Face verification can better secure ATM transactions, although new risks may emerge: Experts
SINGAPORE: Facial recognition technology being enabled at ATMs can help to speed up transactions and resolve long-standing issues such as the misuse of physical ATM cards, experts said.
But they also cautioned that the adoption of any new technology may come with its fair share of risks and that novel safeguards will be needed.
OCBC, Singapore’s second-largest lender, said on Thursday (Mar 18) that it will be enabling face verification for bank transactions at its ATMs.
The new feature started on Thursday, allowing customers to check account balances at eight selected ATMs. It will be extended to cash withdrawals at all 550 OCBC ATMs in Singapore “progressively” from June.
More services, such as cash deposits, fund transfers to other banks, cash card top-ups and credit card bill payments, will be included from next year.
OCBC said it is the first lender in Southeast Asia to introduce facial biometrics to its ATMs.
It added that this also means it is a step closer to eliminating a physical ATM card, which can be stolen or skimmed. The latter is the act of intercepting bank card details using a small device installed on ATMs.
ATMS NEED TO EVOLVE
Facial recognition, which works by scanning someone’s face and matching it with a database image, is already widely used for purposes such as unlocking smartphones.
Being a part of verification at the ubiquitous cash dispensers is also not new, with such services being introduced by several Chinese banks from as early as 2015, according to local media reports.
Spain’s CaixaBank has also been allowing customers to withdraw money from ATMs just by scanning their faces. It started off with 20 ATMs in early-2019 before embarking on a nationwide roll-out last June.
Singapore is “well positioned” to have ATMs enabled with facial recognition technology due to the existence of a national biometric database and other factors, such as banks having their own risk management frameworks and strong law enforcement, said Mr Jeffrey Kok, vice-president of solution engineers for Asia Pacific and Japan at CyberArk.
Singapore residents have also become more comfortable with biometric authentication methods, such as fingerprint and face recognition, which are emerging as “the new normal”, said Mr Kanv Pandit, group managing director for banking solutions in Asia Pacific at FIS.
“This is unsurprising as consumers cement their preferences for a quicker, more convenient and contactless experience when it comes to banking or paying, especially during the pandemic,” he added.
ATMs must also keep up. A recent report by FIS found that cash remains one of the most popular payment methods for purchases in Singapore, accounting for more than a quarter of transactions in 2020.
Mr Pandit said: “As long as cash continues to fill consumers’ needs, ATMs remain a critical delivery channel in Singapore. While in no danger of disappearing, ATMs must evolve to address challenges such as fraud, principally, skimming.”
Apart from quicker transactions, the key benefit of enabling face verification at ATMs is better security as it removes the need for a physical ATM card and PIN.
This reduces the likelihood of unauthorised transactions due to stolen cards or hacked PINs, experts said.
“Biometric authentication such as fingerprint or face recognition relies on attributes of your identity that are a lot less likely to be compromised. This helps banks ensure that the authorised account holder is the one making the withdrawals," said Mr Pandit.
Echoing that, Mr Kok noted that ATMs are “a great use case” for facial verification and recognition technology.
“The technology increases usability, convenience and adopts a very modern approach to address a legacy problem,” he said, as scammers will find it harder to “copy” someone’s identity.
“Facial verification removes many avenues of attack and improves security while also making for a better user experience for the end-user,” he added.
That said, new technology can bring about other risks, meaning that novel mitigation methods will be needed.
For one, criminals are stepping up efforts to manipulate and bypass facial recognition systems through the use of “deep fakes”, which rely on artificial intelligence to alter a person’s image, said Mr Pandit.
The technology on its own may not be foolproof either.
“Studies have uncovered instances where a facial recognition system cannot accurately distinguish between similar-looking faces, such as in the case of twins or siblings,” Mr Pandit added.
Mr Kok said that all biometric technologies have “accuracy settings that impact the likelihood of false positives and false negatives”.
“In the case for ATMs, settings would most likely be tuned to its highest accuracy which means low false positives but higher chance of false negatives.
“This means that legitimate users will have a higher chance to fail the facial verification if there has been significant alteration to their faces, for example facial surgery,” he added.
While such possibilities may impact consumer confidence, Mr Kok noted that these “should not be concerns” as banks have always taken a multi-layered approach to managing risks, such as falling back on other verification methods like mobile phone notifications and existing surveillance methods deployed at ATMs.
Banks have also generally taken a “gradual” approach to allow more banking options enabled by new technologies as consumer confidence grows, he added.
Mr Pandit said banks can enhance security through the use of dual factor authentication, which includes one-time passwords. They can also combat fraud through alert systems such as notifying customers via SMS when a transaction has been made.
WHAT BANKS ARE DOING
OCBC said that it is tapping on the SingPass Face Verification technology developed by local authorities to verify customers for banking transactions at its ATMs.
To enable face verification at an OCBC ATM, account holders will first select their preferred ATM service before entering their NRIC number on the screen.
They will be prompted to position their faces within a frame on the screen. A web-enabled camera will then do a scan and verify it against the facial images and identities of 4 million Singapore residents stored within the national biometric database.
The verification is done in real time as the bank’s ATM network is digitally linked to the database, OCBC said in its press release. Other security features are also in place to prevent fraud, such as liveness-detection technology to detect and block the use of photographs, videos, or masks during the verification process.
Only verified customers will be allowed to proceed with their ATM transactions.
DBS said its customers have also been using the SingPass Face Verification feature to apply for digital bank accounts since July last year.
“This has proven to be popular as our retail customers can apply for digibank access in less than three minutes while corporate customers can access their new corporate accounts online in about 20 minutes from the point of application,” said its Singapore country head Shee Tse Koon.
To date, more than 25,000 customers have used the SingPass Face Verification, with most of them using the feature to securely retrieve their digibank user credentials.
DBS said it will continue to explore ways to expand the use of face verification and emerging technologies in its digital services and self-service machines.
READ: Face verification technology to allow SingPass holders to sign up for DBS digital banking services using a selfie
As for UOB, there are no plans to roll out facial recognition at its ATMs at the moment.
“Amid the prolonged pandemic, our customers’ safety is our priority. To use facial recognition at ATMs means that customers have to remove their mask in public to scan their face,” said the bank’s head of group channels and digitalisation Janet Young.
“We will continue to study the needs and preferences of our customers to provide them with a safe, reliable and relevant banking experience always.”
Ms Young added that almost all of the bank’s ATMs are contactless at the moment.
Customers can make cash withdrawals without a physical ATM card by adding their bank cards to their mobile phones, and tap their devices on the ATMs before keying their PIN.