Biometric Security Could Finally Thrive as Mobile Commerce Grows

Apple Pay's Touch ID is the exception, not the rule. Biometric security typically requires some type of add-on hardware, a model that has struggled to get much adoption over the years.

But these devices might get a fresh chance, as the spread of mobile commerce is creating a growing issue with the practice of sending one-time passwords to users' phones.

For e-commerce, “we used our devices to represent a second factor of authentication … but with the growth of m-commerce, we're using that second factor to transact, which means it's no longer a second factor. We're now missing a device," said George Avetisov, co-founder and CEO of Hypr-3.

Hypr-3 brings fingerprint authentication through the use of a sticker that can be adhered to a consumer's mobile device. The company, based in New York, is not alone in its efforts with biometrics. Other companies are testing new ways to bring biometrics to the market, such as by embedding the technology in a plastic payment card.

For example, MasterCard partnered with Zwipe to launch a contactless card with a built in fingerprint reader in the U.K. this year.

But biometrically-enabled cards are likely to run into the same hurdles as programmable cards such as Dynamics ePlate, Coin and Stratos Card. Though each product has generated consumer interest, they typically have a high price tag for the end user.

Which is why Hypr-3 is steering its product to third parties and banks. The white-label model, which is meant for apps like Bitcoin wallets that consumers use frequently, will roll out in mid-summer, Avetisov said. Hypr-3 has already taken pre-orders for this model.

The closed-loop enterprise solution, which will be targeted at banks and trading platforms, won't roll out for some time, Avetisov said.

The consumer version of Hypr-3 will roll out in May.

In the next few years, banks will start deploying some form of biometric hardware to everyday consumers, said Phillip McGriskin, managing director at WorldPay Futures during an Apple Pay panel discussion in London last week.

Banks already deploy cryptographic hardware tokens to their high-net-worth customers,  Avetisov said. Financial institutions such as Bank of America, Citibank and JPMorgan Chase, give business clients hardware tokens which are usually keychain fobs that present a random number every minute to be input during login.

Banks in Switzerland have deployed biometric USB's to their high net worth clients.

If banks in the U.K. aren't actively piloting biometric authentication, they're definitely looking for solutions, said Edward Maine, marketing and communications manager at ValidSoft, a voice biometrics provider based in London.

And while Dave Birch, director of Consult Hyperion, says stickers are more an inexpensive means to the end where NFC and biometrics is housed on the device, during an interview he used a Barclaycard contactless sticker to pay for coffee.

Hypr-3's upcoming consumer adhesive which operates over low-energy Bluetooth with a mobile app called HyprKey, costs $20 and has more than a year of battery life. Hypr-3 has gotten the majority of its consumer pre-orders from the Bitcoin community, which has traditionally been keen on purchasing additional security hardware.

Hypr-3 is also attracting merchants and consumers in the cryptocurrency community with its back-end features, such as allowing consumers to pay with Bitcoin without having a store of the digital currency.

At the point of sale, HyprKey can be used to pay by either scanning a QR code or tapping a mobile device to an NFC-equipped card terminal. The consumer then swipes a finger over the biometric sticker to release a token that moves to the cloud to be authenticated.

If the merchant accepts Bitcoin, Hypr-3 can use the consumer's linked credit or debit card to purchase bitcoin for the transaction. On the consumer's device, the card used to fund the payment will appear with a message that the transaction has been processed.

“Consumers aren't even aware that they're purchasing with Bitcoin,” Avetisov said, but by using the digital currency consumers could receive discounts merchants offer to encourage Bitcoin use. Because Bitcoin is a decentralized distributed network, there aren't interchange fees and there is no method for chargebacks.

Hypr-3 will institute an exchange fee to consumers. But the company's main source of revenue will be through application programming interfaces (APIs), said Avetisov. Hypr-3 will monetize the fingerprint swipes from an issuer and app perspective, he said. 

Linking Bitcoin to cards has been a challenge for many Bitcoin-focused companies.

A Bitcoin debit card was rumored as far back as 2012, when former BitInstant CEO, Charlie Shrem, announced plans to work with MasterCard on the project. Since then, several Bitcoin startups, including Xapo, Coinkite and Shift Payments have tested products.

Many of these card products have yet to catch hold, for one because of the difficulty in getting card issuers to partner with Bitcoin companies, especially in the U.S.

Additionally, biometric authentication hasn't always mixed well with Bitcoin. Bitcoin ATM provider RoboCoin required the use of a biometric palm vein scanner when its machines debuted in 2013 but the company has since eliminated the requirement because it slowed down use of its hardware.