Beyond passwords: Biometric authentication in financial services

Continuous advancement in digital technology is causing a whirlwind of changes in the Indian financial services industry. Smartphone-enabled mobile wallets and quick loan approvals are just two illustrations of how technology is democratizing access to financial services and bringing efficiency to  processes. 

By 2027, the Indian financial technology (FinTech) market is expected to develop at a phenomenal annual growth rate (CAGR 2022-2027) of 14.02%, reaching a market volume of US$19.55 million. The market is booming and it is being fueled by the digital revolution. However, this expansion requires the presence of strong security measures. It's becoming more and more obvious that in a world where hackers are aplenty, passwords (shared secrets) which have historically protected financial accounts are insufficient.

It cannot be denied though that passwords have restrictions. Hackers use a variety of techniques, including brute force, phishing, and social engineering, to acquire access to them. Not being able to remember complex passwords for different bank accounts often causes password reuse, which is a certain way to get oneself into hot water. Breach of security exposes personal information and undermines faith in the whole financial system.

As digital usage rises, fraudsters are becoming more creative in targeting unsuspecting consumers. Common cybercrimes such as phishing, malware, OTP frauds, and fake UPI links highlight the need to reassess our authentication methods. 

These threats can be mitigated by adopting advanced authentication solutions that primarily leverage biometric verification. With the utilization of unique biological credentials like fingerprints, iris scans, or face recognition, biometric authentication provides a secure and user-friendly way to verify user identification. 

However, biometrics are entirely distinct from passwords since they are intrinsic, meaning that they cannot be re-created. Ultimately, this aids in thwarting any unauthorized entry.

Using biometrics in payment authentication
FIDO (Fast Identity Online) is widely regarded as benchmark for secure authentication, as highlighted by the National Institute of Standards and Technology (NIST). Biometric authentication is becoming increasingly common due to the proliferation of devices equipped with biometric sensors, allowing users to log in using their biometric credentials. However, these biometric credentials alone represent a single factor of authentication and require a robust linkage between the user's digital identity and the transaction.

Developed through collaboration among over 300 industry players, including Google, Apple, and Microsoft, as well as chip manufacturers and payment networks, FIDO is an open authentication standard. Its key strength lies in its phishing-resistant protocol that utilizes public key cryptography to securely verify identity without storing credentials like passwords or PINs on servers. This approach effectively mitigates the risk of large-scale attacks.

Instead of traditional passwords, users can create FIDO keys (also known as Passkey) specific to a web service or app—providing a secure method for logging in or approving transactions.

Benefits of biometric authentication
In terms of the degree of security capacity, biometrics are better than passwords. FIDO passkeys significantly enhances security by using cryptographic login credentials unique to each website, which never leave the user’s device and are never stored on a server. This model eliminates risks of phishing, password theft, and replay attacks. 

Even a study by Aite Group has indicated that the biometric verification system has the capability to significantly lower false transactions by as much as 80%.

Improvements to  user experience: Users who utilize biometric authentication don't need to memorize complex passwords or carry extra authentication tokens around with them. FIDO’s biometric authentication is more convenient for users, allowing them to use built-in methods such as fingerprint readers or cameras on their devices, or security keys, to log in easily and securely. This approach simplifies the user experience while providing robust security.

Higher level of security:  By means of confirming the identification of a user during login attempts and payment transactions, biometrics works as a robust firewall against fake transactions. This builds confidence, which  strengthens the trust between the customer and financial service provider.  FIDO ensures user privacy by generating unique cryptographic keys for each site, which cannot be used to track users across different sites. Any biometric data used remains on the user's device, enhancing privacy and security.

Overall, FIDO’s open standards and broad industry support make it a scalable and interoperable solution, capable of meeting rigorous security and privacy regulations while reducing reliance on traditional passwords.

Addressing concerns and establishing trust
To enhance user trust, , it is necessary to take into consideration the inherent data privacy and security concerns that it presents. This can only be accomplished by implementation of stringent data protection regulations, in addition to transparent data storage and use of protocols. 

Before incorporating biometrics with other verification procedures as a way of strengthening security, financial institutions have to place a strong focus on user education about the collection, maintenance, and confidentiality of biometric data.

Moving forward
As digital technology continues to advance, relying solely on passwords for security is no longer viable. We need more reliable, phishing-resistant, and universally accepted authentication methods that acts as a game-changer in today's digital finance terrain. As we move into 2025, FIDO-based authentication is set to play a crucial role in securing digital payments. 

Companies like Giesecke+Devrient, a sponsor member of the FIDO Alliance, are significantly contributing to this shift towards a more secure and user-friendly authentication environment. By adopting FIDO powered authentication, India has the opportunity to enhance security and establish itself as a leader in the future of digital trust and identity protection within the payment ecosystem. 

-- Tapesh Bhatnagar, Head – Digital Solutions, Giesecke + Devrient MS India Pvt Ltd.