Article

Is the palm reader in the ATM industry's future?

Chip-based palm biometrics are shaping up as the next gen of strong authentication.

May 8, 2012 by Suzanne Cluckey — Owner, Suzanne Cluckey Communications

Americans as a group have for years rejected biometric ID for one reason or another: too slow, too unreliable, too complicated, too Big Brother.

But it's just possible that the latest advances in biometric technology will get the U.S. thinking of biometric ID not as the stuff of sinister sci-fi conspiracy, but as a day-to-day convenience — not as intrusion, but as protection.

Other countries have found this to be true. At ATMs in Japan, fingerprint and palm vein biometrics are widely accepted as a standard for strong authentication. Last month, Ogaki Kyoritsu Bank, a regional FI, said that in late September it will begin to install biometric palm-scanning ATMs using technology from Fujitsu. A report from AFP said the move responded to an increase in demand after last year's earthquake and tsunami for technology that did not require a passbook or ATM card for access to cash.

In Brazil, Banco Bradesco, a banking giant with $411 billion in assets and access to a nationwide network of around 50,000 owned and associated ATMs, uses palm-vein biometrics for user identification.

In the case of a giant entity like Bradesco, a system such as palm vein authentication begins to make sense from a purely practical viewpoint, said Bob Tramontano, vice president of marketing at NCR. "Some of these countries have larger infrastructures, so put it in context that one of the largest banks in the U.S. has just under 20,000 ATMs out there. When you look at Brazil, their top four banks have between 30,000 and 40,000 ATMs. So it's very large populations and the infrastructure is more challenged so people are adding more security, whether it be in the safe or whether it be in authentication methods."

In Bradesco's case, the biometric data are stored on the bank's server. "They are using server matching," said Christer Bergman, VP of biometric solutions at Fujitsu Frontech North America. "That means they transport part of the template or the biometric information back to the server and that's where they do the matching."

A closed-loop system such as this has obvious limitations, said Bergman. Storing the data locally means that it can be used for authentication purposes only at that institution. Any other institution or merchant that wanted to use palm vein ID to secure transactions or purchases would have to create its own database. And as the number of servers with stored customer information increased, so too would the probability of a successful data hack.

An additional inconvenience to the customer is that data matching tends to be slower when biometric information is stored on a central server. "If that information is traveling all the way back to the server, it takes a longer time because it's more data than just a four-digit pin," said Bergman. In an industry that measures time in fractions of seconds, and prides itself on transaction times under half a minute, such delay is not well tolerated.

A solution that Fujitsu and other companies are working on, Bergman said, was to do the matching closer to the card user, i.e., on the card itself.

"And that's how the smart card and the chip card is coming up big in the parts of the world where it comes to a stronger authentication at the terminal," Bergman said. "[T]he matching is done locally on that card, so from the biometrics point of view ... your biometric template is sitting on that card."

This means that the biometric data no longer needs to travel to a central secured server for matching. The user simply inserts the chip card into the ATM, enters a pin, and places his or her palm over the reader, which matches the palm being scanned to the data on the chip. It's a much quicker process.

It's also a much more flexible process. When the data resides on the card, it can be used anywhere a pin reader or palm scanner is installed. There is no need to create a separate database for each application.

Biometric match on card also meets a major requirement of EMV implementation by the major card brands, which insist on a chip system that can be used on any payment network.

Bergman said that palm scanning has additional benefits as well. For starters, the user's palm never touches the scanner, so it's more hygienic than a fingerprint scanner.

Then there's reliability. "In the early days they may have been in the range of a five to ten percent reject rate, but nowdays some people will clock in the one-in-one-million type of failures," said Tramontano. "It's really about how specific you want to be depending on the platform."

There's also the consumer comfort factor. Tramontano points out that for many, the drawback with fingerprint technology is, well, the fingerprint. "In the U.S., the only time you tend to give your fingerprints is when a bad situation is going to happen," he said. There's no such stigma attached to the palm print.

Finally, there's cost. Palm scanners are more expensive than fingerprint readers, but not prohibitively so. "In the whole scheme [of the ATM transaction], it's not significant," Bergman said.

According to Bergman, countries in Europe, including Germany and the U.K., are now considering the addition of palm biometrics as an authenticator. He expects that the U.S. will eventually follow suit. Not overnight, definitely, but in the gradual way that all ATM technology seems to reach critical mass in America.

I think biometrics is going to be down the road … but I don't think the U.S. is in a rush to get there," Tramontano said.

For more on this topic, visit our security research center.

About Suzanne Cluckey

Suzanne’s editorial career has spanned three decades and encompassed all B2B and B2C communications formats. Her award-winning work has appeared in trade and consumer media in the United States and internationally.