U.S. House of Representatives
Committee on Banking and Financial Services
Biometrics and the Future of Money
May 20, 1998
By Oscar R. Pieper
President - Identicator

According to Dan Rather in a recent 48 Hours TV Special, "Identity theft is quite possibly the fastest growing fraud." Identity theft affects citizens, businesses and government. The whole basis behind its growth is that it is easy for a fraud artist to assume a law abiding citizen’s identity through use of fraudulent pieces of identification, such as drivers licenses and payment cards, along with the knowledge of social security numbers and other personal identification about the victim. The only real deterrent to this fast growing crime that has a major impact upon the "Future of Money" is positive user authentication through finger imaging biometrics.

Biometrics Overview

Positive user authentication is extremely important in our payment systems, because without it the financial industry can and will suffer substantial fraud losses in the electronic delivery systems of the future. At the same time the consumer will suffer irretrievable damage through identity theft. In the past a consumer completed his or her transaction in person through a teller or clerk in a store. In the future more and more transactions will be completed without a human interface, making it even easier for the fraud artist.

Today the consumer relies upon the following means to authenticate himself/herself:

-- Possession of bank cards

-- PINs

-- Passwords

-- Possession of identity cards, such as a Drivers License

-- Possession of a key

-- Knowledge of social security number

Unfortunately, all of the above can be compromised through identity theft, resulting in fraud, whereas finger imaging cannot be compromised.

Identity Theft

Identity theft occurs through a fraud artist assuming someone’s identity for the purpose of purchasing goods and services, obtaining funds and gaining access to private information. This type of fraud is made possible, because it is relatively easy to obtain fraudulent paper and plastic identification, along with a knowledge of social security numbers and other personal identification information.

Fraud is one of the fastest growing crimes in the U.S. and worldwide today. For example, bank robbery with a gun is minimal compared to bank robbery with a pen through identity theft which ties to we must protect "The Future of Money".

Identity theft can be virtually eliminated through the use of positive biometric user authentication. The objectives are:

• To eliminate fraud
• To eliminate identity theft, which occurs when a fraud artist assumes someone else’s identity in order to impersonate the individual and to commit various fraud crimes, especially financial crimes, in that person’s name. Quoting Dan Rather in a recent 48 Hours TV program, "In a new CBS News, 48 hour poll, nearly 1 in 4 Americans says it has already happened to them.
• To allow for expansion of new electronic payment services.
• To protect consumer privacy from unauthorized access to private data and financial information and resources.

Who Pays For Fraud

All of us pay for fraud in higher fees and higher cost of goods. The individual who suffers identity theft pays even a higher price in losing his/her identity and then suffering for months trying to regain it. In credit and debit cards, fraud losses amount to approximately $3 billion a year, which is only part of the cost, because it does not include the high administrative costs of designing and implementing the systems, which are currently used in the reduction of fraud exposure.

In reference to checks, which are still the major part of the consumer payment system, the American Bankers Association (ABA) estimates that fraud losses are more than double the $3 billion in credit card losses.

At the same time that we need to eliminate fraud in financial institutions, we also need to make it easier for the honest person to use the various financial delivery systems. We all know how difficult it is for a consumer to cash a check unless he/she has a deposit relationship with the financial institution.

This will affect not only today’s checks and credit cards but also tomorrow’s electronic commerce and interactive banking. One solution would be eliminating the acceptance of checks and credit cards across the board and only accepting financial instruments from people we know, however, this would place a substantial burden on the masses, but it would reduce fraud.

The Best User Authentication Solution

Positive user authentication is the key, but it must be easy to use and cost-effective; therefore, finger imaging is the answer. Why finger imaging is the best:

• Fingerprints do not change over time.
• Fingerprints stop unauthorized access.
• All fingers are unique, which allows each person to have ten easy to use identifiers.
• Base of all worldwide identification.
• Fast and easy to use--we do not forget our fingers.
• Users respect them, fraudsters are afraid them.
• Low-cost solution.
• Protects privacy.

According to Joel Lisker, Senior V.P.-MasterCard International in charge of Security and Risk Management:

"After extensive testing and study, MasterCard has determined that the finger minutiae solution provides the highest degree of reliability, combines with a remote enrollment capability, ease of use at POS and a higher level of consumer acceptance (based on a survey of more than 900 consumers) than other biometric technologies available today. Moreover, it is estimated that finger minutiae technology, implemented on a global scale, could cut industry fraud losses by between 50% and 60% per year."

