Innovation in Biometrics Enables Alternative Payment Methods

Payments have been the major driving force for the wide-scale adoption of biometrics in the consumer market. Today, millions of customers (Goode Intelligence forecast 350 million plus during 2015) are using biometrics on a daily basis around the world to provide secure convenient user authentication and transaction authorisation and this theme is set to continue with a forecast of over three billion users by 2020. 

Biometrics for payments is increasingly a vital part of a payment service providers’ toolkit in the never-ending task of reducing financial fraud and ensuring that their customers can conveniently prove their identity and authorise transactions.

The adoption of biometrics for payments is also leading to wide-scale disruption in the payment industry, enabling alternative methods for consumers to pay for goods and services in a variety of payment scenarios. This is not simple replacing one authentication mechanism with another; the finger replacing the PIN. Biometrics is allowing alternative payment methods to be introduced, some of which are being supplied by non-traditional payment service providers. 

HYPR Corp has developed a biometric security protocol that provides digital payment platforms, including Bitcoin, with a solution to secure access to their digital payment assets.

One of the core security concerns around Bitcoin and other digital currency platforms is that unlike with credit cards, transactions are irreversible.

HYPR was founded to solve the core fraud problem by providing a definitive answer to the question of “Am I who I say I am?” 

HYPR answers the question of “Am I who I say I am?” through a three-factor authentication protocol that creates a biometric authentication bridge between the user and their mobile wallet. The cryptographic algorithm that HYPR uses is the same as the digital signature algorithm that the Bitcoin protocol uses. Because of this similarity, future iterations of the HYPR biometric security platform could be used to biometrically validate Bitcoin transactions.

Another company looking to secure Bitcoin transactions is Nymi with their heartbeat-enabled wearable band. The Nymi band can be used to store a users Bitcoin in a native biometric wallet with the private key tied to a unique ECG biometric signature. I recently demoed the capabilities of the Nymi band at a presentation I gave on the future of biometrics for wearables at the Biometrics 2015 conference in London. I even use the Nymi band to log me into my office computer and have been impressed at how natural it feels to allow me access to my computer. 

It is also enabling new ways in which consumers can use traditional payment methods, even cash (still the preferred payment type for many people). Hoyos Labs has developed a smartphone-based biometric authentication solution that aims to reduce the increasing amount of fraud at the ATM, negating the problem of bank card skimming. Their 1U ATM product is a software platform that allows bank customers to access their accounts via ATMs using biometrics on smartphones. There is no need for cards or for the customer to enter in a PIN at the ATM as the entire authentication occurs on the customer’s smartphone.

The Hoyos Labs solution is compatible with existing ATM platforms and does not need any hardware to be installed on the ATMs.

These are just three examples of how the latest biometric solutions are protecting payments and enabling alternative ways in which we can pay for a wide range of goods and services in a variety of payment scenarios; from Bitcoin to the humble bank note

I explore many more examples of biometric payments, including the rise of the mobile wallet, in an analyst report recently published by Goode Intelligence; "Biometrics for Payments; Payment Security Gets Personal". 

 

Biometrics for Banking Gets Going

I was talking with a senior manager responsible for authentication strategy at a leading retail bank recently about their views on biometrics for user authentication and whether they were thinking of adopting it. I remember a similar conversation with the same person in 2013 and remember them declaring that biometrics was simply not a possible solution for them; a combination of hardware and software OTP tokens was still the favoured solution. 

Moving forward two years and there has been quite a turn-around in their perception of biometrics for providing authentication to bank customers when accessing digital banking services. Biometrics is definitely on the agenda for them and they have a number of live and pilot projects that are leveraging biometrics on mobile devices including the support of Apple Touch ID for mobile app authentication. 

So what has changed in two years for them? 

I think the fundamental reason is the need for convenient privacy-aware authentication across a number of banking channels with the emergence of mobile as the prime banking channel (not forgetting the start of a wearable banking strategy). A hardware OTP token works well enough when a bank customer is accessing banking services from a desktop computer at home but simply does not cut it when that same customer is using their mobile phone or calling up their bank using a telephone-based service. These 1980s two-factor authentication technologies are also susceptible to Man-in-the-Middle (MitM) and Phishing/Malware attacks.

