MasterCard's Biometrics Push Gets Serious

MasterCard is testing whether the time is finally right for biometric authentication to take over as the standard of customer-facing security.

In an upcoming pilot, the card network and First Tech Federal Credit Union in California will allow consumers to authenticate and verify transactions using touch, voice and facial recognition. In a separate security play, MasterCard plans to formally release a network-level security product and is investing $20 million in new cyber security tools.

Biometric authentication has been an admired security technology for years, but has generally been considered unproven as a true replacement for passwords. But MasterCard predicts that biometric authentication could finally have its moment.

"There's been advancement in the technology behind biometrics that makes this a good time," said Carolyn Balfany, MasterCard's senior vice president of product delivery, focused on EMV and security.

MasterCard has run a number of tests of biometric technology in recent years, and has also been developing biometric technology with partners. Additionally, MasterCard supports Apple Pay, which uses Touch ID, a form of fingerprint authentication.

"The tech has been performing better," Balfany said of MasterCard's experience in other tests.

The details of the credit union pilot are still in the works, though facial recognition usually includes the use of a camera to vet a person's appearance against a stored image, and voice recognition is used to vet mobile app users or to gain entry into a facility.

In payments, biometric identifiers are typically used to authenticate cardholders and their devices. Most financial institutions that use biometrics have stuck to fingerprints, and have not adopted voice or facial recognition technology for authentication, though Barclays has deployed voice authentication in call centers for wealth management clients. 

In Europe, Validsoft is marketing voice biometrics to payment companies. Other companies are developing alternatives to biometrics, believing biometric authentication to be intrusive.

MasterCard is hedging its bet on user adoption given the credit union's profile. First Tech is a $7.35 billion-asset institution headquartered in Mountain View, Calif., and its members include staff at Silicon Valley companies such as CISCO, Amazon, Agilent, Microsoft, HP, Intuit and Google—so it's likely the members would be familiar with biometrics.

"We've been talking about biometrics for a long time, but I think we're at the tipping point of adoption, spurred both by the advancement of the various biometric technologies, combined with the fact that we finally have a set of endpoints such as mobile devices that can easily facilitate the authentication without requiring any special hardware," said Julie Conroy, a research director at Aite Group. "From Touch ID, to USAA's announcement a couple weeks ago…to this MasterCard announcement, we will continue to see biometrics provided as an alternative to consumers as financial services organizations look to bolster security while keeping the user experience as friction-free as possible."

MasterCard's play comes as Apple's Touch ID places the branded networks and banks at risk of losing control of identity management, said Tim Sloane, vice president of payments innovation at Mercator Advisory Group.

"If every app implements its own set of biometric techniques, then software bloat and consumer inconvenience will certainly be the outcome," Sloane said.

MasterCard is also moving on other security fronts. It announced a new investment of $20 million for internet security development and said it plans to launch MasterCard SafetyNet in the U.S. this spring. SafetyNet uses MasterCard's network to identify attacks, in some cases before an issuer is aware. The product can block specific transactions based on selected criteria.

Safety Net will be deployed in April to protect ATMs, and will later expand to other channels.

"Each bank has a layer, and we have a layer of security," Balfany said, adding MasterCard will charge issuers for the technology. "If the bank's layer gets taken out then SafetyNet starts acting. It's a second line of defense."