ABA’s Touch Signature Program

Let me give an example where the use of finger imaging has been adopted by the financial industry to reduce fraud. Several years ago the American Bankers Association (ABA) identified a substantial increase in fraudulent checks. They investigated technology alternatives to reduce fraud and at the same time to continue service to their honest customers and determined that finger imaging would be the most effective deterrent to stop check fraud losses. Thus, they implemented a program called Touch Signature. The Touch Signature product is supplied by Identicator under a private label to the ABA. (Show product.) According to the Bank Security and Fraud Prevention publication of the ABA:

"Banks are fighting the bad guys with the very tool those criminals have used to get ahead: technology. And one of the latest ways to do that begins with a fingerprint.

Losses from checks cashed across the teller line fell by almost 50 percent, Bob Randolph (Bank Officer) said. Last year the Clearing House of the Southwest reported that analysis of the 1996 data indicated that the six reporting banks showed losses are 47 percent lower. The total savings for the six banks was $2.5 million.

Why it works

The fingerprinting system is seen both as a deterrent and a method of simplifying banks’ responsibilities when it comes to prosecution.

"Anyone who has ever had their identity taken knows that you’re in a position of proving you’re innocent, rather than guilty. Having prints on these documents serves the purpose. "We have major fraud groups that are highly mobile moving throughout this country. This program is a proactive, joint effort that has the true relationships: to know whom we are dealing with and to have positive proof that we are dealing with the right person."

The Touch Signature Program is simple, low-cost and saves time for both the government, the financial industry and the consumer and it works.

(Demonstration of how Touch Signature works.) Anyone who would like to receive a sample, please give us your name and address and we will send you one.

The Move Toward Electronic Money

The financial industry is moving towards electronic money. Some examples of electronic money are:

• The use of more automated teller machines and customer activated terminals.
• E-checks, where there is no paper in the transaction.
• Electronic commerce - A quote from my article on electronic commerce in the Electronic Commerce World Magazine of May 1998: "Electronic Commerce will not reach the full potential until we address the user authentication issue, i.e. is the buyer or seller truly who he/she claims to be?
• Interactive Banking - Home and PC banking for both corporate and individuals, where consumers can pay bills from their PC.
• The growth in wholesale banking, where wire transfers are especially high in risk.

There is a significant increase in the use of smart cards, especially in Europe, which is spreading to the U.S. Relationship smart cards not only for payment but other uses such as the U.S. GSA initiative, where one card is used for:

• Travel
• Payment
• Data Access
• Physical Access’
• Fleet

In the GSA initiative, there is the option to use biometrics in place of PINs. Of the five financial institutions that were recently selected as integrators, three showed finger imaging and the others showed no biometrics at all.

The key again is positive user authentication to reduce fraud and eliminate identity theft, while at the same time expanding customer services. User authentication links the account to the legitimate customer.

It’s a balancing act. Again a quote from Joel Lisker:

"Fraud thrives on anonymity, and verification of a cardholder’s identity through biometrics is one of the keys to reducing anonymity and winning the war against fraud. At the same time, it is critical that companies maintain a delicate balance: significantly reducing fraudulent transactions through a biometrics solution, while protecting the identity of the contributing cardholder.

"Of all the biometric solutions reviewed and tested to date, MasterCard believes that the finger minutiae technology is the most viable and realistic approach for the payment card industry. It poses the fewest problems for issuers, merchants and cardholders and is far easier and more cost-effective to implement than other biometric options. In addition, finger minutiae technology easily can be programmed to eliminate "false reject" instances - when a valid cardholder is incorrectly denied access to their account. This is critical in the bankcard world, where unconditional acceptance is the utmost importance. When asked in focus group research, consumers selected finger minutiae as the most viable of all biometric approaches."

Finger minutiae is the most effective biometric because it is:

• Easy to use in a variety of situations, home office, POS, etc.
• Fast, 30 seconds to enroll and less than 1 second to use
• Difficult for the criminal element to compromise
• Low-cost, around $100 per point of transaction
• Easily deployed
• Worldwide solution
• Gives an audit trail if necessary
• A very strong deterrent to fraud
• A system that is interoperable
• Easy enrollment either through first use or enrollment by mail

Most importantly it virtually eliminates identity theft.