This has led banking security professionals to look for alternatives that meet the needs to strongly authenticate across a wide range of existing banking channels. The explosion of FinTech-led financial services has also meant that challenger banks are looking at other innovative ways that customers can interact with their banks; biometric authentication gives them the potential to offer their customers a usable and secure method to protect their financial assets when accessing financial services from a range of endpoints.

The use of integrated fingerprint sensors is just one method of providing convenient banking user authentication and will continue to grow as more devices become available. However, I believe that the solutions will evolve and increasingly incorporate other authentication factors and biometric modalities to provide strong security and convenience. For instance, by combining face and voice in a multi-modal biometric authentication solution that can work across a range of banking channels. USAA's recent deployment of Daon's IdentityX multi-modal mobile authentication platform is a great example of this. 

Depending on the context of the transaction/interaction then you can either use a single modality - voice in an IVR interaction - or a combination of modalities - face and voice for mobile or desktop banking services. The combination of context and security risk will dictate the most-appropriate modality or factor to use.

There has also been a lot of debate as to the choice of biometric architecture that a bank should adopt; device-centric, where the biometric data never leaves the device, or server-centric, where the user enrols their biometric and then is stored by the financial institution. For verification; the matching is performed on the device for the device-centric model and against a stored template within a network database (Cloud) for the server-centric model. I think that both models have their merits. I believe that the decision to adopt one over the other (and there will be scenarios where a mixture of both will be adopted) will be driven by a combination of privacy/trust requirements and specific business drivers (some of which will be moulded by culture decisions, i.e. availability of national biometric database). 

For on-device biometric authentication services, I believe that the best approach that meets privacy and trust requirements is to utilise embedded security within mobile devices; Secure Enclave for iOS and TrustZone in ARM-based devices. A great example of this is voice biometric specialist AGNITiO's KIVOX Mobile solution that leverages TrustZone embedded hardware security using a FIDO-Ready implementation developed by Nok Nok Labs. In this model, the bank customer would enrol their biometric voice print on their smart mobile device and then be able to access mobile banking services securely using their voice for authentication. AGNITiO also support the server-centric and IVR-based models ticking the boxes to support multi-channel banking. 

Apple's Touch ID has certainly changed the perceptions of the decision makers in banking security, allowing biometrics to be a serious contender in providing authentication for banking services. There is also a role that biometrics could play in reducing the amount of fraud that is occurring for Apple Pay. There seems to be no problem with Apple's biometric authentication services itself, rather a problem with the card activation (provisioning) process that allows fraudsters to enrol stolen credit cards into Apple Pay and then cash out by purchasing thousands of Dollars worth of Apple kit in-store. Biometrics could close this loophole by allowing the card issuer to validate a legitimate card and its owner using an enrolled voice biometric. Tied in with the card issuer's fraud management system, a customer who was attempting to enrol a credit card into Apple Pay would receive an automated voice call that could verify the legitimacy of the card holder by verifying an enrolled biometric voice print. I don't feel that it would add much friction to the process and have the positive result of reducing this type of credit card fraud. 

I expect to see a lot of innovation in this space where bank-controlled multi-modal biometrics will compliment integrated mobile biometric solutions that have been deployed by the mobile OEM to enable customers to securely access full-banking services from a wide variety of end points. 

Payments drives consumer biometrics and the push for enterprise

I was fortunate to be out in Washington DC last week (8-11 September) speaking at an RSA Global Summit on the future of authentication and presenting my research on mobile and wearable biometric authentication.

The Summit coincided with Apple's latest product launch on the 9th September and I was able to catch up with the announcements during a couple of breaks - unfortunately not aided by Apple's live streaming debacle that was at times verging on the ridiculous. (I particularly enjoyed the Chinese commentary and some severe editing that left out much of what Cook was saying. I got the applause but not the reason for the applause - perhaps that was Apple's corporate comms team in charge of editing?)

As well as a number of new hardware launches including bigger bolder iPhones and a watch....(will it support biometrics for authentication?). We saw Apple make a push into payments with 'Apple Pay'; using the Touch ID fingerprint system to provide authentication for payments (both online and physical). I have been watching Apple create the building blocks for this payment solution over the last couple years - Passcode, iBeacon, Passbook, Touch ID, Secure Enclave and finally NFC. Nice to see the finished solution.

