Card-present fraud is about to get a bit more difficult to pull off. While the EMV chip has been hugely effective at stopping card cloning, it has still been possible to make fraudulent transactions with lost and stolen cards, especially if PIN entry can be bypassed.
One possible solution is biometric credit cards, which authenticate the payer’s identity through inherent physical traits, such as their fingerprints. Credit cards and banks are now working together to launch pilot programs that will test out biometric cards in various markets. How will biometric credit cards work, and how effective will they be at preventing fraud?
Biometric security already has a proven track record. It’s frequently used to unlock smartphones and other personal devices, which has carried over to its use as the primary authentication method for digital wallet apps.
More than two out of three consumers believe that biometrics are more secure then PINs or passwords, and many of them are already using their faces and fingerprints to confirm everyday retail payments.
Meanwhile, credit cards have been steadily acquiring more and more technological hardware. Soon after the EMV chip became standard, the demand for contactless cards started rising, motivated in no small part by the pandemic. With cards already carrying security chips and near-field communication transmitters, it shouldn’t come as a surprise that the card networks would want to add biometric readers.
While biometric cards may still be in the early stages of deployment, it might not be long before this becomes the new mandated standard for card-present security. Now is a good time for merchants to start learning about the technology and preparing for its arrival.
Biometric cards are credit or debit cards that come with a built-in fingerprint scanner that verifies the identity of the cardholder when they try to make a payment. If the scan doesn’t match the enrolled biometric data, the payment will not be authorized.
Biometric authentication is designed to replace PIN entry or signatures at the point-of-sale.
While merchants can be protected from fraud liability if they follow the required procedures for EMV chip cards, there are still ways for fraudsters to exploit a lost or stolen card that hasn’t yet been reported.
Even though a fraudster can guess a PIN or forge a signature, there’s no way for them to falsify somebody else’s fingerprint. Biometric security features make it virtually impossible to fraudulently authorize a payment.
Biometric cards capture the cardholder’s fingerprint data upon first enrollment, then scan the thumbprint of the person holding the card when it is being used for payment. Authorization is only permitted when the prints match.
To use a biometric credit card, the cardholder must first complete an enrollment process in which a digital map is made of their fingerprint. The cardholder may be able to do this on their own, using the sensor embedded in the card, or they may do it in-person at a branch of their issuing bank. Cards may be able to hold several sets of biometric data to accommodate multiple authorized users.
Biometric cards are designed to work with existing terminals and should not require any hardware upgrades from merchants. The card itself will prevent contactless transactions from going through if the scans don’t match. However, that doesn’t necessarily mean a lost sale. Cardholders can still fall back on PIN entry or signature authorization when biometric authentication fails.
Biometric credit cards offer a fast, convenient payment authentication process that offers even stronger security than signatures or PIN entry.
It’s often said that there are three ways to authenticate somebody’s identity: through something they know, something they possess, or something they just are. Knowledge and possessions can be stolen or falsified, but it’s much harder to do that with some inherent physical trait like fingerprints. There’s just no practical, low-cost method for the average fraudster to bypass biometric security.
Because PIN entry and signatures are still an option, the primary benefit of biometric cards at this moment is that they allow customers to enjoy a checkout process that is both fully secure and entirely frictionless. This can result in fewer false declines due to forgotten PINs and prevent lost sales from impinging on your revenue.
Visa’s initial pilot program in the US and Europe has been launched in collaboration with Mountain America Credit Union and Bank of Cyprus. Visa and Mastercard have also carried out earlier test launches in other global markets.
Despite the fact that biometric cards have yet to hit the payments scene in a big way, the card networks have actually been running pilot programs for a few years now.
There may yet be some technical issues and barriers to adoption that are still being worked out, but it is likely that biometric security will take priority over knowledge-based authentication factors in card payments within the next few years.
Once adoption hits a certain critical mass and biometrics proves itself to be the safest option, we could see more card network mandates designed to incentivize merchants to phase out PINs and signatures in favor of biometric authentication.
Advances in chip technology and other innovations have helped to improve card-present fraud protection by leaps and bounds in recent years. Unfortunately, these advances rarely translate to similar improvements in card-not-present environments. It’s ultimately up to every merchant to get a clear understanding of their own fraud situation, identify their vulnerabilities, and implement the most effective solutions possible.
Biometric credit cards will help close up some of the loopholes that still permit fraud to slip through in brick-and-mortar retail environments, but merchants will still need to come up with their own comprehensive strategy for defense against fraud and chargebacks.
Thanks for following the Chargeback Gurus blog. Feel free to submit topic suggestions, questions, or requests for advice to: win@chargebackgurus.com