Withdrawing Money With a Retina Scan: The Future of Biometrics and Banking

Forget strong passwords. In the future, you won't need any password at all to do your banking.In the near future, your ATM could have the ability to identify you by scanning your face or retina.

Imagine walking into a bank and having your account flash onto the teller's computer screen before you even say a word. Or consider what it would be like to call your institution's customer service line and not have to bother going through the laundry list of your name, birth date, PIN and security question.

That could all become a reality in the not-so-distant future. Thanks to facial recognition, voice recognition and palm scan technology, banks are already experimenting with ways to verify customer identities without using passwords or traditional IDs. And yes, just like in the movies, you may one day be providing a retina scan to get into your bank account.

It all started with a fingerprint sensor

Using a person's physical or biological characteristics to verify identity is known as biometric authentication. It may seem like something out of science fiction, but the technology already exists to scan retinas, map veins in hands and recognize unique voice patterns. The hurdle is getting people to actually agree to use these forms of authentication.

That's why experts say Apple's Touch ID is important. The company's iPhones have been equipped with fingerprint sensors since 2013, and other smartphone manufacturers have since followed suit. As a result, many apps, including mobile banking apps, allow customers to log in with their fingerprint rather than a password. It's paved the way for fingerprint scans to be the first widely used form of biometric authentication.

"I think we're getting to the point where people are getting comfortable using fingerprints on their phone," says Greg Crouse, managing director in the financial services practice at Navigant Consulting. Based on that success, smartphones could lead the way for the next big push in the world of biometrics. Newer phones might soon begin to include facial recognition, which could mean it will be only a matter of time before that too is embraced by consumers.

Other types of authentication

While fingerprints are already in the mainstream and facial recognition is poised to follow, those aren't the only forms of biometric authentication being used by banks. Last year, financial technology firm Fiserv announced the launch of Verifast: Palm Authentication, which identifies people based on the vein pattern in their palms. Currently, about 50 banks and credit unions nationwide are using the technology.

Voiceprint and eye scan technology have also been piloted at institutions such as Wells Fargo, USAA and Ally Bank. "We did some user testing on eye scans, and it creeped most people out," says Scott Hess, vice president of innovations in the digital channels group for Fiserv. Among other concerns, people worried about where their retina patterns were stored and whether they were secure.

Banks looking to do away with passwords

Biometric authentication comes with two benefits: It can reduce fraud and increase convenience. "Passwords are a major pain point," says Leo Loomie, senior vice president of client services at Digital Risk, a company providing technology solutions to the mortgage industry. "They are extremely insecure."

Eliminating passwords in favor of biometrics could benefit both banks and consumers. "A lot of the biggest banks we work with are looking to get rid of passwords using a layered approach," Hess says. That means allowing the use of biometric authentication while also checking other data to reduce the possibility of fraud. For instance, an app might use facial recognition or a fingerprint along with a phone's location or other information. If someone is logging in from an unusual spot or behaving outside of what would normally be expected, the app might prompt for a password or different form of identification.

Avoiding fraud and protecting privacy

Looking for behavioral cues to prompt for additional verification is just one way banks can avoid fraudulent activity. Hess says step-up authentication is another avenue available to financial institutions. This allows simple forms of verification, such as a fingerprint or facial recognition, to do basic activities, such as checking account balances. But additional identify checks are required before more sensitive transactions, such as transferring money to an outside account.

"The end state is an ATM scanning your face and retina and knowing who you are," Crouse says. Once biometrics are integrated into the banking experience, they should be seamless and involve multiple levels of confirmation. That's the layered approach banks are looking for to avoid the problems that could occur if someone happens to get ahold of one piece of biometric data. "Once you start combining them, it becomes extremely unlikely someone will be impersonating [someone else]," Loomie says.

Of course, some people may never be comfortable using their fingerprints, faces or retinas to do their banking, and experts in the field agree it's almost guaranteed people will have the option to opt out of biometric authentication. However, don't be surprised if your bank starts insisting on longer passwords, two-factor authentication and other safeguards that may just have you wishing you could withdraw your cash with a simple scan of your hand.