As I said in a couple of interviews with the press last week, what Apple has done is not revolutionary; what it has successfully done is to cement a number of emerging technologies into a usable solution. This is backed by strategic partnerships with the world's largest retail payment  providers and links over 800 million global iTunes users to a mobile payments solution. And from a biometric authentication point of view, with Touch ID, it offers quite possibly the best user experience and the highest penetration of available mobile devices - a frictionless payment tool in a sleek piece of metal and glass. It will be interesting to see how it links other features such as loyalty, social and coupons to the payment app to make it any more appealing than using a plastic card - the value is not in the payment transaction per se.

By also opening up the Touch ID environment to third parties (Touch ID API) it allows other service providers (including financial services providers) to take advantage of this frictionless authentication solution. We have already seen announcements from MINT and Simple bank that they are utilising Touch ID for their mobile banking apps plus a proof of concept from Nok Nok Labs with a FIDO Ready solution. I expect that we will see many more announcements as the devices start to get in the hands of consumers (there is apparently pent-up demand for the latest iPhone from 4S and 5 users wanting to upgrade).

It is quite possible that the trend of Bring Your Own Identity (BYOI) may be accelerated as a result of Apple's Touch ID solution. All a service provider need do is to build an app that uses the Touch ID API and that's my authentication sorted - right?

Talking of FIDO, this year has also seen the world's two largest Internet payment companies, PayPal and Alipay adopt FIDO standards (through Nok Nok Lab's S3 Authentication Suite) to leverage mobile-based fingerprint sensors to provide the prime authentication solution for mobile payments (where the device obviously supports it).

Payments is definitely driving consumer biometrics.

So what about the enterprise? Are they ready to embrace BYOI and adopt authentication solutions for their employees and business partners? I think the answer is a guarded yes but it may take some time.

My time spent at the RSA Global Summit last week in DC was very informative in listening to the thoughts and opinions of enterprise users. Consumer is definitely driving innovation in authentication and this is taking its time to trickle down into the enterprise. In the main, they have BYOI and consumer-based mobile biometric authentication technology on their radar but also need some assurances that the trust, privacy and security models (there is obvious overlap between these three) employed by mobile device OEMs (including Apple, Samsung and Huawei) is good enough to meet security policy and industry regulation.

FIDO can help; by creating a user authentication standard fit for a modern connected world, ratified by some of the world's leading technology companies and service providers, organisations and end users can have a higher level of assurance that trust, privacy and security demands are met. FIDO has real positives in the 'first mile' of authentication but also needs connections to subsequent miles of the authentication and authorisation journey.

Enterprise users in particular demand comprehensive and integrated authentication solutions that combine convenient user authentication (probably on a mobile or wearable device) with other associated risk and security solutions including single sign on/federation, risk based authentication and risk management, business aware authorisation that is context aware and threat intelligence/threat analytics, That's potentially a lot of integration work!

Please free to leave a comment on this blog - I am always interested in receiving feedback and openly discussing this fascinating topic.

Thank you, Alan.

Touch ID - The Cornerstone of Apple's Authentication Framework

This is an extract from an upcoming Goode Intelligence Analyst Report entitled "Mobile & Wearable Biometrics for Authentication Applications"

Apple caught much of the analyst and biometric community by surprise with the announcement that it was to open up its Touch ID fingerprint biometric environment to third-parties using an API at its annual developer conference, WWDC2014, on 1 June 2014.

Apple announced that once iOS 8 launches (possibly September or October 2014) third party developers will be able to access the Touch ID environment and leverage the benefits of mobile fingerprint biometrics.

During the presentation given by Apple's SVP Craig Federighi, Apple referenced Touch ID being used to authenticate into a personal financial application called Mint.

Apple’s Touch ID Local Authentication Framework (LocalAuthentication.framework) will enable third-party app developers to make use of Touch ID and benefit from its convenient personal authentication features.

Touch ID has been a great success for Apple; Apple also announced some stats for its Passcode phone unlock feature at WWDC. 83 percent of users were turning on the Passcode phone lock feature compared with 49 percent of general iOS users. That equates to millions more iOS devices being protected against unauthorised access and a great deterrent to theft.

