Biometrics in payments: Insights, Trends, and Innovators in Southeast Europe

by Etien Yovchev

Imagine...

…all you need to make payments is your face. No cash, no bank cards, no PINs to remember, no limits. And at the same time, your money is securely tied to your unique identity. Actually, no need to imagine as transactions that require nothing more than a quick biometric authentication are no longer a talk of the future. They’re already here and there’s a lot of innovation in the space aimed at making them faster, cheaper, and safer. 

Even more interestingly, a small but decent fraction of this innovation is happening in Southeastern Europe (SEE). For instance, we have the Romanian startup PayByFace, a company, which has enabled selfie checkouts at a double-digit number of stores and restaurants in Romania, and since recently, a coffee shop in the headquarters of Raiffeisenbank Bulgaria. Following his participation in the Visa Innovation Program in Sofia, founder and CEO Mihai Draghici has plans to scale across Europe and maybe one day even bring biometric payments to space. It will likely be a very long journey before we see PayByFace’s logo on a rocket to Mars but Draghici’s business is not an isolated Eastern European example of how biometrics can disrupt the finance industry. TypingDNA is another success story coming from Romania –  funded by Google, this venture has implemented its behavioral biometrics fraud prevention technology in a mobile app of BBVA, one of the world’s largest banks. Bulgaria is home to Alcatraz AI, which, with over €11 million in raised capital, develops 3D facial authentication systems to help financial institutions make cash vaults and data centers more secure. 

That said, it’s still early days for biometrics in the payments industry – not only in SEE but also on a global scale. While pilots are launched one after another, most use cases are still figured out and multiple stakeholders along the value chain are yet to discover the benefits of biometric payments, how they really work, and what are the trends shaping the future applications for shoppers, retailers, banks, and society in general. Biometrics have the potential to completely transform how we all move money around, but with that, we also shouldn’t forget important factors like the role of regulators, topic education, and privacy-driven system design.

The Case for Biometrics in Payments

In recent years, biometric payments have been increasing in popularity to the point where in 2020, they’re no more a concept in a science fiction movie but something that brings tangible value for all stakeholders within the world of payments. A report from Research Nester estimates that the global biometric payments market may grow up to 36 times between 2018 and 2027, reaching a total opportunity size of over €13 trillion. Furthermore, according to a study by the Economist Intelligence Unit and TransUnion, 85% of global executives think that biometrics ‘will likely be used to authenticate the vast majority of payments within the next ten years’.

There are a number of trends that drive the growing adoption of biometrics in the finance industry, including the market demand for frictionless transactions, industry regulation, rising focus on fraud prevention, and, last but not least, the emergence of smart devices (mobile and IoT) that change how people interact with brands and each other. On top of all this, the ongoing pandemic has further accelerated the notion that there might be better and more efficient ways for payments to be made. 

Explore Biometrics
in Payments

Biometrics basics

Broadly speaking, there are several ways we can categorize biometrics in payments. Obviously, one is by the identity trait being used – fingerprint, face, voice, iris, vein patterns, or even behavior.  While the way the individual data is collected varies, regardless of the method, the biometric sample gets converted into a template, which is then compared to match other algorithms in a database. In the end, the matching algorithm calculates the probability of whether the individual is the one that says she or he is. 

Another categorization approach is according to where the personal data is stored. Some regions like India have a centralized cloud system where the universal identity of a person is linked to support payments. In other places with more focus on privacy and data protection such as Europe, the biometric data is stored on the user’s device – be it a phone or a payment card. 

Analysis by Thales notes that no matter the method, biometrics have several big advantages when it comes to authentication, as they are:

  • Universal: can be found in (nearly) all individuals
  • Unique: no two fingerprints or faces are the same
  • Permanent: don’t change over time
  • Measurable: which allows future comparison
  • ..and last but not least – hard to forge
Source: Visa 2017 Biometric Study

The rise of contactless transactions

88% of bank executives share the sentiment that the contactless payments transactions will be their main priority in the years to come, as nearly 1 in 5 payments are already made with contactless cards, according to Fingerprints. In light of the global Covid-19 pandemic, the World Health Organization and various governments are also recommending contactless payments instead of cash where possible and consumer adoption is growing faster than ever.

