Biometrics Add Security in Insecure Times -- Technologies like voice-recognition and fingerprint authentication can add a layer of security while improving customer service and cutting costs.
April 2, 2004 1:48pm
Wall Street & Technology
Clients of Houston-based Aim Investment Services don't have to worry about remembering passwords or PIN codes when seeking information about their portfolios over the phone. That's because last year, Aim became the first mutual fund firm to adopt Nuance Verifier 3.5, a voice-recognition authentication system from Menlo Park, Calif.-based Nuance Communications.
Rather than typing ID numbers and passwords on a telephone keypad, an end-user of this voice biometrics technology simply speaks into the phone and the system confirms his or her identity by examining voice patterns.
"It's kind of cutting edge technology, using somebody's voice print," explains Jesse Dean, an assistant vice president of Aim Investment Services. "It's more secure than a PIN and easier to use."
To sign up for voice authentication, investors call into the integrated voice-response system and are prompted through a series of phrases, after which the system creates a voiceprint. When investors call back in the future, they simply provide their Social Security number, and the system compares the voice with the information on file to determine a match.
An Eye to Customer Service and Security
"People really like it," Dean says of the voice-authentication system, which is deployed through DST International's IVR platform. It has resulted in a 20 percent reduction in call duration and a 15 percent increase in the automation rate, according to Dean. And, from a security standpoint, he says, "We feel very comfortable with voiceprint."
In an age when investment firms must constantly fight hackers and protect their clients from activities like identity theft, the security benefits of voice authentication are not small concerns. Last year, the Federal Trade Commission received 500,000 complaints about fraud and identity theft. Losses exceeded $437 million.
Last fall, a teenager used a Trojan horse - a computer program that contains hidden computer code, in this case a keystroke-logging program - that was planted in an investment chat site to capture the investor's log-in information without the investor's awareness. The teen had bought $91,200 in put options on Cisco that were due to expire worthless, then allegedly executed a series of trades involving his own account and the account of the online investor to close out his options position, cutting the teen's losses by $37,000.
Security-breaching scams are getting more sophisticated and more frequent, creating a need for more aggressive security solutions. One of the more worrisome developments is phishing, where there's a mass distribution of e-mail messages that feature branding and Internet links that appear to come from financial institutions. Recipients are prompted to visit the sites and provide authentication data for their accounts, such as passwords and PINs. Because the sites appear to be official, people often cough up their private data unwittingly.
Industry sources say phishing has become a real problem. According to the most recent statistics from the Anti-Phishing Working Group (www.antiphishing.org), an organization formed to promote best practices and raise awareness about phishing, there were 176 reported attacks in January, up 52 percent from the prior month. About 13.6 percent were repeat attacks from previous months. While eBay was the biggest individual target, financial services was the business sector most under attack. Citibank saw 35 instances of unique attacks, while American Express had six, Visa two, Fleetbank two and Barclays, one.
An IT executive at a brokerage firm notes, "It's very difficult to protect against phishing. These guys are getting more sophisticated."
Biometrics Solutions
Proponents argue that biometrics - technology that uses biological sources for identity verification - is one way to battle the onslaught of identity theft and online fraud attacks. "I think biometrics can play a really important role in providing non-repudiated authentication," says Maxine Most, a principal at Acuity Market Intelligence in Boulder, Colo., which tracks biometrics solutions. She adds that many financial firms are experimenting in some fashion with biometrics. According to Most, the technology can improve security and business processes, and provide a more convenient way for users to be authenticated.
Christine Barry, an analyst at Celent Communications who has tracked biometrics, says, "I don't think it's moving as quickly as a lot of people once expected, but it's definitely made progress."
Mart Raigla, vice president of technology risk and information security at TD Waterhouse, says, "We've been thrilled with our implementation [of biometrics solutions]." He says the various biometrics systems are all very secure, depending on how they are deployed.
There are more than a half-dozen biometrics-based approaches to security, each of which has its strengths and weaknesses.
Voice Authentication: Users provide snippets of their speech, which are compared to voiceprints on file. According to vendors, voice-authentication applications can easily be rolled out to a large consumer base.
Voice authentication is particularly good for shortening the identification process and limiting password re-sets, a significant problem for financial firms. One estimate indicates that each password re-set costs a firm $25 in staff time, so the ability to automate that process and free up staff can be a considerable advantage. Aim's Dean says, "We have seen a reduction in the number of PIN resets" since the firm made voice authentication available. He notes that voice recognition works well in self-service situations: "We wanted to make it easy for our clients."
But, there is a downside to voice authentication, cautions Randall Frank, vice president and chief architect at the Fidelity Center for Applied Technology. Fidelity is "still tire-kicking" a range of biometrics securities, including voice recognition and scanning technologies like biometrics-based doorknobs, according to Frank. "The promise of biometrics remains enormous," he says. "It really offers another layer of security." Frank adds, "The key issue for us is getting them robust enough so they operate flawlessly over millions of customer transactions."
