Advantage Magazine

Fingering Fraud

More companies are using biometrics such as fingerprints to verify identity.

February, 2004
By Carole Edwards

Cashing government and payroll checks earns fees totaling about $3 billion a year for U.S. merchants, but the risk is high. Supermarkets alone are believed to lose about $90 million a year cashing fraudulent checks.

Employees may do other employees a favor by clocking them in early, helping them get paid for hours they didn't work.

Warehouses and docks are left unlocked for easy access, or access is delayed by the need to wait for someone to open a locked door.

Supermarket customers cool their heels at checkout while people in line ahead of them write personal checks, a costly and time-consuming method of payment.

These situations offer opportunities to keep ahead of crooks or boost efficiency by identifying people using biometrics - distinctive, measurable physical features such as fingerprints, handprints, irises, faces and even handwriting, voice and gait. In a post-9/11 world, national security is also driving the development of new biometric systems.

The field is growing fast. International Biometric Group (IBG), a New York research and consulting firm, puts worldwide revenues at $600.7 million in 2002 and about $927.6 million last year.

Of that number, two categories are significant to supermarket operators:

• Physical access and time/attendance applications ($90.9 million in 2002 and $163.5 million last year)
• Retail/ATM/POS applications ($9.5 million in 2002 and $32.1 million last year)

Trevor Prout, marketing director for IBG, said the most common application of finger scans is access to personal computers and networks. Next in line is physical access to facilities. The most common application in supermarkets is identification of people cashing government and payroll checks.

"The use of biometrics in supermarkets is not yet widespread," Prout said. "Supermarkets just started using this technology a couple of years ago. But fingerprints are by far the most popular biometric for supermarkets, probably because finger or thumbprints offer a good combination of ease of use, accuracy and cost effectiveness."

Two supermarket operators that recently installed or expanded biometric systems for cashing payroll and government checks are very enthusiastic about them.

Joyce Smart, a spokeswoman for BI-LO, said the company has seen a 70 percent drop in check fraud, which cost it more than $1 million in 2002. BI-LO, which operates 300 supermarkets in the Carolinas, Georgia and Tennessee, tested Paycheck Secure in Charlotte, NC, for three months before installing it in 176 stores in November.

BioPay LLC of Herndon, VA, provider of Paycheck Secure, says BI-LO's biometric system is the largest in any U.S. retail chain.

Stan Edde, president of Falley's Food 4 Less, a subsidiary of Associated Wholesale Grocers, said he tested Biometric Access Corp.'s Secure-Touch-n-Pay in eight stores in Wichita, KS, and was impressed enough to roll it out to all 31 stores by last summer.

Value of velocity

"The only change we made after the test is that we went to a central server instead of maintaining a separate database at every location," he said. "This enabled us to give real-time check cashing access to all stores."

Before that, Edde said, if someone cashed a bad check in one store, especially on a Friday night or a Sunday, the other stores didn't hear about it until at least that night, enabling the crook to go from store to store.

"We were getting fraudulent payroll checks that were very, very good," he said. "They had magnetic ink, and names like Boeing and McDonald's. The central server gives us velocity; we find out about these kinds of checks very fast... we prosecute, but the people who pass checks are not the people who make them. By the time you cash the check, the people who made it are long gone."

Typically, the customer must present a photo ID and one or more fingerprints when enrolling in a biometric program. The fingerprint is converted into a 250-character algorithm, and in future transactions, the customer need only hold his or her finger up to the scanner.

(Customers who want to pay for groceries with a fingerprint must also provide a check for scanning into the system so the retailer can deduct the funds from a checking account. After that, all the customer presents is a fingerprint. "She could leave her purse in the car," said Edde, who wants to eventually expand biometrics to checkout.)

Two types of systems

Holly Rios, marketing manager for Biometric Access Corp. (BAC), said retailers like "finger image authentication" because they can easily determine whether a presented check and/or customer has any dishonored transactions outstanding, or whether the check shows signs of tampering.