As per the latest data by Visa, as of September 2020, over 80 percent of face-to-face Visa payments are now contactless. While already quite popular, this method carries the risks of fraud – if a  contactless card is lost or stolen, almost nothing stops criminals from using them to buy stuff without providing a PIN. This ‘almost’ is called a payment cap – you can rarely spend more than 50 euro without being asked for a PIN, which is also not great from many perspectives – time, hygiene, and having to remember it, to name a few. One older research by Visa discovered that while 74% of consumers in the UK have a contactless card, only 46% use it, and 55% don’t think it’s secure. 

 

The PIN challenge may seem more insignificant but nowadays end users are often overwhelmed by the number of passwords they have to remember. There’s also the additional inconvenience that may result in abandoned purchases at checkout. Non-trivial costs are also involved. A study by Alte Group from 2016 found out that ‘the implementation cost for requiring PIN on all transactions (in the U.S.) is estimated to top $2.6 billion for issuers and $4.5 billion for merchants’.  It is likely one of the reasons for the recently bigger popularity of contactless payments with banks. 

In summary, there is the trade-off – lower PIN-less limit results in higher inconvenience for consumers, higher limits are great from a user experience perspective but also go with higher rates of payment fraud. Moreover, the PIN itself can get stolen. Biometrics can be used to break this seemingly stalemate situation and examples in Europe are not missing. Earlier in 2020, French bank BNP Paribas rolled out a Visa card with fingerprint-recognition technology that made it possible for customers to make contactless payments of higher value.

Towards financial inclusion

One often overlooked, but a critical issue is that standard and even more innovative digital payment methods lead to the financial exclusion of about 15% to 20% of the world’s population. According to various sources, around 1 billion people still don’t have an official ID, a document usually required if you want to have or operate a bank account. In addition, UNESCO data from 2017 reveals that about 750 million adults around the world remain illiterate. Not being able to read or work with numbers is certainly a big blocker to doing any payments – no matter card or digital. Last but not least, nearly 50 million people around the world live with some form of dementia and it is fairly difficult for them to remember PINs or passwords.

“Whilst many of us take our bank accounts for granted, without one, the ability to engage in the economy and wider society is virtually non-existent. There are limited ways to pay bills, a lack of consumer protection, limitations on employment, zero credit record, and very few lending opportunities,” states Stan Swearingen, CEO of IDEX Biometrics, another European company with a long-history in fingerprint imaging and fingerprint recognition technology.

Advanced biometric authentication can create the conditions for the financial inclusion of all that are currently unbanked. Consumers can be linked to a payment account directly through their unique fingerprint or face patterns –  eliminating the need for a government ID (which itself is often subject to fraud) and lowering the barriers in front of users who face challenges with literacy or memory. 

 

Biometric payment terminals have also been gaining traction in developing countries without existing payment infrastructure. “In India, where biometric identity schemes are bringing the unbanked into the financial system, this type of device has high potential,” explains research author Susannah Hampton.

One of the big enablers for India’s biometric payment system is the so-called ‘Aadhaar’, the world’s largest biometric ID system. In practice, Aadhaar is a 12-digit unique number that takes into account a person’s biometric details such as iris scan and fingerprints, next to demographic information such as the date of birth or address. So, consumers in India can make payments using this number and verification at point of Sale (PoS) or micro ATMs . In July 2019, the Aadhaar Enabled Payment System, which is aiming to bring financial inclusion for the rural part of India, reached the milestone of 200 million monthly transactions. While the mechanism has faced some technical glitches in the past and still requires Internet connection that’s not always present in remote areas, millions get to receive services that otherwise wouldn’t have been available.

The future of payments is digital...

…Customer identification is still needed, though. Moving away from physical cards altogether for a second, more and more consumers have a preference for a fully digital account opening.  According to research by FICO, 32% of consumers in the UK say they would abandon an application process if forced to take action through a non-digital channel. Yet, half of UK banks still force them to do so for verification purposes. A separate 2020 research by Signicat, states that ‘European financial institutions lose almost two-thirds of applicants during onboarding’ and ‘One in five abandonments are due to a lengthy and complicated onboarding process’.

