Apple's Touch ID Takes On Remittance's Risks

Efforts to apply biometric security to payments have reached the fraud-prone remittance market, as Touch ID takes hold for both incumbents such as Western Union and upstarts such as Xoom.

Xoom has incorporated Apple's Touch ID into its mobile app, giving consumers the option of using their fingerprint data to use Xoom on the iPhone 5s, iPhone 6 and iPhone 6 Plus. Touch ID is built into the Home button of all three devices. Western Union's approach instead relies on Apple Pay's Near Field Communication capability — supported only by the iPhone 6 models — for contactless transactions initiated in stores.

Cross-border transfers carry myriad risks. And Xoom itself has already been exploited for fraud; the company reported last month that its systems were used for $30.8 million in fraudulent transfers.

The most common security risks for remittance are account takeovers, in which an attacker gains hold of the credentials for a customer's account. There's also friendly fraud, in which a user (or someone close to that user) transfers funds and then submits a bogus fraud report.

"Biometrics can fight both of these types of fraud, because they identify the user as someone they are, and is paired with the mobile device," said Joe Raymond, Xoom's vice president of product.

As part of its existing security protocol, Xoom requires passwords that are at least eight characters long, and requires a password for each login. With Touch ID, this requirement can be eased. "Apple has made onboarding easier, and the iPhone is always with you," he said.

Western Union's strategy is about flexibility. Apple Pay still has several restrictions; for example, it can be used only with a bank account as a funding mechanism. Western Union is looking at options for supporting mobile payments from other funding sources. 

"I think the key words here [with Xoom and Western Union] are that they are providing this as an additional option, rather than requiring its use versus alternative mechanisms," said Julie Conroy, a research director at Aite Group. "We are seeing many companies trying to make authentication an easier process for consumers, enabling them to choose the form factor with which they are most comfortable. This is one way companies are balancing the customer experience with the need to have stepped-up authentication to protect themselves and their customers."

Xoom does not presently support biometric for non-Apple devices (Samsung's Galaxy S5, for example, also has a fingerprint reader), though it plans to support more handsets in the future, Raymond said. Xoom is also considering other biometric authentication options such as voice and facial recognition.

Touch ID and similar systems are catching on with several mobile payment companies, including Alipay, Square and PayPal's Venmo.