Apple has been steadily building up its product and software portfolio to offer a wide range of connected services and it appears that they intend to use Touch ID as the foundation for identity verification on the Apple ecosystem.

I believe that Touch ID will be used to authenticate in the following scenarios (some of these are available now and some are predictions):

• To replace the PIN for Passcode (device unlock)
• To provide authentication for Apple ID (iTunes purchases)
• To verify identity for an Apple payments product (both for online and physical store purchases)
• To provide authentication for Apple’s CarPlay in-car service
• To verify identity for Apple’s mobile healthcare solution “Healthkit”
• To provide authentication for Apple’s connected home solution “Homekit"
• This includes  the ‘Secure Pairing’ feature where only authorised users can unlock a home door or change the temperature of a room via a smart thermostat

Apple’s vision is to merge the logical and physical worlds using an iDevice (iPhone, iPad or even iWatch) as the smart controller with Touch ID providing convenient biometric authentication for this uber connected world. 

Bring Your Own Finger - The Consumerisation of Biometrics on Mobile Devices

Firstly, let me apologise for jumping on the BYO bandwagon. I did grimace a bit when writing it but in a way it is rather apt. Biometrics are always with you and you do bring them with you; to the shops, to work, when travelling.....

That's what makes them a very attractive proposition for identification purposes. With the ever-growing list of super-long passwords that we are required to use for an increasingly long list of digital services, the search for an agile method for securely identifying people has been the Holy Grail for some time. Link that with the move towards accessing digital services on mobile devices and you have a situation that creates a perfect environment for easy-to-use, convenient, authentication and identity verification services.

Without even considering the rush by mobile manufacturers to embed fingerprint sensors into their latest smart mobile devices, mobile devices have many sensors that can be leveraged for biometric identification purposes. Cameras (front and rear with the support to capture HD video, high quality microphones, accelerometers for behavioural biometrics etc.

In my latest report for Goode Intelligence, "Mobile Biometric Security - Market Forecast Report 2013-2018", I have revised the forecasts from the original report, published in June 2011, to take into consideration the rapidly changing landscape. My research into this sector has discovered that in the last two years the following factors has created an environment that will create a market that is worth US$8.3 billion by 2018:

The Consumerisation of Biometrics: Apple has changed everything and has again disrupted a market and rebranded biometrics as a convenient method of communicating with consumer technology. Previously, Biometrics has largely been associated with high-end security; border control, national ID solutions and for providing access control for high-security buildings. This has all changed with the Apple iPhone 5s and Touch ID

Convenient mobile device protection: Existing mobile device authentication is cumbersome and inconvenient.  This means that many devices are left with no protection. Replacing a PIN or Passcode with an easy-to-use biometric can reduce this burden

 Mobile Commerce: Mobile devices have become the prime method of carrying out digital commerce yet identity verification and payment authorisation has not yet been updated to match this form factor. Biometrics can offer a convenient and secure method to prove identity and to authorise payments

As part of a multi-factor authentication solution: Most of the major authentication vendors support, or have plans to support, biometrics in their authentication products. This will be supported by authentication standards initiatives such as the FIDO Alliance that will enable biometrics to be easily utilised, when available, on mobile devices

Mobile devices are getting more secure: Apple’s Touch ID fingerprint solution makes use of a ‘secure vault’ to ensure that the fingerprint templates are stored in a secure area of the hardware. It is thought that Apple is leveraging ARM’s TrustZone, a hardware-security environment for secure storage and trusted execution. Security services are being built into all mobile platforms to counteract malware and to protect sensitive information and transactions. Complimentary services such as Mobile Device Management (MDM), Secure Containers and Mobile Application Management (MAM) create a trusted platform to support biometric security on consumer mobile devices

iPhone 5S Touch ID - What Apple announced (how much did I get right)

AT 10am EDT yesterday (10/09/2013) Apple held their latest event to announce two new iPhones (iPhone 5S and iPhone 5C) and the latest version of iOS (iOS 7). The event coincided with my attendance at a school information meeting. I thought it wise not to follow Twitter on how the event was progressing even though I was itching to find out whether the fingerprint sensor had made it to the phone - besides, the school hall has awful mobile reception.

The previous day (09/09/2013) I wrote a blog making predictions on how Apple would utilise the fingerprint sensor. So how did I do?