Customer experience is one of the sure things that will play a large role in the future of payments and if banks are to compete successfully with fintech challengers maybe biometrics can be the answer. Mobile-first Revolut with its 12 million customers has been using fingerprint and facial verification for some time now, while on the bankside in 2019, Barclays introduced a device for digital corporate clients that identifies users by scanning their unique finger vein patterns. 

Providing a unified customer journey has so far been a big challenge for the majority of banks and traditional financial institutions. That said, it’s true that the design of an experience that’s both frictionless and compliant is not that easy.

Regulation driving innovation

Building on the previous points, factors like secure authentication, accelerated digitalization, and customer experience have also proven fundamental when it comes to regulation efforts. There are two main types of regulation that have shaped the future of biometrics the most – one is on an EU level, and the other comes as a result of the Covid-19 pandemic.

On the first aspect, in an attempt to reduce fraud and increase trust in the payments sector, PSD2’s Strong Customer Authentication (SCA) has pushed institutions and merchants to implement multi-factor authentication. This means that a user should be authenticated by at least two types of the following ‘factors’ – ownership (something that the user has, for example, a payment card, token, or a smartphone), knowledge (something that the user knows or remembers such as a PIN code or a password), and inherence (something that the user is, for example, a fingerprint, face, voice, or behavior). This, of course, needs to happen without ruining the user experience or annoying the customers to the point they don’t want to make payments. Once again biometrics present the combination of highest security combined with least friction. In some cases, like with behavioral biometrics it all happens in the background – how are users moving the computer mouse, how fast do they type or where do they click – any deviation from the norm can alert the payment provider of possible fraudulent activity. 

The Covid-19 pandemic has also motivated various governments to quickly enact laws and policies that enable digital and remote commerce. For example, Greece, North Macedonia, and Turkey all approved remote bank account openings in 2020 – and often biometric verification is probably the best way for onboarding digital customers in a safe and compliant manner. Again, we go back to the question: How do you do that without exposing the user and the bank to cybersecurity crime. The very same pandemic has also shown numerous problems financial institutions have with technical and security infrastructure, so biometrics by themselves won’t be enough, not without proper data privacy laws. 

The future of communication

Another factor that is likely to boost the growth of biometrics is the growing adoption of new communication mediums such as voice-controlled IoT devices or Virtual Reality (VR), both of which are changing the way people interact with the world.

Once again keeping in mind the balance between convenience and security, biometrics support effortless authentication and payment authorization in quite the natural manner when it comes to talking to your smart speaker or making a purchase during a VR game. According to a study from OC&C Strategy Consultants, the value of voice-based payments is set to explode from $2 billion in payment volume per year for 2018 to $40 billion by 2022. And, while biometrics may sound like a breakthrough technology from the future, it’s actually already an active part of our lives. Biometric technology has already been adopted by hundreds of millions of smartphone owners and Juniper expects that their number will increase to 1.5 billion in the next three years. Fingerprints are the new passwords – be it for unlocking a phone or making a mobile payment. Many of the big technology players are adding some sort of biometrics to their devices  – Apple’s facial recognition Face ID has been adopted by Singapore’s banks OCBC and HSBC. Samsung’s iris scanning technology has been implemented for user login by financial service providers, while Google’s BiometricPrompt API supports different biometric authentication methods for mobile payments, including Google Pay.

Building a facial biometrics payment business in SEE

Started by serial entrepreneur Mihai Draghici, PayByFace has already launched biometric facial recognition-based payments in Romania and a pilot in Bulgaria and is moving towards integrating its service with card processing providers in France, the Netherlands, and Switzerland. PayByFace’s contactless payment system enables shoppers in retail stores and restaurants to complete transactions just by looking at a screen for a couple of seconds –  without the need to use a phone, card, or cash. In 2020, the company joined the second season of the Visa Innovation Program.

Trending Topics SEE: How did you come up with the idea of PayByFace?

Mihai Draghici: There are a lot of different elements that made me get here. Starting from working for two former C-level managers of Visa in the States, I got a lot of critical ideas about how to bring banking to third-world countries as we talked about how to build a better Visa. After that role of mine, I worked in Dallas where I met one of the current advisors of PayByFace, Sreejit Ankarath. There we had some challenges with employees going around corporate buildings like the Microsoft or the Verizon campuses and while walking around campus they had all these annoying little physical cards they had to scan to go through doors. I thought it wouldn’t be nice if everyone could go around campus, open doors, and buy their lunch just with their face. 

