Biometric Authentication

Instead of relying only on something a person knows, such as a password, biometric authentication uses something a person is. Common forms in financial services include fingerprint scanning, facial recognition, voice recognition and iris scanning.

Behavioural biometrics analyse patterns in how people interact with devices, such as typing speed, how they hold their phone or how they move a mouse, which can help detect fraud during a session.

For example, a banking app may allow customers to log in and approve payments using their phone’s fingerprint sensor or facial recognition, rather than typing a password.

Biometric authentication is convenient and harder to steal or guess than passwords. It is often used as one factor in multi-factor authentication and supports strong customer authentication rules, such as those under the European Union’s Payment Services Directive.

However, biometrics raise concerns. Unlike passwords, biometric characteristics cannot be changed if stolen. They can raise privacy issues, and some systems may be fooled by fake images, recordings or deepfakes. Regulations such as the General Data Protection Regulation treat biometric data as especially sensitive. Firms must protect stored biometric data carefully.