Biometrics at the Crossroads

When you think of biometrics-using a person's unique, physical characteristics for identification-it's hard not to conjure images from spy thrillers and science fiction. And fiction is still the operative word, despite years of optimistic promises by bank technologists and futurists.
Not because the technology isn't available-financial institutions have been testing various biometric systems on customers and employees in branches, at ATMs and even over the phone since at least 1995. Rather, the sluggish pace of acceptance stems from a combination of problems: reliability, cost and customer resistance. Faced with those issues, it's not surprising that banker reaction to biometrics quickly turns from "Gee whiz!" to "So what?"But, at the risk of sounding like the "Boy Who Cried Wolf," this time biometrics may at last take hold in banking. Today's biometric technology-whether fingerprint and iris scanning, or voice and face recognition-works far better and costs far less than ever before. Its biggest benefits are security (it's tough to steal or counterfeit an eye) and convenience (no more passwords to remember).A handful of financial companies are using biometrics to recognize customers at ATMs, allow people to cash checks at kiosks, authenticate the identity of corporate customers requesting wire transfers and give bank employees access to their computers without passwords. The major credit card associations are working on biometric applications to reduce fraud. And many developers are looking to biometrics to make purchasing and transferring data over the Internet more secure.According to International Biometric Group, a New York-based technology integration and consulting firm, biometric verification systems generated revenues of just $58.4 million last year. The firm projects the industry's revenues to zoom to $594 million by 2003. (That covers hardware and software, but not integration, consulting or bundled application costs. Neither does it include the far more expensive automatic fingerprint identification systems used primarily by law enforcement and other government agencies.)What the nascent industry has long needed, many experts believe, is a catalyst to generate real excitement among potential buyers, from ordinary consumers to the big corporate information systems chiefs. That trigger event may have happened in early May. Microsoft Corp. announced that it was throwing its considerable weight behind biometrics by purchasing authentication technology from I/O Software Inc. to incorporate into future versions of its Windows operating system. The Riverside, CA-based biometric software developer already sells programs that are compatible with Windows, but by integrating with Windows, it could become ubiquitous very quickly. I/O's technology works on any biometric data: fingerprint, hand and face geometry, iris and retina scans and vocal patterns.To some extent, the deal could also set a de facto industry standard, something that jolted the tiny biometrics world. "The Microsoft announcement gives every consumer the ability to have a device" that can recognize the user without a password, says Bob Clay, director of development at IBG. "In the next two years, every desktop computer will be able to use biometrics for access."Clay believes that finger scanners will be one of the most widespread formats on both home and office computers. According to IBG, they already garner more of the industry's revenue (34%) than any other biometric technology. (See the chart.) The reason: cost and convenience. Finger-scan readers don't take up much room-they're smaller than the typical touch-pad on a notebook computer-and the price has dropped to between $100 and $150, some even less. Just two years ago, peripheral finger-scan units cost as much as $300.But they do have drawbacks, particularly in accuracy. A blister on the finger, sweaty hands or dirt on the scanner can all interfere with a device's ability to read a fingerprint. Nor do they work well in high-traffic environments, such as ATMs, which sometimes handle thousands of users a day. ATM manufacturer Diebold Inc. experimented with fingerprint scans three or four years ago but dropped the idea. "While the verification they provided is good, there's a maintenance issue," says Mark Radke, global marketing manager. "Person after person putting their finger on the same spot created a real problem for the scanner."Yet Diebold hasn't given up on biometrics-far from it. The Cleveland company has two programs with software developers underway, one using iris-scanning technology and the other face-recognition, and is trawling for other deals.A year ago, Bank United, a $17 billion institution based in Houston, installed Diebold's iris-scanning ATMs, with software from Sensar Inc. of Moorestown, NJ, which licenses technology from IriScan of Marlton, NJ. The ATMs were the big hit of last winter's Bank Administration Institute Retail Delivery Systems trade show (see Technology, Feb. 2000), and in early May it won the "Most Innovative Use of Technology" award at Faulkner & Gray's Card Tech/Secure Tech conference. Even though Bank United confined its test to three of 154 ATM locations-in supermarkets in Dallas, Houston and Ft. Worth-the bank is very happy with the results. Customers have a choice of looking into a camera and letting the technology match the image of their eye to identify them in the bank's database, or using old-fashioned personal identification numbers (PINs).According to spokesman Vern Stockton, more than 80% of the customers who could use the iris scanner have done so, and, in a survey, well over 95% of them said they were satisfied with the service. Indeed, the bank has drawn a lot of new customers who've opened accounts just to use the new ATMs, he says.Yet, Bank United hasn't decided whether to introduce the ATMs in other places. For one thing, it's expensive-the initial cost was $5,000 a copy for the software on top of the $25,000 to $30,000 price of the ATM. "We expect to have a decision by late summer," Stockton says. "The roll-out will also depend on the