Time to Start Planning for Biometrics
Bill Orr · ABA banking journal · 2000
Increasingly affordable and accurate, these security devices are poised for the mass market Biometrics is perhaps the oldest new technology in banking today. Biometric devices, which read and interpret human characteristics, have been around for 25 years and control access at 20,000 installations in the U.S. Some of them are in banks, guarding computer rooms and vaults. Electronic fingerprint matching is by far the greatest use of biometric technology. Advocates have predicted for years that biometric technology is about ready to take off and become a universal method of verifying a person's claim that she is who she says she is. That's not yet the case, but for a variety of reasons it looks quite close. Biometrics are very accurate, they can be inexpensive if adopted in large enough quantities, they can be convenient to use when they don't intimidate users, and they can eliminate of the costs of controlling access by present methods. Given the preoccupation with security in today's Internet-oriented business environment, the biometrics application most likely to get the attention of bankers is its potential role in controlling access to customers' accounts via an ATM or a personal computer. There are no such installations in the U.S. today, although an ATM pilot program in Texas seems to be winning customer support (see Two pioneering applications, p. 66). Technology providers say that other to-be-announced installations are in development. Ben Hammel, a senior sales engineer at systems provider Keyware, predicts that some big banks will be using biometrics for its high-end customers by the end of this year, and many big banks will follow suit in the next two years. Prices are the main barrier to a mass market for biometrics devices. They're coming down fast. Between 1993 and 1999, the average price per access point fell by more than 90%, from $6000 to $500, says Erik Bowman, a biometrics solutions manager at Anadac, a unit of fingerprint-system provider Identix. Hand-geometry devices, the 20-year-old veteran method, fell to $300 and fingerprint readers fell to as little as $100, he says. When built into PCs, as is now happening, the cost will be negligible. Standards are emerging Microsoft and other service providers have committed themselves to coming up with standard software interfaces for various types of devices. The International Biometric Industry Association, www.ibia.org, is working to insure that national legislation such as 1999's financial services modernization provides a level playing field for biometrics devices. The Biometric Consortium, www.biometrics.org, lists technology and device providers with links to each firm's website. In the near future, the spreading use of public key infrastructure (PKI) technology in support of digital signatures and comprehensive e-commerce security systems will generate demand for a user-friendly method of personal authentication. That's because present PKI systems authenticate the digital certificate that is related to a private key, not necessarily the person who is claiming identity. Another pressure for biometrics comes from users who would welcome a single personal access code to replace the proliferation of passwords and PINs that millions of users are asked to memorize (a point confirmed by customer research; see Two pioneering applications). Bank IT departments, too, would welcome relief from the considerable expense of handling lost and stolen cards or forgotten PINs. And with biometrics, nobody but the true owner can access an account or use a credit, debit, or smart card. Bio plus metric = positive ID Biometrics is one of three generic ways of controlling access. A security system can grant access based on what a user has (e.g., a bankcard), what she knows (e.g., a PIN), or who she is (a biometric). Present ATMs use a combination of card (generically, a token) and PIN. …