IN OCTOBER 2015, the South African Banking Risk Information Centre (Sabric) released its card fraud report which found that while credit card fraud decreased in 2015, debit card fraud is on the rise, accounting for over R257m in losses last year.
This shift from credit card fraud to debit card fraud can be attributed, at least in part, to the roll-out of new technology. The deployment of chip and pin has decreased the amount of credit card fraud yet, unfortunately, the fraud does not simply disappear. Rather, the attack vector moves to areas that are more susceptible to fraud and where new technology has not yet been adopted.
For example, Standard Bank was targeted this May by a counterfeit ATM card scam and lost over R300m within a period of three hours in Japan. Why Japan? The primary reason is that ATMs in Japan continue to support the use of magnetic strip card data in addition to the more secure chip and pin. Yet, even chip and pin technology is not infallible and is vulnerable to card trapping. With the global rise in identity theft, it must be acknowledged that establishing an individual’s true identity is critical to preventing account fraud. The only true way to bind an account to an individual is to use the authorised individual’s personal characteristics — their biometric information.
The Department of Home Affairs (DHA) is leading the way in biometric authentication, with the Home Affairs National Identification System (Hanis) and the inclusion of fingerprint data on the new national ID card. Since 2010, South African banks have reduced account fraud by confirming individual identities with Hanis. Today, individuals can enrol for the new Smart ID card at selected bank and home affairs branches, with the ultimate goal being use of either a smart ID card or Hanis to confirm identity.
Seven banks now use Hanis in their branches during account origination, for an estimated savings of an impressive R322m a month, according to an announcement by Home Affairs Minister Malusi Gigaba. He estimates that the value of loss prevention sits at around R3bn a year, a figure which is likely to rise as transactions increase due to additional people becoming banked. On the mobile front, in 2015 Standard Bank introduced the capability for its banking members to authenticate with the fingerprint sensor included on the iPhone with its mobile banking application. At ATMs, it’s expected that fingerprint biometrics will replace or augment the use of a PIN (personal identification number).
In a recent post, KPMG SA emphasised how all these shifts in technology investment and the move to a biometric authentication ecosystem were playing a vital role in security and safety. Fingerprint identification is allowing for banking organisations to whittle down identity fraud as individuals have to use their fingerprints to prove who they are. The banks’ adoption of technology to confirm an individual’s identity is providing benefits to both the consumer and the bank. Perhaps we’re even seeing the end of a time where a falsified document or counterfeit ID book is all that is needed to commit fraud.
Not all biometrics are the same however. A poorly designed biometric system is incapable of handling different skin types and conditions, and is unable to distinguish between a live fingerprint and a fake one. A biometric fingerprint verification system must be designed properly to deliver the expected security benefits and positively impact consumers. Biometric technology that is capable of reading fingerprint patterns under the skin bypasses issues with worn fingerprints, wet or dirty hands, and fake fingers. Additionally, liveness detection capability is critical to ensure the biometric information being presented is legitimate. For example, without a requirement for liveness detection, if the biometric data that was captured during the enrolment process is accessed and hacked, it could be used to falsify identity. With liveness detection, the only way to authenticate is with both the matching biometric information and the proof of life. Stolen biometric data would be rendered unusable.
PINs, passwords and identity documents will continue to be used to confirm an individual’s identity, but without biometrics they are vulnerable to increased levels of fraud. As we’ve seen with the banks, there are better ways to confirm identity. Within banking, the use of biometrics is increasing from the teller station and mobile devices to the ATM. Outside of banking, the use of biometrics to properly confirm identity is migrating to healthcare, telecommunications and retail.
With the growing cost of identity theft, the industry is finally responding and investing in more effective ways to ensure that transactions and personal identities are secured. Highly reliable and intuitive technology is critical, whether it be at a bank ATM or the till. To establish proof of life instantly and to secure identities comprehensively — all with a simple touch of a finger — provides benefits today that are difficult to refute.
While many still associate biometrics with futuristic imaginations, it is steadily becoming a standard across SA. Each of the top banks in SA is using biometrics to identify individuals. Voice recognition is used for phone banking and fingerprint verification is used within branches and on some mobile devices. For consumers, biometrics provides a convenient layer of much-needed protection against the growing tide of clever charlatans. For banks, secure and convenient access to banking systems is improved, while exposure to fraud is decreased.
• Sarrail is vice-president of solutions business development for biometrics at HID Global
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.