Biometric Authentication

Biometric authentication is a way of confirming that a person is who they claim to be by measuring a physical or behavioural characteristic, such as a fingerprint, face, iris, voice or typing rhythm, and comparing it with a template recorded earlier. In finance it is used to unlock banking apps, approve card and bank payments, and confirm identity at ATMs and branches. It is popular because the trait cannot be forgotten and is quicker to present than typing a password or code.

Biometrics are the "something you are" (inherence) factor in multi-factor authentication. The term is often used together with biometric verification, which in the narrow sense means checking a live face or fingerprint against an identity document or database during onboarding, while authentication means checking a returning user against their own enrolled template; Money Wiki's biometric verification entry points here. The underlying personal information is covered under biometric data, and the wider practice of payment checks under payment authentication.

Think of a friend who knows your face. You do not need to show them a card or say a password when you visit; they simply recognise you. But they first had to meet you and remember what you look like, and a very good disguise or a twin might fool them.

A phone or bank does something similar. When you set up the feature, it records a description of your fingerprint or face. Later, each time you pay or log in, it compares a fresh scan with that description. If they are close enough, it lets you in. The system never needs a perfect match, only a close one, which is why it is set up carefully to avoid letting in look-alikes or copies.

A sensor captures a sample, software extracts features (such as ridge endings in a fingerprint or distances between facial landmarks), and the result is compared with the stored template to produce a similarity score. If the score passes a threshold, the user is accepted. Two error rates describe performance: the false match rate (an impostor accepted) and the false non-match rate (the genuine user rejected). Raising the threshold lowers one and raises the other.

Because biometrics are not secret (faces are photographed, fingerprints are left on glasses), systems need presentation attack detection, often called liveness detection, to spot photos, masks, replayed video and synthetic deepfakes. The US National Institute of Standards and Technology's digital identity guidelines (SP 800-63B, revision 4) allow biometrics only as part of multi-factor authentication together with a physical authenticator, require a false match rate of one in 10,000 or better, and require presentation attack detection for facial recognition.

There are two main designs:

• On-device matching. The template stays in a protected chip on the phone, and a successful match unlocks a cryptographic key that signs the payment or login. The bank never receives the fingerprint. Phone wallets such as Apple Pay and Google Pay, and passkeys built on FIDO Alliance standards, work this way, which is why they count as two factors: the device (possession) plus the biometric (inherence).
• Server-side matching. The sample is sent to the provider, which compares it with a template it stores. This is common for remote onboarding with identity verification and for national schemes such as India's Aadhaar-enabled payments, where a fingerprint is checked against a central database.
• Behavioural biometrics. Passive signals such as typing speed, swipe patterns and how a phone is held are scored in the background by behavioral analytics and device fingerprinting tools to flag account takeover.

In the EEA and UK, biometrics are an accepted inherence element for strong customer authentication, and banks frequently use an app fingerprint or face check as the challenge step in 3-D Secure. The EU's provisional PSD3 and Payment Services Regulation package, agreed in November 2025, keeps that approach and adds duties on accessible authentication. India's 2025 directions on authentication for digital payments, applying from April 2026, explicitly widen the choice of factors beyond SMS codes, including biometrics. Card networks also run cardholder biometric programmes for e-commerce, and some ATMs and agent points in emerging markets use fingerprints instead of a PIN.

Privacy law applies on top. Under the EU GDPR, biometric data used to uniquely identify a person is a special category that needs an explicit legal basis. In the US, state laws such as Illinois's Biometric Information Privacy Act require notice and consent before collection and allow private lawsuits. On-device designs reduce these obligations because the provider never holds the template.

A stolen password can be changed; a leaked fingerprint cannot. Central template databases therefore raise the stakes of a data breach, which is a key argument for on-device matching and for strong encryption of stored templates. Accuracy can differ between demographic groups and degrade with age, injury or poor lighting, so providers must offer a non-biometric fallback, which in turn can be the weakest link.

Biometrics also confirm only that the right person approved a payment, not that they understood it. In authorized push payment fraud and other social engineering scams, the victim approves the payment with their own face or fingerprint, so banks still need transaction monitoring and payee checks. Advances in generative AI have increased attacks on remote face checks, which has made liveness testing standards a growing focus for regulators and vendors.

• NIST SP 800-63B: Authentication and Authenticator Management
• FIDO Alliance