A few years ago, I went back to Romania to see my grandma and while I was there I learned about open banking, and PSD-2 and GDPR, and about all the other things in Europe that I didn’t know. I was having lunch in Bucharest, I had to sit in the restaurant for an hour after finishing with my meal because I wasn’t able to pay since their device ran out of paper and then the battery died. While sitting there, I thought that there has to be a better way – why couldn’t I just pay with my face and not worry about my wallet. All of these ideas combined together led to PayByFace.

Trending Topics: From your perspective, what are the biggest advantages of facial biometric technology in payments?

Mihai Draghici: I have been researching a lot about fingerprint payments, vein payments, and voice payments, and all the other forms of biometric payments. When it comes to fingerprint payments, from an engineering perspective they’re not scalable. Speaking about physical locations, even if they were somewhat interesting before the whole Covid-19 situation, now they’re not. 

There are some cool things that Amazon is doing with vein payments now in their stores and that seems pretty promising. Yet, it still seems to be involving bulky devices and you still have to insert the card. 

The one thing I don’t ever leave my home without is my face, and facial recognition is already pretty good and is getting better. I have been experimenting with face recognition algorithms for almost 10-12 years now and it’s definitely improving very fast. I believe that face recognition payments have the benefit of convenience but also from the engineering perspective, they are ultra-scalable.


Trending Topics: Why did you decide to start with physical merchants like restaurants and cafeterias instead of making facial biometric shopping available online?

Mihai Draghici: This is all part of our go-to-market strategy. In the early 2000s, I built some of the largest out-of-home digital signage systems in America – I had 300 screens throughout Los Angeles, I had about 80 screens in Texas, and about 150 screens in Seattle. So, I got to understand the out-of-home digital signage business really well and I realized, that I can use the same strategy to go to market because I know how to put digital screens at the point of sale and how to sell advertising on them. The difference is that now we are also doing payment on it. 

It just made sense because I could start small and bootstrap and then get my first revenue through digital out-of-home advertising sales because I wouldn’t need users to enroll in the app and merchants to do transactions to get revenues since it’s a side revenue stream. All I needed to do is install iPads across different businesses in a small concentrated area and start selling digital advertising. 

Trending Topics: In the future, do you plan for advertising to be your main source of revenue? 

Mihai Draghici: No, that is just to grow the network of merchants right now. With advertising revenue, I can buy iPads for more stores. With the new stores, I can get more advertising revenue and buy more iPads. This goes on until the business hits a critical point and merchants start buying their own iPads. 

That is when it doesn’t matter anymore whether I sell advertising or not because the other business models kick in. For example, click and collect and merchant subscription analytics portals – for the merchant to download data and do SMS promotion to the users and for the users to be able to order in the app a latte, click and collect at the store or get a delivery. 

We also have an API developer portal for third-party application developers to integrate and build their own PayByFace inside their apps that we monetize – so there is a whole bunch of different business models for monetization but digital out-of-home is the initial seed model to fund the growth of the physical network. 

Trending Topics:  What are your biggest goals and priorities for the next year?

Mihai Draghici: One of the key components to be able to launch PayByFace in new markets is the integration with a payment gateway like we did with Ukrainian Processing Center (UPC) and Euplatesc.ro in Romania. That facilitates our ability to actually onboard merchants for payments in the market in the entire country where we have integrated a gateway. Right now, we have two gateways and the first one in Romania took me a year to build, while the second one took me a month, so I suppose the third and the fourth one will take me just a few days. It is getting easier and easier to onboard gateways because of our system, so the next step is more and more gateways integrations, so we can launch PayByFace in more and more countries, and also partner with large chains and large businesses and banks.

