Biometrics Payment Cards: Next-Generation Authentication

Subscribe To Download This Insight

3Q 2017 | IN-4649

MasterCard is trialing a bankcard that incorporates a biometric finger sensor, in addition to having a chip and PIN verification. The biometric payment card has already been trialed in South Africa, and MasterCard is now looking to make a transition to the European market in the next few months.

Registered users can unlock up to five pieces of premium content each month.

Log in or register to unlock this Insight.

 

Adding an Additional Security Layer

NEWS


MasterCard is trialing a bankcard that incorporates a biometric finger sensor, in addition to having a chip and PIN verification. The biometric payment card has already been trialed in South Africa, and MasterCard is now looking to make a transition to the European market in the next few months.

The card is a contact payment card that will allow people to make payments without needing to use a PIN, which will speed up payment methods (for contact payments) even further and may rival those of tap-and-go with the benefit of having no cap on spending limits in a single payment. This new payment card enhances the security of the chip and PIN because it does not have digits or a signature that can be copied.

Cost Remains a Major Adoption Barrier

IMPACT


The inclusion of biometric authentication in a payment card system is a bright new step for the biometrics market as payments is one of the largest sectors of the smart card market. A project such as this will provide credibility to the inclusion of biometric security on a large scale, opening more verticals, as well as adding more sophisticated security to payments. The finger sensor removes the possibility of PIN theft and therefore reduces the likelihood of petty crime and theft.

One major benefit is that the chip and PIN biometric card can be used on existing POS infrastructure. It functions on all current chip and PIN terminals, as the biometric data acts as the PIN code and up to two fingerprints are stored on the card. Because it doesn’t require a new type of authentication at the pay point, the payment terminals will not need to change, reducing the friction to mass use past the pilot project in South Africa. The main drawback is the lack of contactless, as MasterCard has yet to release a contactless variant. Contactless payment has proven a very popular method of payment in many countries worldwide, and the addition of a biometric sensor might provide a platform from which contactless spending limits (typically in the £30 range today) could be increased.

Today, biometric sensor integration into smart card is considered high-end and high-cost, and in addition to this, MasterCard’s biometric cards have to have the biometric information authenticated in a local bank branch that accepts the program. The applications and security can be argued to be worth the costs, and as more projects come to fruition, the cost will undoubtedly decrease. However, there is still room for concern over the access to biometric information since it is stored on the payment card, and also because the finger sensor may not always work (i.e., if the finger is oily or wet), but that is why the card retains its digit PIN code as a backup.

Biometric Authentication Is Not Enough—It Needs to Be Paired with Additional Value and Convenience

COMMENTARY


With hacking becoming more and more prevalent and at times reaching corporate and nationwide levels, securing information is paramount. There may be concern on the part of the user of the smart card that their biometric data is not secure, and suppliers will need to be able to reassure users and ensure that the biometric data is indeed secure.

The risk of this happening is not high, and as a security measure, biometrics are very functional and can be the next step to securing the smart card market. In addition, consumer familiarity with biometric authentication is constantly improving, as it is commonly used as a secure method to unlock a smartphone or to authenticate a mobile payment. In a way, the incorporation of biometric sensors and use cases on handsets has created the trust and familiarity platform from which sensor integration can begin to be included into other devices and things. Companies are already producing and researching more efficient and viable methods of integrating biometrics into smart cards; these companies include OT-Morpho, Cubic, MasterCard, Kona I, IDEX, Gemalto, and FPC. This is by no means a complete list of all contributors, but they are among the companies piloting and showcasing various ways in which biometrics complement the many facets of smart card uses.

It is also likely that in the next 5 to 10 years there will be more inclusion of biometric security in various fields, such as transport ticketing, multipurpose cards, as well as cards that can be used for identification, access, and payments all in one. A good example would be the biometric card currently in use at the Groupe Partouche chain of casinos located on the French Riviera. In the casino chain, the biometric cards are used for access control and for authenticating payments.

While current developments in biometric payment cards are focused on the contact only interface, a biometric contactless payment card would prove the natural next step to add simplicity and convenience for the user. The extra layer of security is a necessity and biometrics fits the bill—secure, convenient, and fast, in order to stay one step ahead of the security curve. However, ABI Research believes that mass adoption of biometric cards will not take place until security is paired with added value for the issuer and convenience for the user. It needs to be a platform from which issuers can extend card life (typically three years), increase contactless spend limits, or combine with a display function to add an additional layer of security to authenticate the generation of a new dynamic card verification value (CVV) to help address the growing instances of card not present (CNP) fraud. 

Services

Companies Mentioned