First, let's take a look at what Apple announced yesterday.

What Apple Announced?

Source: Apple

Along with a faster processor and the next version of iOs (iOS 7) Apple announced the fruits of their AuthenTec acquisition, Touch ID - "a new fingerprint identity sensor". In other words an optical fingerprint sensor embedded underneath the Home button of the iPhone 5S.

In a video released to coincide with the announcement, Apple's chief design guru, Jony Ive, emphasises that Touch ID is more about convenience than security by saying that it "enhances the user's experience" and "is the next step in using your iPhone" as well as "protecting all of the information" held on the phone.

Touch ID will have two functions at lauch:

1. Unlock the phone (iPhone Passcode replacement)
2. Authenticate into iTunes (Apple ID Passcode replacement)

How does it work?
Once a user has enrolled (a user can enrol a single or multiple fingers) with Touch ID they can then replace the Passcode to unlock a locked device with the touch of their enrolled finger(s). One of the issues of previous smartphones with embedded fingerprint sensors (including the Atrix 4G) was a lack of other supporting functionality outside of the unlock phone feature. Apple have taken a positive step forwards by also allowing the fingerprint to provide authentication for iTunes payments - replacing the Apple ID password with the fingerprint. Is this the entry point (or pilot) for Apple's fingerprint-authenticated mPayments and will Apple store payments come next?

Technology
As with any embedded fingerprint sensor the service is a combination of hardware and software. The new Home button is made from sapphire crystal that both protects the sensor and acts as a lens to enhance the fingerprint. A steel ring has been inserted surrounding the button that detects the finger and wakes up the sensor (probably saves the battery). The optical sensor takes a high resolution image of the print (taken from the subepidermal surface of the skin to counteract damaged  and ageing epidermi). The captured image is then compared with the stored template that was captured during the enrolment process.

Is it secure?

According to Apple, all fingerprint information is encrypted and stored securely in a 'Secure Enclave' on the new A7 chip. Details of this process have not yet been released but I am guessing that a unique key is used for this encryption. There is also mention on whether the hardware protecting the template is FIPS 140-2 compliant. 

Dan Riccio, SVP, Hardware Engineering, Apple, has stated that the template is "never accessible by other software, never stored on Apple's servers or backed up to the iCloud". Expect to see these these claims coming under the microscopes of security researchers eager to test out this latest piece of security kit.

No security is 100% secure and optical fingerprint sensors are no exception. There have been a number of well-documented replay and relay attacks on sensors that can circumvent the security or the security process that supports the sensor. I am pretty sure that Touch ID will be successfully targeted and we will see the tech and national press quick to highlight the security failings of Apple's flagship iPhone. The question is whether these attacks can be replicated by the average thief  (hundreds of iPhones are stolen on a daily basis). Are we also going to see phone thieves force their users to unlock their devices with their fingerprints or even chop off a finger, as Lookout Mobile Security's Marc Rogers suggests in this interview with the Mirror newspaper. Possibly, but it will be tricky for a violent thief to do this as which finger has the user enrolled? However, if this does happen than it could end up being a PR disaster for Apple.  

It is also interesting to hear Apple emphasise features such as convenience and user convenience, not security or theft deterrence. If Touch ID is accurate and speedy, iPhone unlocks and iTunes transactions will be performed at a faster rate than those performed by password-verification. 

Did I get my predictions right?

Yesterday I predicted that:

• Apple would release an iPhone with an embedded fingerprint sensor contained in the home button
• The main uses of the fingerprint sensor would be:
• To protect the device (phone unlock)
• Link to iTunes for authentication
• Enable mobile payments using the iTunes account at Apple stores
• It wont be opened up to third party developers at launch

4 out of 5 isn't bad and I feel that if there is a positive reception from iPhone 5S users to Touch ID then Apple will look to other services being included in the service and one of these will be mPayments at physical stores. 

I am also confident that we will see this technology embedded within other Apple devices including both the iPad and the iPad mini.

How many iPhone 5S's will Apple sell and what does it mean for the mobile biometric market?

There is a feeling that the lower-priced iPhone 5C will sell more than the Touch-ID equipped 5S but how many units will Apple shift? On its launch last year the iPhone 5 sold more than 5 million units in its first weekend. The last official figures from Apple for Q3 2013 stated that 31.2 million iPhone were sold around the world (that's going to be mixture of 4's, 4S's and 5's).