The biggest problems that we are solving are for banks because right now there is a big shift from physical store sales to e-commerce sales as the evidence and the data show it. So the problem with the banks is that banks typically provide merchants with an in-store POS solution that is hooked into acquiring and card processing in the banking ecosystem of money flow. But when a merchant goes online and starts to sell through Deliveroo or Takeaway or Paypal, the bank no longer has that money flow and they lose revenues on acquiring the business. To solve that problem we are basically bringing the e-commerce business back into the banks with a unified soft POS solution that does both in-store and e-commerce payments through the same banking acquiring infrastructure. But there are also so many other problems that we are solving for them like hands-free Covid-friendly check out and helping them to get to know their customers (we help them gather their emails, send them offers). 

Trending Topics:  What is your long-term vision for PayByFace? 

Mihai Draghici: I’d like to see PayByFace’s logo on Elon Musk’s rocket to Mars. If I am going to a Starbucks on the moon, I am not carrying a dollar bill or my iPhone with me, right? You are going to get on a spaceship and you are going to pay for your coffee on the moon with your face, or your veins but I guarantee it’s not going to be with a dollar bill. So that’s the idea, I want to take PayByFace to Space with Visa and SpaceX altogether – I want to be the first payment system in space.

…all you need to make payments is your face. No cash, no bank cards, no PINs to remember, no limits. And at the same time, your money is securely tied to your unique identity. Actually, no need to imagine as transactions that require nothing more than a quick biometric authentication are no longer a talk of the future. They’re already here and there’s a lot of innovation in the space aimed at making them faster, cheaper, and safer. 

Even more interestingly, a small but decent fraction of this innovation is happening in Southeastern Europe (SEE). For instance, we have the Romanian startup PayByFace, a company, which has enabled selfie checkouts at a double-digit number of stores and restaurants in Romania, and since recently, a coffee shop in the headquarters of Raiffeisenbank Bulgaria. Following his participation in the Visa Innovation Program in Sofia, founder and CEO Mihai Draghici has plans to scale across Europe and maybe one day even bring biometric payments to space. It will likely be a very long journey before we see PayByFace’s logo on a rocket to Mars but Draghici’s business is not an isolated Eastern European example of how biometrics can disrupt the finance industry. TypingDNA is another success story coming from Romania –  funded by Google, this venture has implemented its behavioral biometrics fraud prevention technology in a mobile app of BBVA, one of the world’s largest banks. Bulgaria is home to Alcatraz AI, which, with over €11 million in raised capital, develops 3D facial authentication systems to help financial institutions make cash vaults and data centers more secure. 

That said, it’s still early days for biometrics in the payments industry – not only in SEE but also on a global scale. While pilots are launched one after another, most use cases are still figured out and multiple stakeholders along the value chain are yet to discover the benefits of biometric payments, how they really work, and what are the trends shaping the future applications for shoppers, retailers, banks, and society in general. Biometrics have the potential to completely transform how we all move money around, but with that, we also shouldn’t forget important factors like the role of regulators, topic education, and privacy-driven system design.


The benefits for everyone

Consumers are among the big winners of the incorporation in payments as they get to pay faster and easier than ever before. No more time-consuming visits to bank branches, no more waiting for hours at the register in the supermarket, and even more importantly, no more easy hacks and fraud.

For banks, first and foremost, biometrics are one of those rare opportunities to combine security with good user experience, thereby acquiring and retaining more customers. Especially from younger and tech-savvy market segments. In practice, all the things that are beneficial for users can also be exploited by banks – convenience, not having to remember PINs, safe online banking. Unifying the customer journey is something that banks haven’t really been able to do so far and biometrics can certainly help in that direction.

Of course, reducing fraud is no doubt even more important if a bank wants to keep its clients. According to GlobalData’s 2018 Consumer Payments Insight Survey, 16% of consumers worldwide have been victims of payment fraud over the previous four years and as per the Nilson Report, global card fraud losses reached $22.8 billion back in 2016. More and more banks are implementing voice biometrics for know-your-customer (KYC) procedures and behavioral biometrics to spot unusual patterns in transactions.  Multiple banks around the world already provide biometric ATMs that identify customers and let them withdraw cash only following a matching fingerprint, vein, iris or face scan. 

Another big motivation for banks to explore biometrics is the possibility to remove limits on contactless payments, as stated by Societe Generale in France, which back in 2018 was the first bank in the country to introduce a card with fingerprint sensors. Removing the cap on contactless payments is not just a matter of convenience, pilots have demonstrated that the usage of biometric cards goes hand in hand with an increased transaction value. 

