The San Diego Union-Tribune

A new gold finger: One touch and it's paid for

April 1, 2004
By Cate T. Corcoran

Fingerprint-based biometric payment systems are up and running at an estimated 40 or so retailers across the country. If such systems become commonplace in grocery stores, gas stations and video stores, they could invade apparel stores as well.

That's partly because consumers will come to expect them, say the companies that make the systems. Finger-pay systems are available today from three companies, and they all work similarly. The systems don't actually record a customer's fingerprint but use several data points from a finger to generate a unique number. The result can never be turned back into a fingerprint image, the companies say.

Customers must register to use the systems. After that, a customer places a finger on a scanning device about the size of a deck of cards and enters a personal search code, such as a telephone number. (The code speeds the database lookup and does not need to be kept secret.)

The system matches the customer's finger data against the same data provided on registration, and then the customer verifies the amount of the purchase. The rest of the transaction goes through as usual. The procedure is faster than using a credit card, and there is no fumbling for cards or checks.

"We see that customers like not having to bring a wallet or a purse in," says Paul Kapioski, president of Cap Food Sources, which owns West Seattle Thriftway, part of a grocery-store chain in Seattle. "It's very convenient for them."

The store uses a system from Pay By Touch of San Francisco and has one finger reader in each of its 13 checkout lanes. About 3,000 customers have registered for Pay By Touch, and the store has done some 200,000 transactions on the system in two years.

To register, a customer goes to the customer service desk and presents a finger (naturally), a personal search code and his or her preferred payment options - debit, electronic check or credit card. The store is responsible for verifying the customer's identity at registration, says Caroline McNally, chief marketing officer for Pay By Touch.

The company with the largest number of customers is BioPay of Herndon, which has about three dozen clients, most of which are in the Washington, D.C., area. One of these is Sterling Amoco, a gas station and convenience store in Sterling, Va., which has two finger scanners at its cash register.

"We have a lot of regular customers that use it," says general manager Shannon Stokes. "Sometimes the customer will have a little piece of grit or sand on their finger, and it declines the purchase, but then they wipe their finger off and it's fine. I really like it."

Once customers enroll with a merchant that uses BioPay or Pay By Touch, they can pay by finger at any retailer that uses the same system. That's not the case with systems from Biometric Access Corp. of Round Rock, Texas, which relies on each individual retailer to manage its own database of customer information.

But adoption is not certain, and questions remain about cost, security and privacy.

"I think there's a reluctance on the part of large retailers at this point to make an investment until it's clear what the return on the investment will be," says Trevor Prout, director of marketing for the vendor-neutral research and consulting group International Biometric Group of New York City.

"There's also some discomfort with the technology today. There's a lack of awareness among consumers about how it works, there are privacy concerns and there's the stigma of fingerprint technology in general being associated with criminal and forensic uses."

Credit-card companies could view finger-pay systems as a threat, and so far none has moved to offer it.

"There's a lot of investment in infrastructure that's required, and the global standards aren't in place yet," says Colin Baptie, a spokesman for Visa International in Foster City, south of San Francisco.

Nonetheless, Visa conducted its own finger-pay pilot in its company cafeteria and is ready to support any of its member banks that want to offer it.

"People liked using it," says Baptie. "It was fun and easy, and there was no fumbling for cash."

The credit-card companies might instead prefer to put biometric data on a smart card to eliminate fraud. The consumer would still use a card to pay, but the retailer would scan and match the customer's fingerprint instead of checking his or her signature.

Another concern with the new systems is security. Because the systems use personal search codes to narrow down the number of possible matches, they never give false positives, say the companies. But fingerprints can be stolen. Researchers in Germany and Japan have been able to lift fingerprints from surfaces and create false fingertips out of latex and gelatin that are good enough to fool fingerprint scanners.

"It may be opening up a new form of fraud," says Barry Steinhardt, director of the Technology and Liberty Program for the American Civil Liberties Union in New York City. "Certainly it worries me as a consumer."

Privacy advocates question what companies will do with the data the systems generate. If the companies sell it or make it available to the government, it could be used to track a consumer's purchases or movements.

"Ultimately there's a question of where this is leading us," says Steinhardt. "We are increasingly becoming in the U.S. a surveillance society where every action, every utterance can be monitored and tracked. I'm sure companies will begin by saying it's wholly voluntary, and they'll all protect the data. But in the end, programs that invade our privacy rarely look like what they began as."