Based on these figures I am estimating over 20 million iPhone 5S units will be sold around the world by the end of Christmas 2013 - that's a lot of fingerprint sensors. That's more mobile fingerprint sensors than AuthenTec had shipped before being sold to Apple.

Back in 2011 I forecast that there would be 19.4 million mobile devices shipping with embedded fingerprint sensors by 2015. Apple are probably going to blow that forecast in a single quarter.

As a result of this momentous news for the biometrics industry I am going to revise the forecasts from 2011 and publish these in the coming weeks. I feel that Touch ID will have a direct impact on the biometrics industry in general and in particular the mobile biometrics industry. Other mobile phone manufacturers will probably follow-suit with similar solutions, not just fingerprint. Apple also acquired a lot of  fingerprint IP when they purchased AuthenTec. This may well restrict what other mobile device ODMs can do with embedded fingerprint sensors.

One this is for certain, the Apple announcement yesterday will propel biometrics into the mainstream. This knock-on effect will not just be for fingerprint sensors but for many other modalities including voice, facial, eye (iris and retina) and other emerging ones such as heart rhythm and behaviour. Linked to attempts to standardise authentication and identity verification (notably The FIDO Alliance) and the movement of identity services to the cloud will bring about a revolution in how we authenticate and identify ourselves for digital services across multiple endpoints (Remember the smart phone is part of a constantly evolving cycle of technology innovation and we are at the beginning of the start of another one - wearable computing).

It is certainly an exciting time for those of us that work in the security and authentication industries.

Alan Goode - September 11 2013

iPhone 5S Fingerprint Sensor: What I think Apple will do with it - it's not just about security!

I am writing this blog a day before Apple's September 10 event where it has been widely predicted by journalists and analysts alike that Apple will launch the next generation iPhone with an embedded fingerprint sensor (EFS).

So how will Apple use the fingerprint sensor?

I have been covering this market for many years now (Goode Intelligence published a report in June 2011 investigating the market for mobile biometrics) and spoke with the team at AuthenTec (Fingerprint Sensor manufacturer) before they were acquired by Apple.

I am currently working on a number of projects for Goode Intelligence that cover this market, a report investigating the market for mobile authentication and identity verification  that covers biometrics and a report taking a look at the security of wearable technology and how it can be used for authentication purposes.
As part of this research I have talked to many biometric technology vendors, including fingerprint sensor manufacturers, buoyed by Apple's potential move in this area. All of them indicate that Apple will tomorrow launch an iPhone with a fingerprint sensor. I share this prediction - it may come back to haunt me tomorrow when we see an iPhone with no sensor - perhaps its an iWatch with a fingerprint sensor!

I predict that Apple could make use of the embedded fingerprint sensor (probably an optical EFS) in the following ways:

Protect the device
My last smartphone was an Android-powered Motorola Atrix 4G - I think I may have been one of the few owners in the UK. It was not a bad smartphone, OK it ran a pretty old version of Android but I could live with that because it had an embedded fingerprint sensor integrated into the rear of the phone doubling up as a power button (see below) - sound familiar? What I loved about this phone was the ability to unlock the device by using the fingerprint sensor (supplied by AuthenTec).

After a pretty simple enrolment process I could use a fingerprint swipe to unlock the device and in approximately 90% of occasions it worked first time. I regularly travel into London, commuting on public trains and tubes and by swiping the sensor with an enrolled finger I could avoid any potential passcode shoulder surfing - a real deterrent against theft.

What I didn't like about this phone, and this is a lesson for any ODM thinking of embedding a biometric sensor into a phone, was the lack of a supporting ecosystem. By using the lock feature, I could conveniently protect my phone from unauthorised use but little else. Motorola, and this is the same mistake made by other fingerprint sensor manufacturers who have sold to laptop and netbook OEMs, didn't create the supporting ecosystem (APIs or SDKs) that could be utilised by other stakeholders, such as third-party app developers and service providers. No one, outside of Motorola, could utilise the benefits of the sensor.



