South African banks look to biometrics to reduce fraud

Source: Business Day, 11/08/2016

IN OCTOBER 2015, the South African Banking Risk Information Centre
(Sabric) released its card fraud report which found that while credit
card fraud decreased in 2015, debit card fraud is on the rise,
accounting for over R257m in losses last year.


This shift from credit card fraud to debit card fraud can be
attributed, at least in part, to the roll-out of new technology. The
deployment of chip and pin has decreased the amount of credit card
fraud yet, unfortunately, the fraud does not simply disappear.


Rather, the attack vector moves to areas that are more
susceptible to fraud and where new technology has not yet been
adopted.


For example, Standard Bank was targeted this May by a counterfeit ATM
card scam and lost over R300m within a period of three hours in Japan.
Why Japan? The primary reason is that ATMs in Japan continue to
support the use of magnetic strip card data in addition to the more
secure chip and pin. Yet, even chip and pin technology is not
infallible and is vulnerable to card trapping. With the global rise in
identity theft, it must be acknowledged that establishing an
individual`s true identity is critical to preventing account fraud.


The only true way to bind an account to an individual is to
use the authorised individual`s personal characteristics — their
biometric information.


The Department of Home Affairs (DHA) is leading the way in biometric
authentication, with the Home Affairs National Identification System
(Hanis) and the inclusion of fingerprint data on the new national ID
card. Since 2010, South African banks have reduced account fraud by
confirming individual identities with Hanis. Today, individuals can
enrol for the new Smart ID card at selected bank and home affairs
branches, with the ultimate goal being use of either a smart ID card
or Hanis to confirm identity.


Seven banks now use Hanis in their branches during account
origination, for an estimated savings of an impressive R322m a month,
according to an announcement by Home Affairs Minister Malusi
Gigaba.

He estimates that the value of loss prevention sits
at around R3bn a year, a figure which is likely to rise as
transactions increase due to additional people becoming banked. On the
mobile front, in 2015 Standard Bank introduced the capability for its
banking members to authenticate with the fingerprint sensor included
on the iPhone with its mobile banking application. At ATMs, it`s
expected that fingerprint biometrics will replace or augment the use
of a PIN (personal identification number).


In a recent post, KPMG SA emphasised how all these shifts in
technology investment and the move to a biometric authentication
ecosystem were playing a vital role in security and safety.


Fingerprint identification is allowing for banking organisations to
whittle down identity fraud as individuals have to use their
fingerprints to prove who they are. The banks` adoption of technology
to confirm an individual`s identity is providing benefits to both the
consumer and the bank. Perhaps we`re even seeing the end of a time
where a falsified document or counterfeit ID book is all that is
needed to commit fraud.


Not all biometrics are the same however. A poorly designed biometric
system is incapable of handling different skin types and conditions,
and is unable to distinguish between a live fingerprint and a fake
one. A biometric fingerprint verification system must be designed
properly to deliver the expected security benefits and positively
impact consumers. Biometric technology that is capable of reading
fingerprint patterns under the skin bypasses issues with worn
fingerprints, wet or dirty hands, and fake fingers. Additionally,
liveness detection capability is critical to ensure the biometric
information being presented is legitimate. For example, without a
requirement for liveness detection, if the biometric data that was
captured during the enrolment process is accessed and hacked, it could
be used to falsify identity. With liveness detection, the only way to
authenticate is with both the matching biometric information and the
proof of life. Stolen biometric data would be rendered unusable.


PINs, passwords and identity documents will continue to be used to
confirm an individual`s identity, but without biometrics they are
vulnerable to increased levels of fraud. As we`ve seen with the banks,
there are better ways to confirm identity. Within banking, the use of
biometrics is increasing from the teller station and mobile devices to
the ATM. Outside of banking, the use of biometrics to properly confirm
identity is migrating to healthcare, telecommunications and
retail.


With the growing cost of identity theft, the industry is finally
responding and investing in more effective ways to ensure that
transactions and personal identities are secured. Highly reliable and
intuitive technology is critical, whether it be at a bank ATM or the
till. To establish proof of life instantly and to secure identities
comprehensively — all with a simple touch of a finger — provides
benefits today that are difficult to refute.


While many still associate biometrics with futuristic imaginations, it
is steadily becoming a standard across SA. Each of the top banks in SA
is using biometrics to identify individuals. Voice recognition is used
for phone banking and fingerprint verification is used within branches
and on some mobile devices. For consumers, biometrics provides a
convenient layer of much-needed protection against the growing tide of
clever charlatans. For banks, secure and convenient access to banking
systems is improved, while exposure to fraud is decreased.