Why Banks Are Using Apple's Touch ID

More than a decade ago, Tangerine Bank (then called ING Direct Canada) decided to try to replace passwords. It helped create a mouse with a built-in scanner to let customers sign in to web banking with their thumbprints.

"A dozen years ago, we thought there had to be a better way than the password," said Charaka Kithulegoda, the chief information officer at Tangerine. "Biometrics gives the opportunity to provide security in a seamless way."

The project, which only made it to pilot status, taught Tangerine something important: sure, the thumbprint technology worked, but the experience was too complex and caused a firestorm of support calls.

The times, well, they're changing.

When Apple recently made available its application-programming interface for its Touch ID fingerprint-authentication technology, Kithulegoda saw what Tangerine has "been waiting [on] for 12 years." The bank added Touch ID capability for customers running iOS 8 on their devices. So have others.

BBVA's Simple, American Express and Discover are a few of the U.S. financial services companies that also have offered the Apple technology to customers, and others are expected to follow suit.

Samsung has built fingerprint scanners into some of its mobile devices, and Westpac New Zealand has developed apps that work with them.

"It's just the start, to be completely honest," said Al Pascual, the director of fraud and security at Javelin Strategy & Research. "The biggest challenge for biometrics for years was cost."

Smartphones eliminate that burden. And Apple's brand is expected to make the technology more mainstream for consumers and banks.

"Apple has done a great job in helping the industry get comfortable with biometrics," Kithulegoda said.

Plus, the authentication technology is viewed as a way to give busy consumers an alternative to passwords and PINs.

Amex, for one, said it made the update in response to mobile users' requests for a faster and more convenient way to log in to its mobile app. (Others such as JPMorgan Chase, Citigroup and Bank of the West nodded to convenience by letting people see their account balances and do other things without having to log in.)

"Apple's Touch ID was the best way to provide this option to our card members, who can now choose to enable Touch ID, or continue to log in to their account with a username and password," an Amex spokeswoman wrote in an email to American Banker.

Tangerine has taken a different approach. For now, the Canadian bank is using the biometric feature to add a layer of security rather than replace the password. Executives want to learn how consumers use it and help them get comfortable with it.

Some experts worry that thieves could steal fingerprints, while Touch ID itself has already been hacked, point out analysts.

"We just need to keep in mind that biometrics are by no means bulletproof; at the end of the day, the biometric is also a static data element and susceptible to compromise," Julie Conroy, a research director at Aite Group, wrote in an email.

Still, Conroy says compromising this type of biometric information on a large scale is difficult, and overall she views Touch ID as "a good way to bring biometrics into mainstream consciousness."

Financial institutions and their tech vendors have been testing other biometric techniques, including iris scans and voice-recognition technologies.

Kishen Kumar, a principal with Capgemini Financial Services, said there are many examples of banks across the world using biometrics to identify their customers across varied channels — including at automated teller machines. He expects more digital identity developments to emerge and replace the need for physical cards. But technology add-ons could present a problem if they slow down the loading of mobile apps, which are supposed to be fast.

"More innovations will need to come in," Kumar said.

Digital Insight, a firm that serves about 840 financial institutions, plans to have its new emerging-technologies unit experiment with Touch ID and other biometrics.

The testing is meant to address a problem faced by the firm and some of its bank clients: many consumers calling for help to reset their passwords even when there are self-service tools available, said José Resendiz, vice president of product management, experience design and business development at Digital Insight, which is a subsidiary of NCR.

Tangerine, meanwhile, is working on using voice authentication to access banking services on mobile devices. U.S. Bank, Wells Fargo and Barclays have also been testing voice biometrics for authentication.

And one day, the Canadian bank could see using biometrics to replace the password for its customers.

"We can and will let people opt out of using their password," Kithulegoda said.

Already, the Touch ID enhancement can bolster the security image of mobile banking and mobile payments.

Javelin's Pascual expects more banks to adopt the technology as a secure alternative to usernames and passwords.

For reprint and licensing requests for this article, click here.
Bank technology Cyber security Authentication Biometrics
MORE FROM AMERICAN BANKER