How Finger Minutiae Works

Each finger is made up of a network of unique ridges that have end points and splits. (See ABA slide.) During enrollment, which takes around 30 seconds, the system generates a small template of these unique features. The original fingerprint is then thrown away. The original fingerprint cannot be re-created from these extracted features. This template can then be stored on a mag stripe, a smart card or on a server controlling access to private information.

At the point of entry, the customer simply places the same finger on a low-cost Direct Fingerprint Reader, see Identicator Engine slide (system is made up of a reader and software), such as the one that is incorporated in this Trusted Mouse. (Show the mouse.) The positive link between the account and the accountholder can be accomplished in less than one second. The program as outlined above is currently being used in a number of installations including the U.S. Treasury electronic payment systems project at Ft. Sill, Oklahoma.

Another quote from Joel Lisker:

"Finger minutiae holds enormous promise. It offers a near-zero percent false rejection rate and is cost and memory-efficient, requiring only 80 bytes of data to be stored on a chip. By contrast, other biometric technologies require several thousand bytes. Finger minutiae is safe, repeatable and reliable, yet it does not infringe on consumers’ privacy. Because it only requires installation of a compact direct finger reader at the point of sale, it is a "small footprint" solution, as opposed to hand geometry readers and iris or retinal scanning equipment, which typically can be both bulky and expensive."

GAO Report

In September of 1995, the U.S. General Accounting Office (GAO) released a report entitled "Use of Biometrics to Deter Fraud in a Nationwide EBT Program". (Show the report.) Its number is GAO/OSI-95-20. The report concluded that:

"EBT alone does not effectively deter fraud in the delivery of food stamp benefits. Thus, an EBT program without the enhanced security of biometric verification raises a genuine concern about the potential for increased program costs and losses. The concern increases with the proposal to expand EBT into other federal, state, or local government programs involving billions of dollars -- such as AFDC, WIC, social security, and federal retirement benefits.

Due to the universal acceptance of fingerprints as a means for verifying identities, its extensive history of reliability in the law enforcement arena, and successes with AFIS technology, we believe fingerprint verification is the biometric form that offers the greatest potential for success and acceptance in securing EBT systems from fraud."

Identicator Technology

Identicator Technology has installed finger-imaging systems throughout many applications worldwide. We would like to highlight two installations that received the highest recognition at the CardTech/SecurTech Convention, the major industry annual gathering.

In April 1998, we received the annual award for the U.S Treasury electronic payment project at Fort Sill (slide). Mellon Bank is the systems integrator and Identicator’s fingerprint technology is used both at the enrollment station and the transaction station. There will be 20,000 smart cards issued to Army recruits and they use finger imaging rather than PINs. The results are very positive. The users say it is not only easier but also faster than the PIN-related systems. The key is that through finger imaging, the accountholder is tied directly to the card.

Two years ago, Identicator was similarly recognized at the same prestigious gathering for the TASS Project, where 650 ATM kiosk machines (slide) are equipped with Identicator’s Direct Fingerprint Readers. The kiosk provides cash and information to recipients, 24 hours a day, 7 days a week. A smart card is used (slide). The recipient simply places his/her card in the kiosk and places his/her finger on the reader and in less one second the cash is dispersed. All that is stored on the card are the fingerprint features and remember a fingerprint cannot be re-created from these features.

Identicator was selected as the technology for the largest deployment of biometrics within the U.S. Department of Defense. The RAPIDS (Real-time Automated Personnel Identification System) and DEERS (Defense Enrollment and Eligibility Reporting System) employs 1,322 servers and workstations worldwide. Identicator software and hardware is being used to enroll 6 million DOD employees and retirees in an effort to establish positive identification of all military personnel with regard to records and disbursements. This initiative was as a result of the success of Operation Mongoose, a DOD anti-fraud program that has saved millions of dollars in taxpayer money.

Identicator is a member of the BioAPI Standards Group made up of Compaq, IBM, Microsoft and Novell. This group will significantly move the adoption of finger imaging technology worldwide through clear, open standards.

Summary

The bottom line is that we need protection from fraud and identity theft. This is important, not only to ensure that one’s good name is not damaged, but also to ensure that one’s financial resources and personal data cannot be attacked so easily. This protection comes from finger minutiae, which in fact is the essential protection for law-abiding citizens, government and business. We will not successfully move into the "Future of Money" without it.