Can biometric cards ride the surge in contactless payments?

Biometric authentication has always been a challenging subject with consumers, who are accustomed to using the technology to unlock their phones but are still wary about how much personal information they share with retailers and card issuers.

Banks are also concerned about the cost of adding biometric authentication, but the rapid growth of contactless cards during the pandemic has shown that investing in card technology can pay off.

Biometric card manufacturers argue that the time is right to add a fingerprint reader within the card itself.

"Using a biometric contactless card is both for consumers' and merchants' convenience wherever the standard contactless POS payments are already a practice," said Barnabas Ferenczi, head of strategy and marketing in the smart card and digital payments business of Munich-based card manufacturer Giesecke+Devrient. "For the consumer, this is the same tap and go ergonomics at the till, with no real change."

Consumers are already accustomed to contactless payments. In the U.K., nine out of 10 transactions in 2020 were contactless, according to new data from Barclaycard. Late last year, Visa tracked a similar trend in the U.S. in saying 31 million Americans paid with a Visa contactless card or digital in March of 2020, up from 25 million a few months earlier.

Merchants who have POS contactless payment readers and support Near Field Communication are able to accept biometric contactless card payments, Ferenczi added. Those factors cover the majority of existing readers and nearly all newly delivered terminals globally, he said.

For the past five years, biometrics had increased exposure among consumers, with countries like India establishing a digital identity program that uses fingerprints and iris scans in addition to a photograph for those collecting social welfare payments.

Industry researchers have predicted that mobile biometrics will authenticate up to $2 trillion in remote and in-store payments in 2023. And that speculation occurred well before a global pandemic pushed consumers into using contactless payment methods.

Plus, since Apple introduced fingerprint authentication to unlock a phone and also make a payment with Apple Pay seven years ago, it has found even more usefulness during the coronavirus pandemic.

In addition, the FIDO Alliance (which is made up of major technology and payments companies) has worked feverishly to bring biometrics into a brighter spotlight to at least put an end to static passwords in e-commerce.

Companies like G+D or Sweden-based Fingerprints Cards want to establish biometric contactless cards as the new standard, pointing to the enhanced data security, the convenience of bypassing PINs, avoiding transaction limits, and staying safer during the global pandemic by not touching PIN pads or card readers.

While use of biometrics for authorization is prevalent in other parts of the world, it is likely to be a bumpier road in the U.S., mostly because U.S. banks will likely take a longer road to scrutinize and analyze return on investment.

Indeed, the cost of issuing biometrics cards could give many U.S. banks pause, said Tim Sloane, director of emerging technologies advisory services for Boston-based Mercator Advisory Group.

"The implementation of biometrics is going to be different in every country and probably for every use case," Sloane said. "Fingerprints on a mobile device are likely to be the go-to direction here in the U.S. and there may be instances in which you go to make a payment, and if it is deemed a higher risk, then you might be asked to authorize with a fingerprint on a phone or card."

The challenge in the U.S. is the estimated $1 to $1.50 or more added to each biometrics card issued because they are not in mass production, Sloane added. Issuers "might be able to bring that down to 75 cents, but that's still a pretty significant extra cost," he said.

Because a biometric card addresses only lost and stolen card fraud, many banks will weigh that to be a relatively small risk compared to the cost of issuing and reissuing certain types of cards, Sloane said.

In a more dramatic comparison, biometric cards were as much as $20 each to issue, compared to just $2 for an EMV card, according to ABI Research in 2019.

Thus, biometrics card issuers have to argue that these new cards could be used for other purposes, Sloane said. "If it can somehow link to your mobile phone or web browser to authenticate you for account access or other reasons, then I could see someone else eating that cost" of the card issuance.

Global security and cyberdefense provider Thales has also long been a proponent of other use cases, specifically biometrics having a play in Social Security benefits if those benefits were distributed to EMV cards.

Thales has supplied EMV biometric cards to banks the past two years, including an arrangement with RB/NatWest in the U.K.

Thales has often made the point that its cards comply with the ISO standards and the company helps arrange for the POS terminal to power on the biometrics sensor through the ISO 14443 standard for wireless connection. Advances in sensor technology will have a role in how much it could cost for a bank to issue a card, with the consensus being that newer-generation sensors will lower the costs.

That type of new sensor technology is already helping lower the cost of biometrics cards in Europe by about $5 per card to reach the $10-per-card range, Christian Fredrikson, CEO of Stockholm-based Fingerprint Cards, said in a recent podcast with PaymentsSource.

The target is to get it down even lower to make issuance easier to absorb in a bank's budget. The hope is to get the cost down to about $3 a card, which is more in line with contactless NFC cards, he said.

Fingerprint Cards has also moved along the path of adding technology and developing use cases in its European markets, developing the Touchless 2.0 platform combining iris screening with facial recognition as part of its authentication process.

Testing biometric cards for the past year, Fingerprints sees the improvements to its touchless portfolio as a way to complement those cards with advanced security. The company is engaged in some of the more than 20 banks worldwide testing biometric cards, indicating a growing interest, Fredrikson said.

A positive facet of biometric cards is that they satisfy both security and convenience — two factors that often are not both met at the same time with new payment methods or products, Fredrikson said.

Still, the U.S. is likely to be slow to adopt biometrics cards, mainly because of the country's vast differences in payments infrastructure and some merchants' inability to accept biometrics, he added.

"However, you have a variety of systems in the U.S. accepting contactless, so it is time to accelerate this at the POS," Fredrikson said. "Clearly, people do not want to touch a payments device during the pandemic."

G+D's Ferenczi contends there would be no infrastructure changes required for most POS networks, and he also points to the checkout time for a customer being reduced significantly for merchants as a key aspect of their return on investment.

"Moreover, as our biometric cards do not need a battery, unlike some other products on the market, the cards have a long lifetime, are robust and easy to use and then to dispense," Ferenczi said.

The U.S. began ramping up contactless card use once the pandemic set in, increasing to about 50% to 60% of transactions from about 10% just two years ago, Ferenczi added.

"Statistics of Mastercard and Visa show that the adoption of contactless payments at the POS has also accelerated in the U.S., also due to COVID-19, with more than half of consumers having already paid via contactless recently," Ferenczi said.

With technology moving at a rapid pace, there is always the outside chance that biometric cards could complement other major advancements — or, conversely, find themselves left behind as other technologies reach the market.

"Visa and Mastercard with the new 3D Secure are enabling a one-time password and biometrics within that framework," Sloane said. "When you use your card for an e-commerce transaction, they can request authorization through a one-time password or a biometric challenge."