BMO Financial Group North
American vice president and head of corporate card products Steve Pedersen
talks:
- Biometric pilot update
- A new biometrics credit card
- Chip/EMV transition
BTN: In March you
announced a biometric
authentication pilot in conjunction with MasterCard using fingerprints and
"selfies" for security instead of pin numbers or signatures. The
pilot rolled out to several hundred BMO employees. How is that going?
Pedersen: Our
soft launch has gone very well and we're going into full production with
MasterCard this fall. For all BMO employees using it, we put them through
multiple surveys asking how they liked the enrollment process, usage and [if they
had] concerns. The results have been great. People love it and they thought it
was easy to use.
BTN: Can you talk
about some of the concerns or obstacles users faced with biometric
authentication?
Pedersen: We learned a lot. Some of the questions we got
from users I never fully anticipated like, "If I got Botox done would the selfie still work?" The
other thing is that as part of the rollout, the tool leverages MasterCard
SecureCode, which is a private code for your MasterCard account that you can
use when shopping online and biometrics can replace the need to enter this code
at checkout. Depending on a client's shopping pattern—for example, a small
ticket transaction at a larger merchant—the merchant may decide to not prompt
for MasterCard SecureCode so the cardholder would not get a biometric prompt.
This could cause concern for the user. We
are automatically enrolling all customers into SecureCode. Our roll out will
include comprehensive FAQs and client education to ensure enrolled cardholders
are aware of potential differences in experience.
BTN: Between
SecureCode codes and biometric prompts, do cardholders ever get annoyed at all
the checkpoints?
Pedersen: We're using a risk-based approach [with SecureCode vendors]
For instance, Amtrak is a SecureCode vendor. If you're always taking the train
and buying tickets every day and the purchases are within a dollar range, we
don't need to keep bugging you. Once the tool realizes your established
pattern, we don't need to get verification from you because we want to limit
the interruption in your daily life. Verification will be needed when
[transactions] don't look right.
BTN: Do
biometrics work with all devices?
Pedersen: Apple
has made more inroads than Android because of security concerns. But we're also working with MasterCard to get
a BlackBerry option. BlackBerry is a big Canadian institution, so a lot of
businesses in Canada have BlackBerrys. I still have one—I admit it, I'm a
dinosaur. I still see it heavily used in Europe as well.
BTN: What is the
answer to the Botox question?
Pedersen: A lot
of the questions gravitate around selfie. What if I have a receding hairline or
facial hair? What if I changed to colored contact lenses? The algorithms
focus on the T-zone and [the authentication process] takes a bunch of distinct
measurements. So facial hair or hair on top of your head wouldn't make a
difference nor would changing to colored contacts. With Botox gone wrong or an
accident, selfie pay may require a re-enrollment.
BTN: What does the
enrollment process consist of?
Pedersen: We send
two emails, one with a link and one with a password. You go to the link, put in
the password. As part of the enrollment process the device and phone number go
through some quick authentication components.
If the device allows for both [selfie and fingerprint authentication],
you can choose which one you want. Some devices don't have fingerprint
[authentication], but they have a camera. The selfie component allows for
device diversity as part of biometrics. If you don't have fingerprint on the device
we will go right to selfie for authentication, take picture—boom, it's quick.
The enrollment process took me less than a minute.
BTN: Any other biometric-related
things you're working on?
Pedersen: We're
considering leveraging biometrics capability to allow people to log in to some
of our sites, like our Spend
Dynamics [expense management] tool, I don't know if this will ever go into
production, but we're going to be piloting a biometric credit card with a
fingerprint reader on the upper right hand corner of the card itself. It allows
for more than one fingerprint to be used and will have full MasterCard PayPass
tap-and-pay capability. It's not new technology, but it's very interesting and
we're trying to understand if there's an actual use case. It's important for us
explore different options. It doesn't mean they're going to work, but our
customers expect us to to look for opportunities that will make the [payment] experience
better.
BTN: What part of
the experience?
Pedersen: The biggest
challenge for most of our customers—and I think it's an industry phenomenon—is
still all of the fraud activity happening in the U.S. Despite all of that, it's
still a relatively slow adoption of chip [technology] within the U.S. at the point
of sale. The issuing community has gotten aggressive in getting chip cards out
there, but it's still the retail community that's very much lagging. That's
still dominating a number of conversations with our customers.
Until the U.S. environment gets more militant about getting
chip terminals in place, it's still going to be highly vulnerable to breaches.
We don't see these breaches or anything close to the frequency or size in other
jurisdictions. We're also having interesting conversations over the number of
lawsuits that are being raised over chip and signature.
BTN: What will it
take for the U.S. to switch to chip and pin from signature?
Pedersen:
The
U.K. started as a signature environment and within a couple of years flipped to
pin. I could see the exact same thing happening in the U.S. But it's going to
have to hurt the retail community before they make a change. On the traveler
side, it feels like every major hotel chain has been impacted. But think about
when you go to a hotel and they take your card. What do they do? They swipe it,
still to this day. At some point the hotel industry will have to make the transformation
as well. When they do, I will breathe a substantive sigh of relief.