In the case of voice recognition, he says, a mere five percent failure rate might not sound like much, but across 1.2 million accounts, it amounts to 60,000 frustrated customers a day, which really concerns Fidelity. In addition, Frank says, there's an issue in trying to get 20 million clients enrolled.
Voice recognition operates best when there's no background noise, so the notion of using it with a computer and microphone is still wishful thinking, experts say. Vendors include Nuance; Vocent Solutions of Mountain View, Calif.; and Voicevault of Dublin, Ireland.
FINGERPRINTS: Each individual has a unique fingerprint. He or she simply places his or her finger on a device that scans it and compares the image to records held in a database to authenticate the user. Fingerprinting is often used for access to computing networks or buildings. Celent's Barry notes that fingerprint scanning is one of the most widely used biometrics systems. There are more than 50 vendors providing solutions.
Kevin Whyte, vice president of wealth management at TD Bank Financial Group in Toronto, which encompasses TD Waterhouse, says his firm uses fingerprint scanning to authenticate some of its traders. "It's a way to avoid multiple passwords," he says. "We're not talking about thousands of traders."
Celent's Barry notes, however, that it's a challenge to get the right detail and resolution from fingerprints, especially among those who work with their hands, such as carpenters. And using fingerprints can be costly, because users need access to a finger scanner.
Scanners cost about $100 and can be somewhat technical to hook up and use, which makes them difficult to deploy to a client base. Vendors include Identix of Minnetonka, Minn.; SAFLINK of Bellevue, Wash; and BioScrypt of Mississauga, Ontario, among many others.
HAND SCANS: Here, the user places his or her hand on a scanner, which measures such things as finger length and the curvature of a hand. Barry notes that while fingerprints are unique, handprints are not. The technology has been used primarily for access to physical spaces. Again, the issue is the cost of the devices.
Vendors include Recognition Systems of Campbell, Calif.; Diebold of North Canton, Ohio; and ABT Advanced Biometric Technologies of Dollard Des Ormeaux, Quebec.
IRIS AND RETINA SCANS: TD Waterhouse's Whyte says his firm uses iris scanners to grant employees access to sensitive data centers. Although it has been "relatively problem free," he says he doesn't believe there is an appetite to expand its use beyond the data centers.
Iris and retina scans are considered more invasive than other biometrics systems, and there are concerns about the privacy of such data. Celent's Barry says that iris scanning is one of the most accurate of the biometrics technologies. The scanner examines the iris and records up to 266 unique spots or data points.
Retina scans, which employ a light that is flashed into a person's eyes, are even more accurate, but the devices are costly, and there are healthcare concerns, Fidelity's Frank notes. A retina scan, he says, actually involves a low power laser that is shone into the eye, which tends to make people nervous. Frank says the problem with an eye scan is deploying it effectively and getting it to work quickly. Most people won't tolerate standing around while a scan examines their eyes, he asserts.
In addition, the position of the eye has to be directly in front of the scanner or the device could provide a false reading. The applications are not considered conducive to consumer deployments, though some bank machines use iris scanners. Vendors in this space include Iridian Technologies of Moorestown, N.J., and eEye Digital Security of Aliso Viejo, Calif.
SIGNATURE VERIFICATION: This technology analyzes a person's penmanship. It looks at things like pen stroke and how the writer dots the letter "i" or crosses the letter "t," as well as speed-of-hand and the amount of pressure placed on the writing instrument.
Acuity's Most says that this technology is good for opening accounts and in cases where people are physically available to sign things. She says Charles Schwab is piloting the technology.
The drawback for handwriting biometrics is that it is limited in scope and must be used with the appropriate sensing device, which means that it's confined to counter-type activity. Vendors include Communication Intelligence Corp. of Redwood Shores, Calif., and Interlink Electronics of Camarillo, Calif.
FACIAL RECOGNITION: This technology examines a person's face, looking at things like the distance between a person's eyes and the structure of his or her nose and mouth. It requires a camera, and if a person is not looking directly at it, there can be errors. Glasses and even skin color can also cause problems.
Vendors include Advanced Biometrics Security of Littleton, Mass.; Minn.-based Identix; and AcSys Biometrics Corp. of Burlington, Ontario.
Despite the growing pains of biometrics, many remain optimistic about the long-term potential of the technologies. Celent's Barry says spending on biometrics is expected to hit $1 billion by the end of 2004, up from only a few hundred million in 2001. There are an estimated 200 vendors offering biometrics solutions, and it is expected that computers of the future will contain things like cameras and finger scanners embedded into the keyboards, which will likely spur adoption.
TD Bank Financial Group's Whyte says the key to implementing biometrics isn't so much about integrating the technology into systems as it is about education and familiarity. "People need to be educated and comfortable," he says.
wallstreetandtech.com
Copyright (c) 2004 CMP Media LLC
hoovers.com
steve |
