Moore says, noting that employees can provide co-workers with their passcodes, but not their eyes.
To control access to computer databases, banks can install special pads on PC keyboards. Employees provide a fingerprint on the pad before they log on to special applications. The system verifies the employee before granting access to the information.
Such a system is being used by New York-based Citigroup Inc. to identify employees who work in multiple branches, according to a report from Needham, Mass.-based TowerGroup. In the past, Citibank employees were issued passwords for logging on to PCs. But since each branch typically uses different passwords, employees who worked in multiple branches needed to remember multiple passwords. Now employees can touch a fingerprint pad before logging in. Biometrics has eliminated the password confusion because the fingerprint data is kept in a central file that can recognize employees regardless of what branch they’re working out of, says the TowerGroup report.
One of the biggest advantages to bank adoption of such a system is the offloading of some of the burden carried by Information Technology (IT) staff. “You can really improve efficiency by reducing the number of calls to IT by employees who forgot their passwords. It lets IT concentrate on more important issues,” says Josh Kessler, analyst and product manager for emerging technologies for TowerGroup.
Saflink’s McLaughlin explains that the total installation cost of hardware, biometric software and application software for a finger print-based system is typically about $150 per user with a continued annual maintenance cost of about $4 per employee. He says studies have indicated the annual cost of IT staff to deal with password-related questions is between $150 and $300 per employee. That would indicate an expected payback of between one to two years, McLaughlin says.
Safe Deposit Box Users and Branch Visitors
Authenticating access to safe deposit boxes is a first biometric application for many institutions. Banks using this technology include Charlotte-based Bank of America Corp. and Memphis-based First Horizon National Corporation.
At most banks today, customers requesting access to their safety deposit boxes need to arrive at the branch with a key. A bank employee then retrieves a second key and leads the customer to the box, which both keys are used to open. The employee often must wait for the customer to finish looking through the box before returning to lock up.
First Horizon didn’t like tying up employee time in this way. So it applied a hand geometry recognition system purchased from North Canton, Ohio-based Diebold Inc. to provide unmanned access to its safety deposit boxes. First Horizon customers who enroll in the system provide a hand print and are given an access code by the bank. When customers want to view the contents of their box, they place their hand on an unmanned scanner and then enter their access code to be admitted to an area where they can access their box in complete privacy.
“This frees up our employees to serve other customers rather than needing to wait while customers are looking through their boxes,” says Wayne Leggett, vice president of physical security for First Horizon. First Horizon chose hand geometry because of its reliability and the fact that it was not deemed to be intrusive, Leggett adds. He declines to reveal the cost of the system.
A spokesperson for Campbell, Calif.-based IR Recognition Systems, which developed the hand recognition system used in the Diebold product, says the cost is typically between $2,500 and $7,000 per work station depending on the feature set and the size of the installation, including equipment and software.
Another biometrics retail application is identifying customers in teller lines, usually with a fingerprint scanner that can be more secure than a driver’s license or other form of identification. Purdue Federal Credit Union of West Lafayette, Ind. used finger imaging-based kiosks for unmanned banking (see “Off-site Biometrics Authenticate Callers, the Unbanked,” pg.34) for the past decade, and it has used the same biometric technology to grant employees access to computer databases. Now the credit union is introducing a system from San Mateo, Calif.-based IDMetrics Inc. that will use finger images to authenticate customers in its branches, according to Gail Koehler, senior vice president of technology.
Koehler says customers in the branches will be asked to scan their fingers as well as either swipe their debit cards or enter their account numbers on a pad. That information will enable the system to identify the customer so that when the customer approaches the teller, the customer’s account information will immediately pop up on the teller’s computer screen. This system will speed up the handling of customers since tellers won’t have to ask for identification and type in account numbers.
Koehler says the system is being installed in six branches for $40,000, including the cost of equipment, software and vendor support.
“Using biometrics at the branches is much more cost-effective than using it for home banking and other applications,” says Bruce Cundiff, an analyst with Pleasanton, Calif.-based Javelin Strategy and Research. “With home banking you would have to distribute scanners to millions of customers in their homes. With the branches, you would need only one or two scanners per branch.”
