Mastercard Launches Biometric Cards

Biometrics more or less “went mainstream” when the iPhone 5s, launched in September 2013, incorporated a fingerprint reader into the iPhone.

Presented to consumers as a way to use a fingerprint, instead of a password, to access their phone, TouchID got consumers used to the idea that they could be in control of who and how the information on their phones was accessed by using something that is uniquely theirs to unlock the home screen.

Since then, TouchID has been integrated into a variety of payments experiences — from using the phone to make a payment in a physical store to opening a mobile banking app.

Biometrics have also played a role in establishing and verifying identity in countries like India and South Africa where governments issue “smart cards” to wring fraud from the system when government benefits are paid.

Today, Mastercard is taking that notion of biometrics, plastic cards and payments to a different level with the announcement of a next generation biometric card that combines EMV chip technology with a fingerprint reader on the front of the card to authenticate the identity of a cardholder at the point of sale.

The card, Mastercard’s EVP of Identity Solutions Bob Reany told Karen Webster, looks identical to any other chip card — it’s engineered to ISO specifications for sizing, and the EMV chip is where it always is on the lower left.

With one difference.

There’s a thin film on the upper right hand corner where the customer would naturally rest her thumb when dipping her card. That thin film is the fingerprint reader — and when the card is inserted into an EMV terminal, it matches the thumb print of the person holding the card to the one on file. If there is a match, the customer is authenticated and the transaction processed.

“Because it has actually has a fingerprint reader embedded on the card itself and the technology is part of the chip technology,” Reany said, “the only person who can use it is that consumer who registered.”

No PIN required.

“The basic standard for authentication is something you have, something you know or something you are. An EMV card is the something the consumer has. When the biometric card is inserted into the machine, we can be confident that the person using that card is the person who’s supposed to be using that card. With the fingerprint reader on the card, we are adding the ‘something you are’ to the process,” Reany explained.

Merchants, Reany pointed out, get the advantage of a reduction in fraud that this new level of security and authentication offers without a costly POS upgrade, since all of the authentication is done on the card itself via the chip — and the existing chip readers.

Reany said that Mastercard rejected any innovation that required building the biometrics into POS terminals. “We’ve seen very recently that terminalization changes are really, really difficult,” he observed, further remarking that there’d be little if any appetite for additional changes, particularly in the aftermath of the EMV upgrade.

He said they also rejected pitches to put fingerprint readers on powered cards, citing cost, battery life and flexibility. “We didn’t want to design something really innovative and cool around something that would not work — batteries on cards don’t work,” Reany said.

Built For Governments

Reany said that the first — and motivating — use case for this technology wasn’t commerce in the developed world at all — it was originally built for governments using cards to distribute benefits and public sector pay.

“As it turns out, if you use biometrics during the registration process, you can get rid of a lot of fraud in systems,” Reany said. He shared that when the government of South Africa first went to biometric cards for the distribution of benefits, they reduced the payout for financial benefits from the Treasury by over 20 percent. Fraud, double-dipping and in some cases collecting benefits posthumously were all problems that biometric cards can make much more obvious — and thus easier to eliminate.

But the lightbulb for payments more generally in the developed world went off, Reany told Webster, when he was first showing their biometric cards to issuer partners as proof of concepts for an interesting innovation under development.

“So imagine our surprise when they said, ‘this is the coolest card I’ve ever seen and I want to use it for my affluent portfolios,’” he told Webster. He said that the issuers had more ideas about how to use it than even Mastercard had envisioned. “I think that best way to move innovation forward is to have your customer base and your partners see the possibilities you could never imagine that solve a pain point for them,” he said.

What’s Next

To use a biometric card today, users have to go to a bank (or other authorized location) and register their card and fingerprint in person. That, Reany noted, was a byproduct of the card originally being designed for government use cases, since they had assumed physical presence for registration was a must-have.

That situation, he noted, is different for banks and their customers — which means they are working with their partners to make remote registration possible. More to come on that score.

Reany also said that a trial of the service in South Africa’s leading supermarket retailer, Pick n Pay, and Absa Bank, a subsidiary of Barclays Africa, have already concluded.  Over the next few months, additional trials — including ones in Europe and Asia — will be conducted with the biometric card.

A full rollout is expected later this year.

“I think we are really still seeing the beginning of innovating around biometrics — and I think the best thing here is we’ve shown that you can add innovation without making the card inoperably complex for merchants and users.”