So enough about Motorola, let us turn to Apple. I believe that Apple will launch with a fingerprint-enabled unlock feature on the iPhone 5S users. To protect this device in a similar manner to the Atrix 4G by unlocking the iPhone by use of  an enrolled finger swiping on pressing the iPhone home button. The iPhone 5S stroke - coming to a train near you soon!

eCommerce
The second feature that I feel will be fingerprint-enabled from tomorrow will be the ability to use a fingerprint in iPhone initiated eCommerce transactions. The iPhone as a payment method. Perhaps without needing NFC (for now anyway).

Apple has become not only a successful computer manufacturer but a very important retailer of digital media. Earlier this year (June 2013), Apple CEO, Tim Cook, announced the there were 575 million registered iTunes accounts around the world. Accounts do not equate to unique users but even so we must be talking of half a billion people who are iTunes users and who have registered their credit cards with Apple.

These 575 million iTunes accounts have downloaded a total of 50 billion apps from the app store and paid for billions of dollars of digital content including films, music and books. According to CNNMoney iTunes generated $12.9 billion in 2012. These figures detail the importance of Apple as a very successful retailer, both on-line and physical (There are a reported 413 physical Apple stores located in 14 countries).

Like any successful retailer Apple will suffer from financial fraud and there have been reports of fraud affecting Apple iTunes. By adding the requirement for a second factor (what you are - your fingerprint) in combination of what you have (the iPhone), fraud surrounding iTunes transactions (for iPhone 5S users) could be significantly reduced.

Fingerprints could also be used to protect Apple's wallet service, Passbook. Apple's vision is to have Passbook as a secure wallet service that contains valuable digital files, boarding passes, loyalty cards, event tickets and retail coupons. A convenient and secure method to protect this valuable information would be to fingerprint-enable Passbook.

Passbook may also be turned into a payment tool. I predict that we will see Passbook being used as a mPayment tool with the user's fingerprint being used to unlock the wallet and then to authenticate transactions. Initially I believe that this will be used (think of it as a pilot) in Apple stores. It could work like this. I am browsing in my local Apple store and I would like to purchase a new MacBook Air. I take my iPhone 5S out, open up the Passbook app and authenticate using my fingerprint. I choose the payment feature and this activates the barcode scanner. I scan in the barcode for the Air and press the 'Buy' button. It asks me to verify my identity and I scan my fingerprint (possibly also entering in my Apple ID passcode, although this may be a bit clunky for a physical store). It verifies me as the account holder and then initiates the transaction (checks whether I have the funds and goes through the fraud management system). Happily for me, and for Apple, I pass all the checks and it sends down a receipt to the phone (contained in the protected Passbook). The receipt could contain a barcode that a retail assistant could check before handing over my lovely shiny new gadget. It could work - quick, convenient and pretty secure.

Will it be open?
In conversations I have with technology vendors working in this space I am always asked my opinion on whether Apple will open up the sensor for third-party use (The authentication vendors may be secretly scared of having their business model disrupted by Apple - not the first and definitely not the last). My answer is a qualified no. Apple's history has been to keep its technology within its garden walls and not to open it up. I believe that any low-level authentication SDKs and APIs that directly call the sensor will be shut off from third-party access. It may wish to add some high-level functions to its iOS development library that make use of the sensor for payment and in-app billing features but, at least for the short-term, I would be surprised that they open it up to authentication vendors.

What may happen is a replication of a trend that we are seeing for consumer end-user authentication. The quasi-federated model where a large, trusted, internet service will provide authentication services on behalf of a third-party service provider. For instance, I can choose to authenticate into my Spotify account using my Facebook ID. Facebook have become the broker for my identity (This also includes Google). Apple could offer a similar sort of service using the fingerprint sensor as part of the response to the challenge. Widen its network, gather vital user intelligence and increase its sphere of influence through identity verification services.

To sum up
I know we have been here before (NFC), but I believe that a piece of security kit that has been hidden away in high-security buildings and been collecting dust on laptops around the world will get the Apple magic tomorrow and Apple will make it work. It is being driven by a combination of convenient security and a desire for Apple to benefit from half a billion credit card owners by enabling iPhone initiated payments at physical stores.

This will have a direct impact on the biometric industry and will propel biometrics into the mainstream.

I welcome any feedback from this blog (including typos and factual corrections).


Disclaimer: This is my personal viewpoint and does not reflect those of my employer, Goode Intelligence.