Biometrics & Cards: The Ultimate ID?

Chip cards and biometric technology have been developing in tandem but have yet to converge.

The financial services potential of smart cards with physical identification characteristics stored in their chips - perhaps fingerprints, voice prints, or eye scans - seems self-evident, an advance over passwords and personal identification numbers ideal for the coming century.

But industry experts say it could be another year before chips and biometrics merge on plastic, and they see the health care industry using them first.

Biometric Tracking of Kansas City, Mo., has been working on a project to link an association of 51 East Coast hospitals via the Internet. A biometric template beside the PC takes the place of a PIN pad for ensuring secure access to data bases. Eventually, hospitals will issue smart cards containing patient demographics such as medical histories, doctor information, blood types, allergies, and test results.

Another fingerprint company, National Registry Inc. of Tampa, has two Florida hospitals and the Kaiser Permanente health maintenance organization in Pasadena, Calif., in pilot tests.

"Health care organizations tend to be early adopters of new technology," said Greg Jensen, technical manager of the health care division at National Registry. "The technology on the information side of health care is changing extremely rapidly. They're going to Web technology for internal records. There has been a complete shift in their business practice that is not occurring in financial services."

They have to put a high priority on network security and confidentiality, and biometrics fulfill the need.

The financial industry may be slower to come around because of the large numbers of biometric scanners, which are still relatively costly, that would have to be deployed at points of transaction, said Michael Stock, founder and managing member of Biometric Tracking. "The two won't be implemented within a short period of time until the customer demands it.

"In the banking industry, everyone will tolerate a certain degree of losses, but in health care everyone demands security."

Given their closer connections to the health care market, insurance companies are also closing in on biometrics and smart cards, Mr. Stock said.

"Through use of these technologies, insurance companies could reduce their overhead expenditures, provide a better service to physicians, and negotiate lower rates for doctors by providing shorter processing times for legitimate claims and eliminating third-party processors," he explained. All the confidential client information would be contained on a smart card and verified by a biometric.

Similar to college campuses' early move to smart cards, "You'll see closed systems take off because there's a smaller number of people and they're easier to control," said Larry Graves, product manager in Verifone Inc.'s global marketing group. "Essentially biometrics will go big as soon as there's someone standing at the door with a bag of gold saying, 'I want it.' The bigger the bag of gold, the faster it will fly!"

Verifone, with an eye toward combining the technologies, recently organized a "BioDay" and had eight vendors describing their products. Though open to iris recognition, hand geometry, and voice systems, Verifone leans toward fingerprint scanning. For the past 18 months it has been working with Identix of Alexandria, Va., to deploy fingerprint devices at some Chase Manhattan branches in New York. Test customers swipe their magnetic stripe cards and place a finger on a glass window. Reaction has been positive and the pilot is continuing.

Elsewhere, the Bank of Central Asia in Indonesia has replaced teller passwords with Identix finger scanners.

"In five years, biometrics will be fairly common and most large rollouts will use fingerprint ID," Mr. Graves predicted. "We find fingerprint scanning to be the least intrusive, the most widespread and understood method" - not to mention most economical.

"The huge problem for everyone is the logistics of enrollment," he said. But smart cards could overcome public resistance to the "Big Brother" aspect because fingerprints will be stored in the portable chips, not in central data files.

Banks have an incentive to move to biometrics "to reduce paper handling expenses and fraud losses," Mr. Graves added.

Oracle Corp. is one influential company to watch in this area. It joined an Open Card Framework consortium in March, led by MCI Communications Corp., with other partners including Sun Microsystems, IBM, and Netscape.

"We will evolve an open framework for smart cards in a network computing environment," said Paul Lambert, director of security products at Oracle. "There are a lot of intriguing things going on, but neither smart cards nor biometrics have been well adopted in the U.S."

Meanwhile, at the end of February, Oracle introduced a fingerprint identification device by Identix - a "Biometric Adapter" for access to Oracle data base systems.

"It's not embedded into the keyboard or mouse yet, but this is the direction the industry is going," said Wynn White, director of middleware products for Oracle. "There is a lot of interest in biometrics and this is the ultimate in user identification."

Ten states have introduced fingerprints as a driver's license requirement. The Connecticut Department of Social Services has added fingerprints to its cards for benefit recipients, and the Ohio State Department of Social Services is this month rolling out a smart card for food stamps and the WIC nutrition program. "We're looking at biometrics for a later stage, as we believe it is something people would like to see," said David Schwartz, project manager of the Ohio electronic benefits transfer card.

"The biggest problem is that the infrastructure has to change, particularly in banking," said Edward Murrer, vice president of sales and marketing at Identix.

"VeriFone could create the infrastructure to migrate from mag stripe to chip and to include biometrics with chip," he said. "For limited applications, say for 20 different locations, it's not impossible to change the infrastructure. However on the retail side, it's a bigger deal and needs to be supported."

MasterCard International has been demonstrating biometrics at the reception desk at its Purchase, N.Y., headquarters. Limited to staff and visitor access, the system over the past eight months has recorded 6,100 visitors and 13,000 "transactions."

"The Cardholder Verification Method matches the finger minutiae with a particular individual and eventually to the chip platform on which it depends," said Joel Lisker, senior vice president of security and fraud prevention. "Our first stage was to have a data base but now we have migrated to a match mode," Mr. Lisker said, referring to the storage method. "The second stage is for the Direct Finger Reader to record the cardholder's fingerprint on a chip."

About 50 bytes of data in the chip, representing a fingerprint, would be compared at the point of sale, or in MasterCard's case at its welcome desk, to the finger itself.

MasterCard tested the reaction of 1,000 consumers to several forms of biometrics - fingerprint, signature, facial, hand, eye - and found, as had the Association for Payment Clearing Services in Britain, that fingerprints rate as good if not better than PINs.

Mr. Lisker sees "a natural complementarity of chip and biometrics" as way to both identify the cardholder and enhance business on the card.

Advocates of other biometrics are considering smart card interfaces. Total Recognition Systems in Alexandria, Va., said it expects to beta-test its infrared facial scanning technology with smart cards in September.

Veritel Corp., a Chicago-based specialist in voice recognition, plans to work with card vendors to put speech algorithms in "a voice template on a chip," said Christopher Tomes, founder and president of Veritel.

"We believe the voice will dominate" because of the ubiquity of telephones, said Mr. Tomes. "User acceptance is always a problem but the most nonintrusive device is one that asks someone to say their name."

And arguing the case of hand geometry is Bill Spence, vice president of sales and marketing at Silicon Valley-based Recognition Systems. Its devices controlled access at Olympic sites in Atlanta last year and have made inroads in emerging markets.

"There is not a lot of existing infrastructure in these other countries, so as they move forward . . . they are leapfrogging into new technologies," Mr. Spence said. "The key to our success is that we have designed a system that is easy to use and allows people access and authorizes them to move from private to public environments." u

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER