Touchless authentication for the post-COVID world
One of the minor and peculiar side effects of the pandemic was a coin shortage that hit nationally over the summer. The shortage was driven in part by fewer people in retail stores and the fact that many of those who did shop in person didn't want to touch money because they were fearful of catching the virus.
Instead of reaching for cash or even credit cards, consumers want to pay with their phones. Based on a survey of 17,000 consumers conducted in 19 countries this spring, a Mastercard study found that 79 percent of respondents are now using contactless payments, citing safety concerns. And almost as many (74 percent) said they plan to continue paying that way in a post-pandemic world.
"Perceptions of safety and convenience have spurred a preference for contactless cards and reminded consumers of the convenience of tapping on a global scale," the survey concludes. According to the study, 46 percent of respondents swapped out their top-of-wallet card to enable contactless. When it came to those under 35, the percentage reached 52 percent. A clear majority of respondents, at 82 percent, said contactless is a more hygienic and faster way to pay.
It's not just about wanting to avoid cash. More people are looking for ways to avoid having to touch keypads, credit cards, door handles, and everything in between. As it turns out, as payments increase with contactless, so does the interest in more ways to conduct touchless authentication. As far as the user is concerned, contactless biometrics work, as the name suggests, just like traditional biometrics—only without requiring contact with the biometric reader.
Big shift to contactless
Several popular touchless authentication methods are in use, including palm scans, where users hold their palm about six inches above the reader, and voice recognition and iris scans. According to KBV Research, contactless biometric revenues will grow by about 19 percent annually and reach $18.6 billion by 2026. The firm expects the sales growth will be fueled by faster and easier authentication and interest generated by COVID-19.
In March, the New York Police Department stopped using fingerprint biometrics to authenticate access to its headquarters, and governments, including India, also heavily restricted the use of touch biometrics. This summer, Pasadena, California-based PopID, a provider of facial recognition payments, was deployed at about 25 retailers and quick-serve restaurants, including CaliBurger. The system works at kiosks and display screens at checkout and enables scans by wait staff using Android mobile devices. The company also offers a similar service for building access.
Of course, there are barriers to the adoption of touchless biometrics. Many of those barriers are similar to the obstacles to adopting touch biometrics: cost, accuracy, standards, and privacy concerns. The National Institute of Standards and Technology has studied contactless fingerprint biometric technologies for several years now. This spring, NIST released an interoperability assessment that evaluated the accuracy of contactless and its interoperability with traditional touch fingerprint scans.
The study found contactless fingerprint biometrics are less accurate than traditional fingerprint biometrics, which can be attributed to the way prints are captured. When a finger is pressed on a conventional reader, it creates a two-dimensional print of the finger's unique features. However, with contactless, the finger is lit and the 3D surface is captured, resulting in more deviation than with the user physically touching the biometric scanner.
While traditional fingerprint biometrics scanners are not 100 percent accurate, they can be more than 99.5 percent accurate. However, in NIST's evaluation, while contactless biometric devices were only 60 to 70 percent accurate, accuracy rose to between 90 and 95 percent when devices used multiple fingers. Another barrier is a lack of industry standards making 3D biometrics compatible with existing 2D databases
Still, the industry is moving ahead with contactless biometrics, especially in payments. And major companies are moving fast.
Amazon announced in late September that it's enabling customers who pay in-store to use its Amazon One contactless palm scanner system. The company is deploying the system at two Amazon Go stores in Seattle to start. As a choice for shoppers, Amazon will place Amazon One at entrances, and it could become a form of payment or check-in for loyalty cards. Amazon also sees eventually deploying Amazon One at stadiums and office buildings. "Amazon One could be part of an existing entry point to make accessing the location quicker and easier," the company said in a blog post.
Amazon One follows a similar move from Walmart, which earlier this year announced contactless Walmart Pay. With Walmart Pay, shoppers don't have to use a credit card or touch a screen. Instead, they can scan a QR code at the kiosk with their phone and pay within Walmart's phone app. "The way we're all living and shopping is changing. We know customers want and need to be served differently. And we're moving quickly to adapt to those changing needs. It's one way we can help to add some stability to our customers' lives," said Janey Whiteside, executive vice president and Walmart chief customer officer, in a statement.
Another example of touchless is biometric credit cards. These cards, currently being piloted, look just like chip cards except they come equipped with fingerprint readers. Card carriers can place their finger on the card and then put it in the chip reader or place it on the reader for contactless payment. The primary benefit is the elimination of PIN codes.
Over the summer, Spain's retail bank CaixaBank announced it was deploying about 100 ATMs with facial recognition, making it one of the largest ATM networks to adopt touchless biometrics, the bank said. According to the bank's statement, facial recognition streamlines customer identification and enables customers to access the ATM without memorizing passwords or touching a keyboard. "In the context of COVID-19, the system offers the added advantage of enabling users to withdraw cash from ATMs while minimizing contact with the terminal's surface, given that the customer does not need to use the keypad," the bank said.
Of course, contactless authentication doesn't solve all of the risks at an ATM. "It still doesn't solve the problem of the card and how to handle all that dirty money," according to Garrett Bekker, a senior research analyst covering identity management at 451 Research, a part of S&P Global Market Intelligence. Bekker said one industry interested in contactless authentication is healthcare, particularly with roaming doctors, nurses, and techs at hospitals and medical offices. Obviously, masks will be an impediment to facial recognition in these environments.
Contactless, not concern-less
There are, as is the case with most biometric authentication, privacy concerns. The Electronic Frontier Foundation issued a warning against making payments through facial recognition, stating that such systems are "less secure than alternatives, unfriendly to privacy, and likely riskier than other payment alternatives for anyone concerned about catching COVID-19."
The EFF contends that using biometrics to pay is a privacy risk and that facial recognition, because it requires mask removal, could increase viral infection risk. "This is particularly relevant to PopID," the EFF wrote. "A contactless system that makes someone take off a mask endangers the other customers. Ironically, if a customer sees a store using PopID, they better be wearing a mask because PopID is requiring them to come off momentarily. Or they could just shop somewhere else."
Regardless of where one stands on the viability of touchless biometrics, removing a mask for facial recognition would defeat the purpose of wearing the mask in the first place. Therefore, experts expect more biometrics to authenticate people through traits such as their iris, pupils, gait, ears, and more.
Masks have proved a problem not just for public authentication but for consumer electronics. Modern iPhones removed the Touch ID fingerprint reader, in favor of Face ID, with the iPhone X in 2018. iPhone users with masks on find themselves reverting to entering the backup passcode, and Apple has updated iOS to facilitate this.
As the pandemic spotlights touchless transactions and hygiene in public spaces, these trends are bound to impact biometrics, and sensors and keypads in high-touch places may eventually be replaced by biometric authentication that doesn't require physical touch. The only question is which technologies will prevail and when.
Touchless authentication: Lessons for leaders
- The need for touchless authentication is clear. The best options for implementing it are not.
- Just months ago, facial recognition was the mainstream leader in device authentication. That fell apart once people started wearing masks.
- Privacy concerns are an inherent feature of authentication and only seem to worsen with biometrics.
Delivering the promise of the capabilities of biometrics requires a powerful infrastructure
A contactless system that makes someone take off a mask endangers the other customers.
Electronic Frontier Foundation
This article/content was written by the individual writer identified and does not necessarily reflect the view of Hewlett Packard Enterprise Company.