Goodbye, Password. Banks Opt to Scan Fingers and Faces Instead.
Goodbye, Password. Banks Opt to Scan Fingers and Faces
Instead.
By MICHAEL CORKERY JUNE 21, 2016
The banking password may be about to expire — forever.
Some of the nation’s largest banks, acknowledging that
traditional passwords are either too cumbersome or no longer secure, are
increasingly using fingerprints, facial scans and other types of biometrics to
safeguard accounts.
Millions of customers at Bank of America, JPMorgan Chase
and Wells Fargo routinely use fingerprints to log into their bank accounts
through their mobile phones. This feature, which some of the largest banks have
introduced in the last few months, is enabling a huge share of American banking
customers to verify their identities with biometrics. And millions more are
expected to opt in as more phones incorporate fingerprint scans.
Other uses of biometrics are also coming online. Wells
Fargo lets some customers scan their eyes with their mobile phones to log into
corporate accounts and wire millions of dollars. Citigroup can help verify
800,000 of its credit card customers by their voices. USAA, which provides
insurance and banking services to members of the military and their families,
identifies some of its customers through their facial contours.
Some of the moves reflect concern that so many hundreds
of millions of email addresses, phone numbers, Social Security numbers and other
personal identifiers have fallen into the hands of criminals, rendering those
identifiers increasingly ineffective at protecting accounts. And while thieves
could eventually find ways to steal biometric data, banks are convinced they
offer more protection.
“We believe the password is dying,” said Tom Shaw, vice
president for enterprise financial crimes management at USAA, which is based in
San Antonio. “We realized we have to get away from personal identification
information because of the growing number of data breaches.”
Long regarded as the stuff of science fiction, biometrics
have been tested by big banks for decades, but have only recently become
sufficiently accurate and cost effective to use in a big way. It has taken a
great deal of trial and error: With many of the early prototypes, a facial scan
could be foiled by bad lighting, and voice recognition could be scuttled by
background noise or laryngitis.
Before smartphones became ubiquitous, there was an even
bigger obstacle: To capture a finger image or scan an eyeball, a bank would
have to pay to distribute the necessary technology to tens of millions of
customers. A few tried, but their efforts were costly and short-lived.
Today, the equation has changed. Many models of the
iPhone have touch pads that can scan fingerprints. The cameras and microphones
on many mobile devices are so powerful that they can record the minute details
needed to create a biometric ID.
The smartphones also provide an extra layer of security:
Many biometric features will only work when used on the specific phone that
belongs to the bank account holder.
“If you have your phone and you are authenticating with
your fingerprint, it is very likely you,” said Samir Nanavati, a longtime
biometrics expert and a founder of Twin Mill, a security software and
consulting firm.
The trade-off, of course, is that in the quest for
security and convenience, customers are handing over marks of their unique
physical identities. After all, it is easy to change a compromised password.
But a fingerprint must last forever.
Some bank executives say customers often ask whether
their biometric information will become part of a private database, akin to
what the F.B.I. keeps.
The banks themselves are not keeping caches of actual
fingerprints or eye patterns. Rather, the banks are creating and storing what
they call templates — or what amount to long, hard-to-predict numerical
sequences — based on a scan of a person’s fingerprint or eyeballs.
It is possible that the thieves could use the biometric
templates to steal money, but the banks say they have worked to develop
additional safeguards. With some voice authentication systems, banks use
certain prompts to prove it is a living customer and not a recording. Many eye
scans require customers to blink or move their eyes to prevent a thief from
using a photo to gain access.
Wells Fargo has been working with EyeVerify, a start-up
in Kansas City, Mo., to develop its eye scan feature, which is being tested
with a small group of corporate customers. The technology creates a map of the
veins in the whites of an eye.
To log into an account, a customer taps open a Wells
Fargo app on a smartphone. When prompted, the customer’s eyes are lined up with
a pair of yellow circles on the phone screen. If they match, the customer —
typically a chief financial officer or other top executive — gains instant
access to the account and can start moving money or conducting other
transactions.
Wells Fargo executives said the eye scan could eventually
offer an alternative to the authentication system used for corporate accounts,
which involves physical tokens that generate numeric pass codes every few
seconds. Although generally considered secure, these tokens can be a hassle to
carry around.
For now, Wells Fargo is offering eye scans — among the
most foolproof biometric technologies, according to security experts — only to
select corporate customers, for whom the stakes are arguably higher because
there is potentially so much money involved.
“It is harder to take someone’s eyeball than someone’s
user ID and password,” said Steve Ellis, who leads Wells Fargo’s innovation
group that worked on developing the eye scan authentication. The bank also made
an investment in EyeVerify.
Instead of eye scans, Bank of America has embraced
fingerprints. Since it began offering the option in September, about 33 percent
of the bank’s 20 million mobile banking customers have started using a
fingertip to get into their accounts.
There are limits, though, on how far an average retail
customer can proceed through the banking process without a password.
For example, JPMorgan Chase customers can gain access to
their bank accounts with their fingerprints, but have to use a traditional
password to transfer money.
Still, the speed and accuracy of the banks’ biometric
capabilities are especially notable because they are emerging from an industry
known for its antiquated system of tellers and branches and endless reams of
paperwork.
Wells Fargo’s eye scan technology, for example, worked so
quickly that the developers had to slow it down by a few seconds so customers
knew it had actually registered their identities.
It takes only about 40 seconds to capture enough
information about a customer’s vocal patterns to create a voice imprint that
can be used as a form of identification, according to Andrew S. Keen, director
of program management for Global Consumer Operations at Citigroup. Once a print
is established, it can reduce the time that customers spend identifying
themselves to a call center representative.
Many financial firms emphasize the convenience of
biometrics, but USAA is one of the few that highlights the effectiveness of
these technologies at thwarting thieves.
Since USAA began offering biometric authentication early
last year, more than 1.7 million customers have been accessing their accounts
using either their fingerprints, voices or facial scans.
“We can’t rely on personal identification information any
longer,” said Mr. Shaw. “We believe we have to rely on biometrics.”
A version of this article appears in print on June 22,
2016, on page A1 of the New York edition with the headline: Bye, Password. Now
a Fingertip Gets Clients In.
Comments
Post a Comment