by

by Dave Tushie, Magellan Consulting, Inc., ICMA Standards and Technical Representative

Cards with embedded biometric sensors, primarily fingerprint, have been proposed and tested for many years. Significant advances in this technology have accelerated more recently and created a higher level of interest in issuing these cards. Notably, Mastercard and Visa trials with RBS Group (U.K.) beginning in 2019 caused multiple trials throughout Europe in 2020. This greater interest in biometrics on cards is accentuated with EMVCo announcing in January that it has approved its first fingerprint sensor and chip configuration for secure financial cards.

In reality, the most recent acceleration in this technology can be traced to two intersecting developments: 1) smartphone adoption of biometric user authentication and 2) advancing low power semiconductor chip technology. Initially, fingerprint biometrics drove the transition from PIN to biometrics in smartphones. Refining the measurement indices and algorithms improved the False Acceptance Rates (FARs) and False Reject Rates (FRRs), providing a higher level of assurance that the user was authorized. More recently, the fingerprint biometric has been augmented with facial recognition biometrics, providing an indication of where card biometrics may be headed in the future. Coupled with these advancements is the emphasis on greater sophistication in chip design with ever lower requirements on the power needed to operate them. An additional significant effect is the substantial reduction in cost of these sensors and chips due to the volume of smartphones produced. Card manufacturers are able to take advantage of being far down the manufacturing learning curve (decreasing component cost with increasing volume) afforded by the “head start” in smartphone usage.

Of particular interest to those in the secure financial card industry is that these technology advancements now allow these fingerprint sensors and chips to be embedded in a standard ID-1 card configuration. Because of the low power requirements of these chips, no on-board battery is required to power them. Rather, similar to a contactless card, the radio frequency (RF) field of the point of sale (POS) or reader device provides sufficient energy to power these chips. When used in a transaction, the fingerprint sensor reads the cardholder fingerprint and it is compared to the stored biometric in the secure element of the card. The card then provides a message that the fingerprint biometric is verified, similar to the process of a PIN if it is used as the cardholder verification method. Thus, the process fits well within the current EMV payment environment.

There is some friction in the enrollment process that is currently being addressed. It appears that three different processes could be used:

1. At home, using a suitable enrollment device (reader/writer). Similar to enrollment on a smartphone, multiple fingerprints (including multiple authorized users of the card) could be enrolled for any card.
2. Branch bank assisted enrollment.
3. Unattended enrollment device, like a kiosk or ATM machine.

Cardholders trust bank cards issued by a trusted third party (bank) with whom they have long standing relationships. They trust that their card is secure, more so than they trust a mobile device to be similarly secure. When that card is lost or stolen, or a data breech occurs, they trust that they will be held harmless when fraud is perpetrated with that card. Consequently, cards still hold the upper hand compared to mobile devices for payments and probably for the foreseeable future.