By contrast, the systems offered by companies such as CashWorks, Certegy and Identico (see "Get Your Check Cashed Here," Advantage, January 2003) use a huge database of information to try to identify fraudulent people or checks. Data aggregators - which are biometric to an extent, because they start with a photo ID - may also help dispense the cash through an ATM. Neither biometric nor database-system providers take any interest in the merchant's check-cashing fee, which ranges from1 to 5 percent of the value of the check, depending on store policy and state law.

"Biometrics are wonderful. We have them as an option on our product," said Larry Gilbert, president and CEO of Identico Systems, provider of the TrueID databased check cashing system. "But no biometric system will 'read' every person. One percent on average won't read, and if you can't read everyone, fraudsters will make sure they're in the group that can't be read. The system will be defenseless against that type of fraud."

Noting that employee training is "very important to the success of implementing the technology," Smart said that if a person's fingerprints are missing or not useable, BI-LO cashiers "are trained in addressing these issues so another finger is used for enrollment process."

Prout said retailers "always need a workaround process" to accommodate customers who can't or won't provide a useable finger.

Biometrics at checkout

Using biometrics for payment at checkout is rare, said Robyn M. Porter, communications manager for BioPay. She said Paycheck Secure (for authenticating payroll and government checks) is in use at nearly 600 retail outlets in 34 states. BioPay's new bCheck replaces personal checks at checkout. FMI's Activity Based Cost Study of Retail Payments report says personal checks account for a third of supermarket payments.

Meaningful comparison of biometric costs is dicey. Prout said finger scan devices typically cost in the hundreds of dollars" for the scanner - that is, not counting software, servers, etc. - while iris recognition devices are priced in the thousands. "Facial recognition technology is not yet as capable as other technology in terms of accuracy," he said, "but the government is investing heavily in R&D for face recognition technology."

The cost of installing Secure Touch-n-Pay varies with the number of outlets and the store's existing infrastructure, Rios said, adding that as a very broad generalization it might cost about $4,000 to install two devices and related customer service equipment in one store, with volume discounts for additional stores.

The providers of database systems such as TrueID take the loss if a fraudulent check is approved, whereas the merchant usually takes the loss with a biometric system. Edde said that hasn't happened. Porter said it hasn't happened with BioPay, either, but the company offers an optional insurance program just in case.

Edde said checks can still be returned for insufficient funds or because the account was closed, and Food 4 Less processes them the same way it did before biometrics.

The 'p' word

Rios said customers like biometrics because they no longer have to present personal information during check-cashing transactions, a major privacy concern. Smart said customers think biometrics actually protects privacy.

"If you cash a check today," Porter said, "it has your name and address, and you have to provide your driver's license, which in most cases has your social security number. That check is handled by seven people on average. Paycheck Secure and bCheck are much more secure and private than that."

She said converting the print into an algorithm changes it into a form different from that used by law enforcement.

Nonetheless, retailers are cautious about using fingerprints at checkout, on the ground that customers simply fall into a different category from check cashers. Smart said "you can choose to cash your payroll check somewhere else" but "buying groceries is not optional - everybody has to eat." Kroger is still conducting a multi-year test of such a system at several Texas stores, and will not comment on it.

"There's a certain amount of consumer resistance to biometrics," said Gilbert of Identico Systems. "I think that will go away over a period of years as people get more accustomed to them, but if you've got a system that consumers object to, perhaps legitimately, a retailer has to respect those obligations. So, once again, the fraudster can say, 'I don't want my fingerprint used.' If the system can't accommodate someone who objects, it's vulnerable to fraud. So we think a system using a driver's license as a least common denominator, to which you can add biometrics and other systems, is the best way to go."

As biometric systems become more accurate, cheaper and more familiar to consumers, many think retailers and wholesalers will find other uses for them. Rios said one BAC customer is a large supermarket chain that is using biometric employee timecards, but she would not identify it. She acknowledged that this use of biometrics is still rare in supermarkets; McDonald's remains the best-known user.

Edde said another obvious use is for front-end managers to use a fingerprint instead of scan card - to void sales, for example. Certainly the incentive is there to try to head off losses before they occur. As Edde said of cashing fraudulent payroll checks: "There's no recovery. It's a total loss to the business."