Biometrics in banking: What you should know before implementing

Banks and industry regulators must stay ahead of increasingly sophisticated fraud methods. Traditional security measures like passwords and PINs—which rely on easily compromised information—are insufficient in this race. Biometrics in banking (fingerprint scans, facial recognition, or iris scans) offer both a higher level of security and greater convenience for users. Biometrics have become a requirement for financial software development. Both customers and regulators demand its implementation. According to Mastercard, 93% of customers say they prefer biometric passwords. Regulators in the EU and other regions now require biometric identity confirmation to receive various financial services. Let's explore major use cases of biometrics in banking and the best practices for implementing them.

Best practices in biometrics implementation in banking

Implementing biometrics in banking generally doesn't involve the development of new biometric reading technology. Instead, the use of biometrics in banking is about using existing technologies—such as Face ID for iOS and Android Face Recognition—and integrating these capabilities with the bank's systems. 

Apple and Google provide APIs to access these scanning features and authentication flow for the app's identity management systems (IDM), core banking systems, and security and data management layers. The biometric data never leaves the user's device; instead, a secure token or verification result is transmitted; the tricky part comes when this token needs to be processed within the bank's infrastructure in a compliant and secure way. 

Here's a breakdown of the major components of implementing biometric authentication in banking:

Replacing incompatible legacy systems

Many banks still rely on legacy systems that are not designed with modern, digital-first technologies in mind.

First, integrating biometrics means retrofitting older systems to handle new forms of user authentication, which may involve significant customization. Additionally, older systems may not have the necessary APIs or protocols to communicate with the biometric systems that work on newer platforms. If this is the case, banks must create middleware solutions or employ API gateways to bridge the gap between biometric solutions and legacy systems. The middleware would handle communication between the two systems, converting requests into formats that both systems understand.

When the data gets into the system, legacy systems might find themselves having encryption formats incompatible with the biometric technology. Integrating biometrics, in this case, would mean changing the encryption standards of the system. 

Making such dramatic changes to the basic software on which all bank operations run can carry a lot of risks. It is essential to plan the transition and implement change management practices carefully. 

Read more: Achieving digital transformation in banking one step at a time

Ensuring data security

Unlike passwords, if compromised, biometric data cannot be changed and will stay compromised forever. This makes it uniquely sensitive. There are basic principles of handling biometric data that will guarantee its security:

• Consent: Banks must clearly communicate how the users' biometric data will be used, stored, and protected, along with an opt-in mechanism. This is explicitly required under GDPR in Europe and BIPA in Illinois. GDPR also mandates that users can request the transfer of their biometric data in a secure format and have a right to erasure.
• Minimization and encryption: Banks should collect only the minimal biometric data required for each operation. Instead of storing this data, it should be encrypted using biometric templates (mathematical representations of biometric features) on the user's device before entering the broader banking system. Even if a breach occurs, no identifiable biometric information is leaked.
• Pseudonymization: The actual identity of the user should be separated from the biometric data itself, ensuring that even if the data is breached, it cannot be easily linked to a specific individual.
• Role-based access control (RBAC): Only employees who need access to biometric data as part of their job can access it.
• Incident response: Continuous monitoring systems should be deployed to detect anomalies in using or accessing biometric data. If unauthorized access is detected, the system should immediately trigger alarms and potentially suspend biometric services until the issue is resolved. There has to be a protocol in place in case of such a breach.
• Security awareness: Regular educational activities should be held for employees on the importance of biometric data security, how to handle biometric data securely, and what to do in case of suspicious activities or potential security breaches.

User authentication in banking app

The entire user authentication flow must be designed with security, user experience, and compliance, from initial registration to ongoing account access.

When setting up an account, biometric data has to be collected after completing the KYC process. It should be impossible for the customer to avoid submitting all required information before setting up biometric authentication. Once set up, biometric authentication is highly secure, but the initial enrollment process is a critical vulnerability. Without verifying the user's identity through KYC, there is a risk that a fraudster could register their biometric data to another person's account.

While extremely convenient, biometrics, especially face scans, are not available to users 100% of the time. For situations like these, other authentication options should always remain available.

The app must define session timeout periods, after which the user must re-authenticate with biometrics. This protects the user in case they leave their phone unlocked. Additionally, re-authentication must protect some actions even if the session is active. This will depend on the local regulation and the bank's preferences. Every biometric authentication attempt should generate an audit log that tracks the time, device, and action performed. This ensures traceability in case of unauthorized access attempts.

If a user loses their device or switches to a new one, the app must include an easy and secure process for re-registering biometrics on the new device. This might require an OTP to be sent to the user's email or phone, combined with KYC re-verification. It should also be possible to update biometric information. 

Digital onboarding, biometric signatures, and document updates

Depending on the jurisdiction, contracts for financial services may require biometric signatures or identity verification. In the EU, customers must provide biometric proof of identity when opening an account or applying for financial products like loans or mortgages, renewing it every three years. This requirement would be challenging, but most smartphones today come equipped with near-field communication (NFC) technology. This allows them to read data from RFID chips—components of modern IDs that store the owner's biometric information. The advantages of biometrics in banking are revealed by allowing the users to perform these confirmations automatically from home, eliminating the need to visit a branch. This technology is especially crucial for online-only banks. Automated biometrics in banking is arguably the most effective security measure available today. Cloning or faking an RFID chip demands exceptional skills and resources, putting it beyond the reach of ordinary hackers.

A critical, often overlooked challenge in implementing biometrics in banking and KYC automation solutions is acquiring appropriate data for testing. Due to strict privacy and security regulations (like GDPR and CCPA), real customer or employee data cannot and should not be used for testing purposes. At the same time, testing systems for robustness requires large, diverse datasets to ensure they can handle variations in demographics, lighting, device quality, and more. Generative AI can create synthetic IDs, facial images, and fingerprints with needed diversity. These synthetic datasets allow for comprehensive testing of biometric systems without breaching privacy regulations while ensuring the solution can process diverse requests and edge cases.

Wrap up

Biometrics in banking provide heightened security and convenience, with growing pressure from both customers and regulators for their widespread adoption. However, integrating these technologies into legacy systems presents significant challenges, requiring meticulous planning and careful change management to minimize risks. Data security and compliance are paramount, as banks must strike a balance between protecting sensitive information and enhancing user experiences. Ultimately, adaptability and a forward-thinking approach are essential for the financial sector to maintain security, ensure regulatory compliance, and meet evolving customer expectations in an increasingly digital landscape.

Why choose N-iX for your biometrics implementation

N-iX is a trusted partner for enterprise clients who are driving innovation. With over 21 years of expertise in financial development, we understand the complexities and can help you reach your goals. Here's why we stand out:

• Proven expertise: We run a team of over 200 data experts who have hands-on experience in various domains, including Big Data, AI, and Machine Learning, which are crucial for biometrics implementation. 
• Domain knowledge: Developing financial software requires domain expertise in finance to ensure compliance with complex regulations, accurate handling of financial data, and the creation of solutions tailored to industry-specific challenges and workflows. At N-iX, we have delivered over 250 projects and have a team of over 300 finance domain experts helping you address industry-specific business needs. 
• Quality assurance: We adhere to international standards and regulations, including ISO 27001:2013, PCI DSS, ISO 9001:2015, and GDPR, ensuring the top quality and high standards of our engineering and delivery services.