Going back to the topic of financial inclusion, there’s also a chance for banks to unlock new customer bases by providing biometric cards to people who cannot be authenticated any other way. 

For retailers, we can again make the argument that faster transactions and better customer experience would result in more sales, especially if the contactless payments cap is removed. In Covid-19 times, biometrics can also enable payments that are truly socially distant and also empower the more universal switch to digital sales.

Then, there’s the opportunity for businesses to get more customer data and the opportunity for personalized offers to keep customers engaged with the brand.

 

What's next

All in all, given the accelerated, by the pandemic, adoption timelines, Fingerprint estimates that by 2026, there will be about 3 billion biometric payment devices shipped every year. It all sounds very promising but there are a number of factors that will influence adoption moving forward.

It is very interesting to recognise the development and adoption of the biometric technology as an important pillar of innovation in Fintech. Fingerprint, face, voice or behavioral recognition could have positive impact on the accessibility and security of payments - a game-changer for users, merchants and financial institutions. Especially impressive is the fact that there are number of strong players in Central and Eastern Europe who are leading the way in the field of biometrics.

Daniel Tomov, Founding Partner at Eleven Ventures

Dealing with privacy concerns

Javvad Malik, a security awareness advocate at KnowBe4, argues that one of the biggest worries when it comes to biometrics in payments is how personal data will be used. “While convenience is good for merchants and customers, it shouldn’t be done at the expense of privacy – these are areas where there should be serious consideration of allowing a big tech company to have access to another extremely valuable dataset of information that can be monetized.”

Regulation in some regions and technological advances make it possible for all user data to be on the card itself and never leave its owner. But even with the right privacy mechanisms in place consumers will need to be educated on how it all works in order to really trust someone else with their identity.

Creating the right regulation environment

Building on the previous point, in the US, Oakland, San Francisco, Portland, and Boston all have bans on the use of facial recognition technology in public places. In Europe, European Data Protection Supervisor (EDPS) Wojciech Wiewiórowski also calls for slower adoption of biometrics.

“I fear we in our societies still lack the full picture of the individual and societal impact of automated recognition in public spaces of human features, not only of faces but also of gait, voice, and other biometric or behavioral signals,” Wiewiórowski said, “I, therefore, support the idea of a moratorium on their deployment, in the EU, so that an informed and democratic debate can take place.”

Towards multi-modality

Another key prerequisite for the future success of biometrics in payments appears to be the concept of multi-modality – systems that are able to accept more than one identity characteristic.

Multi-modal biometrics means that if it’s raining, the users can use voice instead of a fingerprint; or facial recognition when it’s cold and they’re wearing gloves. It also provides alternative authentication if the facial recognition software is not able to recognize people wearing masks because of a global pandemic. 

Getting to the next level with 5G

The arriving 5G network can unlock new possibilities for the world of payment biometrics. For example, low latency bandwidth may enable a new level of real-time information gathering. One use case in that direction is the delivery of accurate context-aware financial recommendations. With 5G connectivity, it can also become easier for companies to aggregate data from different biometric systems, and through multimodal authentication increase security even further. Or, in an even more futuristic scenario, users can get the full banking experience even in virtual reality. In a nutshell, 5G can increase the speed of transactions and bring the same experience for consumers across all of their applications – phones, smartwatches, connected cars, etc. 

I would say the main trends in biometric payments right now appear to be the general increase in digital payments, whether through payment cards, mobile devices or online, and pilots.  The number of pilots and trials everywhere is a huge trend in biometric payments right now.The biggest obstacles or challenges to mass adoption of biometrics for payments are: customer acceptance and inertia, but both seem to be falling, and it is difficult to say what (if anything) will replace them, at least before quantum computing shows up and potentially changes what we consider hackable.

Chris Burt, Editor at Biometric Update
Share on facebook
Facebook
Share on twitter
Twitter
Share on linkedin
LinkedIn

This is a special edition supported by Visa Innovation Program and Eleven Ventures exploring in depth the newest trends in fintech in Europe and SEE. 

Up next: InsurTech and Innovation in Receivables.