Online Applications
The use of biometrics for home banking has received more attention recently in the wake of recommendations by federal regulators that financial institutions adopt “two-factor” authentication by the end of this year. In essence, that means use of a password or personal identification number alone is no longer considered sufficient. Biometrics is considered the most secure form of authentication available for that second factor.
“The need for stronger authentication is causing more institutions than ever before to consider and test biometrics,” says Christine Barry, research director for Aite Group. In order to avoid the cost of purchasing and shipping pads to consumers, many banks are instead looking at using tokens or “challenge” questions, where consumers have to give answers to questions for which only they would know the answer.
For more information on authentication, see “What Lengths Will Customers Go To Protect Their Online Accounts?,” in the November/December 2005 issue.
San Francisco-based Pay By Touch Inc., which markets fingerprint recognition for retail applications, recently began marketing to financial institutions an online system that utilizes a fingerprint pad. “We think biometrics will be the best alternative for financial institutions looking for a second-factor authentication,” says Executive Vice President John Siegal. “With fingerprint recognition you don’t have to worry about someone stealing your password.”
The Pay By Touch program could run on IBM Think Pads, which some consumers are already using for home computers. But for most customers, banks would have to purchase and ship these readers to their customers. Siegal says each pad would cost less than $30, depending upon the quantities purchased, and could attach to USB ports on most PCs.
Siegal says some financial institutions have expressed interest in using the system but declines to elaborate. But Pay By Touch’s system is already widely recognized by consumers for financial applications as the company has enrolled two million customers in programs enabling them to use their fingerprints to authorize checks as well as credit and debit card payments. “This system would be a lot easier for bank customers to use than jumping through all the hoops that the alternative systems require,” Siegal says.
While most of the proposed biometric systems for Internet banking involve finger or hand prints, New Hope, Pa.-based VoiceVerified Inc. has also developed a voice verification system. Currently being tested by two financial institutions, this program would allow customers to identify themselves by either speaking into a microphone connected to a PC or speaking into a phone, according to President and COO Wayne Cluff.
Cluff believes the latter will be the more common, given the fact that most home PCs do not have microphones. In this case, when customers log on to a bank site, they will either be given a phone number to call or the bank will call them at their home or office number. The customers would then be given a series of integers to repeat that would enable the bank to verify them based on their voice.
One of the major obstacles with finger and hand print systems is that banks would have to ship potentially millions of the devices to customers to incorporate into their home PCs. Then they would have to deal with the customer service issues associated with getting the systems set up and teaching customers how to use them.
“There are lower-cost options that are simpler for customers to use,” says Celent’s Moore. “But over time, I think you will see more banks move toward biometrics because it is more secure.”
First Horizon, for example, is happy with using biometrics for its safety deposit system, but does not plan to apply it to online banking just yet. “We really haven’t found a need for biometrics anywhere else,” Leggett says. In terms of proposed online banking applications, he adds, “This is one of those things where the systems look great, but it doesn’t always make sense when there are other alternatives available.”
Even Purdue Federal Credit Union, a leader in biometrics applications, hesitates to use fingerprint authen-tication for online banking, according to Koehler. There is the problem of getting the fingerprint pads into customer households, she says. “Obviously this is the technology we think would provide the best authentication. But we would either have to get all our customers to buy the pads or we would have to ship them out, and I don’t think we are ready to go forward with that yet.”
Even voice recognition systems, which do not require additional equipment, would require customers to take the additional steps of calling the bank or answering a phone call each time they wanted to log on to check a bank balance or pay a bill.
But while using these devices for a large-scale application such as home banking may be complicated, Javelin’s Cundiff proposes that banks consider using biometrics for corporate customers or at least high-end retail customers. With those customer segments, the cost of distributing the devices would be limited since there would be far fewer customers requiring the equipment and there is a risk for much larger losses.
“It would make sense to require that customers use a fingerprint or other form of biometric authentication on transactions of, say, $100,000 or more. This would be a more feasible use of the technology,” Cundiff says.
Questions or comments about this article? Post them at the Banking Strategies blog.
|
