Article
ATM security in Asia moves to veins
Vein-pattern recognition finds success at ATMs in Japan.
Last year, Frost & Sullivan recognized Fujitsu for its so-called "revolutionary" approach to biometric-product technology. The product: Fujitsu's palm-vein-authentication device, PalmSecure.
PalmSecure picked up kudos from Frost & Sullivan for its high level of security and consistency, as well as its ease-of-use and its contactless process.
In January, Fujitsu demonstrated new PalmSecure products at the Consumer Electronics Show in Las Vegas, displaying what some industry experts say could lead to greater acceptance in the United States of biometric-security options.
VPR, or vein-pattern recognition, for financial-transaction verification is still relatively new, says Victor Lee, a consultant with New York-based International Biometrics Group. In 2007, VPR only accounted for 3 percent of the biometric market, even though Fujitsu developed its VPR technology in 2004.
| |||||
 | ATM & Financial Self-Service Classifieds Buy or sell anything related to ATM's and Financial Self-Service. Place your ad for as little as $50 per month. | ||||
"Vein-pattern-recognition adoption is increasing, and it is the most state-of-the art authentication technology today," Lee said.
Evidence of some acceptance of biometrics-security technology in the financial space is already evident. Last year, Shinkin Central Bank in New York installed a biometric access-control system designed by Hitachi that uses vascular biometrics, technology similar to the VPR product designed by Fujitsu.
Security prevails
Escalated concerns about fraud, identify theft and security leaks have prompted consumers throughout the world to pay closer attention to how their money is being managed and protected, and the United States is no exception.
Chuck Wilson, deputy general manager of Allen, Texas-based Hitachi Security Solutions, says, as fraud concerns escalate, North American financial institutions will search out more reliable security methods.
He points to Japan, which was quick to adopt and enforce the use of biometrics-security products to authenticate financial transactions, as an example. North America will likely follow the same route, he says. Japan was just ahead of the curve.
In the early 2000s, Japan's financial industry saw high rates of ATM-related fraud, namely fraudulent ATM withdrawals and other scams related to cloned cards.
"At that time, there was no withdrawal limit and banks didn't guarantee losses due to theft," Wilson said. "Customers were held responsible for securing their PINs. By 2005, funds stolen (totaled) over (U.S.) $8 million."
Japan's growing fraud soon grabbed media attention, Wilson said, and the financial industry was caught with egg on its face, because they made consumers vulnerable and they weren't offering any protections.
According to Fujitsu, based on data from 140,000 palms, the VPR system has a false-acceptance rate of less than 0.00008%, and a false rejection rate of 0.01%. The VPR can authentic users from:
The data also is not adversely impacted by lifestyle, providing accurate information for users after drinking alcohol, taking baths, going outside, and waking up. |
After the government, in February 2006, shifted ATM-loss liability to the banks, Japanese FIs quickly searched for security alternatives, and biometrics seemed like the most viable solution.
Fujitsu's palm-vein technology in 2004 and 2005 was adopted in Japan by Suruga Bank, the Bank of Tokyo-Mitsubishi, Hiroshima Bank and the Bank of Ikeda.
"Palm-vein-pattern recognition has a .00008 percent false-acceptance rate, and has been extremely successful in Japan," said Gerald Byrnes, manager of biometrics for Fujitsu in Sunnyvale, Calif.
Today, more than 92 percent of Japan's banks use vein-pattern recognition, Wilson said. And "adoption by the Japanese banks resulted in sharply reduced fraud."
But adoption in North America, especially the United States, could take longer than companies like Fujitsu would like.
Movement has been made in other parts of the Americas, such as South America. Banco Bradesco, Brazil's largest private bank, this year is incorporating palm-vein technology into its ATM. The bank tested the solution in 2006.
North America, however, could be a different story. And recent events support that theory.
Just last week, U.S. biometrics-tech leader in the financial space, Pay By Touch, starting auctioning off pieces of its business, after declaring bankruptcy. Pay By Touch sold its BioPay Paycheck Secure business to a Phoenix-based management group for $4.2 million. Pay By Touch paid $82 million for the business in 2006 when it acquired it from BioPay.
The finger is the rub
What's held biometrics use back in North America, as well as other markets such as the United Kingdom, is that most solutions have relied on finger-print readers. One need only look to the miserable failure experienced by Pay By Touch to see that, at least in the States, a "touch" doesn't go over well.
Simply put, many U.S. consumers don't like to give out their fingerprints, say experts like Byrnes, Wilson and Lee, for a number of reasons — none of which have been definitively pinpointed by any scientific facts. The assumption is that U.S. and U.K. consumers associate fingerprints with government control, and they want no part of it.
Another consideration: Fingerprints can sometimes be difficult to read, and they also pose their own vulnerabilities to security breaches.
Other issues with fingerprints also come into the biometrics debate.
For one, fingerprints are more difficult to obtain from people of Asian descent because of less-defined ridges in Asian hands, especially women. Additionally, between 2 percent and 5 percent of the general population has some physical limitation that hinders fingerprint imaging. Doctors who wash their hands frequently; hair dressers who work with chemicals; and others who work in trades that require frequent hand-washing can have fingerprint erosion, Wilson says.
Fingertips also become dirty, oily or cut, and dirt and oil tend to obscure finger images. Fingerprints can be lifted and copied, and industry concerns about the ability to read prints from a dead, severed hand still plague the technology.
VPR is different, Wilson said. And because of its high rates of authentication, more U.S. FIs will be open to using it.
"There is great security this kind of authentication, called triple-factor security, because it uses a PIN (something you know), a smart card (a physical token; something you have) and a biometric (something you are) are at the same time," Wilson said.
VPR compares vein patterns in the palm to individual-user patterns saved in a database, on a smart card, etc. Because the patterns exist inside the body, they cannot be stolen or copied.
The patterns are read and photographed via the reflection of infrared light. Hemoglobin in the blood reflects the light.
The most interesting part about the hemoglobin is that it reflects and absorbs light differently, depending on whether it's deoxidized – meaning it's already carried oxygen to the body's tissues. Deoxidized hemoglobin absorbs the light, reducing the light's reflection rate and causing the veins to appear as a black pattern.
How it determines viability, such as is the palm alive or not, is even more interesting.
When the body cools – because of a lowered ambient temperature – blood vessels, particularly the capillaries, contract, decreasing the blood flow in the body. The slowed flow increases the hand's light transmittance, so less light is absorbed by the hemoglobin, allowing light to pass through more easily. The more light, the less heat.
The solution, because it's based on reading through infrared light, is contactless – a big seller for FIs, says Lee.
Fujitsu's solution, for instance, allows ATM users to hold the palms of their hands over a reader on the ATM. The reader emits near-infrared light – the same wave-length spectrum used in TV remote controls – and reads the vein patterns.
ATM transactions are verified by matching the VPR to patterns saved on a smart card.
Ariana-Michele Moore, an analyst with Boston-Based Celent LLC, like Lee, is intrigued by VPR. She's just not ready to say one way or the other how likely it could take off in the United States.
"(VPR) has interesting potential and is intriguing," Moore said.
But, she adds, many fear how their personal data is stored and used. And research has not determined the long-term effects of exposing a palm to near-infrared light.
