Thales Launches Payment Card with Onboard Fingerprint Scanner

Thales has announced a payment card to include an onboard fingerprint sensor, promising improved security and usability – and an end to contactless payment limits.

The Thales Gemalto Biometric Sensor Payment card (BSPC), the company explained, replaces the traditional PIN with an on-card fingerprint sensor and requires no modifications to existing point-of-sale (POS) payment terminals. Banks signing up to use it, though, will need to implement a procedure for enroling users' fingerprints onto the card's secure element.

Thales claimed to have implemented the card with banks worldwide, with 30 months of live trials and 10,000 users across nine countries. ‘Over 80% of users interviewed confirmed they love it and feel it's more convenient and provides greater security,’ said Frédéric Martinez, Product Line Manager for Biometric and Advanced Payment at Thales.

Security and convenience

‘In terms of security, the biometric card ultimately means that a lost or stolen card is useless without the owner's fingerprint to authenticate a contactless transaction. In such trustworthy payment environments, there is no need to set any payment limit.’ 

It's not just about convenience, though. Thales claims the system offers vastly enhanced security over the traditional PIN. ‘The probability of another user being recognised as the genuine user by the Thales Gemalto BSPC is less than the chance of another user guessing the card's PIN code,’ Martinez pointed out. ‘Fingerprint verification on the card has a False Acceptance Rate (FAR) of <1/10,000.’ 

There are concerns, however, about using fingerprints as an authentication system. For starters, if the biometric data is leaked you can't change your fingerprints as easily as a PIN or password.

Researchers have also demonstrated how they can produce a replica fingerprint good enough to fool commercial sensors from a photo – creating a mould which can be used in place of the target digit (see IDN August 2020).

Martinez is unconcerned. ‘The biometric system on the card includes anti-spoofing features, making any mould based on a photograph of the fingerprint (even high resolution) not able to fool the system.’

On the matter of data privacy and security, Martinez says that ‘when registering the customer's fingerprint, the reference data of their fingerprint is only stored in the secure chip of the card. This does not include any biometric data per se, but is a mathematical conversion of single points that represent your fingerprint reference data. In addition, no personal data is stored in the services of the financial institution or sent to any other centralised database. Even if the card is lost or stolen, the data cannot be recovered by a third party.’

Mastercard adopts biometrics

The Mastercard Biometric Card (© Mastercard).

In a related story, the US-based payment system multinational, Mastercard, has announced a next-generation solution to provide security using biometrics. According to the company, the Mastercard Biometric Card combines chip technology with fingerprints to conveniently and safely verify the cardholder’s identity for in-store purchases. An embedded sensor that's powered by the chip, authenticates identity through a fingerprint and can be used at terminals worldwide.

How it works

During a transaction, the embedded sensor captures and matches the cardholder's fingerprint to the digital template stored on the card. The cardholder's biometric data does not leave the card at any point, as the biometric capture and match is done entirely on the card. If the match is successful, the transaction is authenticated and there is no need for the cardholder to provide a PIN or signature.