availability of the technology."Diebold's foray into building ATMs that recognize a customer's face is far more significant. At the end of last year, it formed a strategic alliance with InnoVentry Corp., a San Francisco-based developer of an advanced automated check-cashing machine, to put the new machines into 1,500 retail stores nationwide and to look for new markets together.Jointly owned by Wells Fargo & Co. and Cash America International Inc., InnoVentry describes its market as the "self-banked-the 37-plus million adults in the U.S. who do not have bank or checking accounts, or maintain only nominal balances in the accounts they do hold." According to spokeswoman Alexa Hanes, its machines, placed in supermarkets and convenience stores, are designed to provide an easy-to-use, convenient alternative to retail check-cashing outlets. Last July, the company bought 500 biometric-reading ATMs from Diebold, and so far has deployed 220 of them in Phoenix, Dallas and Houston. It was scheduled to move into Florida in May, and plans to have the machines in up to 11 markets by the end of the year. Its roll-out has been slowed only by the different regulations for check-cashers in each state, Hanes says.These machines use facial recognition technology licensed from Visionics Corp. in Jersey City, NJ, to identify users. Because the technique involves measurements of fixed features, such as the distance between a person's eyes, it works even if the customer grows a beard or wears colored contact lenses. Hanes says the company believes it has the largest biometric database of customers in the nation, with more than 400,000 people enrolled. The fees, considerably less than what the average check-cashing store charges: 1.75% for government and tax checks, 3% for payroll checks and 5% for personal checks."We've found we have quite a few users that do have bank accounts, but use the machines to cash checks because of the convenience factor," Hanes says. The machines also act as ATMs, using traditional debit cards, for bank customers who need cash.As with the Sensar iris scanner, customers don't have to get closer than about two feet from the camera, and the two technologies cost about the same. According to Hanes, InnoVentry tested iris scanners with consumers, but those required users to put their eyes very close to the machine, something off-putting for most people. It also rejected finger-scans because of their associations with law enforcement.Radke, the Diebold marketer, acknowledges that financial institutions don't tend to rush into new technologies. Still, he says, in the next year or two, biometric devices on ATMs will proliferate.As the Microsoft-I/O Software announcement suggests, they're also likely to proliferate in offices, and perhaps even at home and on mobile computers and telecommunications equipment. Chase Manhattan Corp., for one, is piloting a finger scan system for employees, in which about 200 bankers use a desktop device attached to their PCs to log in to the company's system. Such technology will eventually spread far beyond the financial industry. For instance, Sensar has developed a desktop product that can act both as an iris scanner and as a video-conferencing camera. The company is targeting what Robert Van Naarden, vice president of marketing, sales and customer service, calls "enterprise employees"-companies in any industry in which information security demands that everyone use a password (often changed once a month) to gain access to their computers. High-volume buyers can get the system for less than $100. "A couple of years ago, it couldn't have been done at all."The same goes for facial recognition. According to IBG, "The drop in price of peripheral cameras, to as low as $50 to $75, has brought facial scan into the range of home use for network log-in (although facial scan vendors would prefer to enter the more lucrative corporate IT market)." Such cameras have begun to pop up on portable computers.That would mean tremendous benefits in security for electronic commerce, since one of the thorniest issues is how to verify the identity of the people on each side of a transaction. As it gets easier to connect to the Web through portable devices such as personal digital assistants and digital mobile phones, security and user identification are emerging as bigger problems than they were when users could only get access from their office or home computers.That's one reason why Phil Hester, chief technology officer of the IBM Personal Systems Group, believes that, in the long run, biometric readers are more likely to be built into mobile devices than desktop computers. As pocket-sized computers and digital phones get more sophisticated, he says, their owners are "likely to have a significant amount of both business and personal information on them." And these things are easy to steal, unlike desktop PCs, which are often safely locked in an office.But Hester is skeptical that biometrics are poised to break through into the mainstream any time soon, especially for consumers. To gain acceptance, he says, biometric technology "has to come at a price where it's almost free to build it in. For people to use it, you have to make it standard on the product." Standards also need to develop so that customer data stored in the company's old databases can be tied into the new devices. Hester likens Microsoft's adoption of I/O's software to "a stake in the ground that the industry can evolve around."In his view, the accuracy of the more affordable biometric systems needs to improve. "The process by which the thing learns to recognize or reject needs to get much better. It's now 95% or more, but it needs to approach 100%," he says. False rejections are particularly nettlesome. "People's frustration with technology locking them out really causes them to blow a fuse."All of these factors combined make biometrics something the technologists and futurists seem to love a lot more than the people who are expected to buy or use the technology. "People aren't sure there's a need for it," Hester says. "I just don't see the adoption curve that the Internet had."