Meeting biometric authentication deadline a big challenge for banks

Banks say there is still a long way to go before the supporting infrastructure is put in place for biometric authentication-based transactions on ATMs and PoS machines

New Delhi: With less than two months left to meet the deadline set by the Reserve Bank of India (RBI), banks are moving towards enabling ATMs and point of sale (PoS) machines they will install in the new year to allow Aadhaar-based biometric authentication.

Banks say there is still a long way to go before the supporting infrastructure is put in place for biometric authentication-based transactions on ATMs and PoS machines.

Last month, RBI issued a notification asking all banks to ensure that ATMs and PoS machines deployed from 1 January are enabled for accepting chip-enabled cards as well as those authenticated using a personal identification number (PIN) or the Aadhaar unique identification number and biometric verification.

The decision came on the recommendation of a working group established by RBI favouring the use of Aadhaar as an effective alternative for additional authentication of domestic card transactions.

“It is the incremental engagement that is getting secured, but the existing inventory also needs to be updated in order to eliminate the chances of data breach,” said Puneet Kapoor, senior executive vice-president at Kotak Mahindra Bank Ltd. “It will take some time before we reach a position where we can say that we have really optimized the opportunity of biometric authentication.”

The introduction of biometric-enabled PoS machines will allow more people to perform Aadhaar-based financial transactions because of the large issuance of RuPay cards under the Pradhan Mantri Jan Dhan Yojana, a government initiative to ensure every household has access to a bank account, said Ritesh Pai, senior president and country head of digital banking at Yes Bank Ltd.

“Biometric-enabled PoS machines are also expected to ease the experience of financial transactions for a large number of users and it also ensures higher security levels,” Pai added. “This will spur a gradual adoption of such infrastructure throughout the ecosystem, and eventually we are likely to see only biometric-enabled infrastructure to be present for card acceptance with older devices being replaced.”

With more than 1.07 billion Aadhaar enrolments, the use of Aadhaar for authentication of proof of identity and proof of address and for electronic know your customer verification is expected to pick up in the coming months.

“For a card present transaction, PIN is a factor for authentication. In the place of the PIN, we can use biometric authentication. The latter will be more authentic in comparison to the first one,” said an official at Federal Bank who didn’t want to be named. “So, theoretically at least, if the card is dumped, the thumbprint alone will be only a single factor authentication, though more secure than the card and PIN combo.”

This official said RBI’s 1 January deadline will be a “challenge” for banks to meet.

Delta ID Inc., an iris scan technology developer, is in talks with some banks for use of its software in PoS terminals and ATMs.

“With the addition of biometrics, payments will change for the better for both consumers and banks. We will start seeing both fingerprint and iris [scan] in PoS devices next year. Biometrics ensures low fraud and associated risks,” said Vivek Khandelwal, vice-president of business development at Delta ID.