1. The Financial Services Sector Opportunity
François Lasnier
VP Banking & Retail, NAM
Schlumberger Smart Cards & Terminals
11/11/2018

2. Agenda Technical Overview – Three Models The Smart Card Advantage
Type of Biometrics in the Financial Space
Benefits
Applications
Users – Pilots
Main Barriers to Adoption
Some Stats
Legislations & Regulations
Industry Outlook – Trends & Opportunities
11/11/2018

3. Technical Overview (#1)
Link to an individual
/ access rights
One-to-one
Database model
ISSUES:
Security
Future liability (no legisl. yet)
Privacy / Social acceptance
Passive (no proof of transact.)
Enrollment
Potential for customer fear
Database
Service Provider
Bio-authentication
(user authentication)
By Service Provider
online
11/11/2018

4. Technical Overview (#2)
Cert. Validation thru Chain of Trust
Online & offline
Many-to-many (distributed)
Active (e.g., e-sign)
Wider acceptance (multi-channel)
Better privacy control
PKI
Authorization Server
Service Provider
User authentication
Cert. embeds ID data
Smart Card
Public/Private Keys Digital Certificate
Transfer of identity attributes Digital Certificate  Biometrics
Biometrics to unlock the Smart Card
11/11/2018

5. Technical Overview (#3)
Best privacy control
Smart Card verifies Identity
Service Provider authenticates Smart Card
Identity only used to unlock SC
Authorization Server
Service Provider
SC authentication SC linked to an account
No Identity data beyond this point
Card ID
Card ID
Public/Private Keys Card ID
No transfer of identity attributes Identity linked to SC at issuance but never released
Biometrics to unlock the Smart Card
11/11/2018

6. The smart card advantage
Smart cards are secure identification portable devices
Tamper resistant hardware
Certified software access control
Secure private key storage
Cryptographic algorithms
Digital ID storage
Personal data
Graphical personalization
Universally accepted format
Your virtual identity stays with you
You can use your virtual identity where you are
You provide your credentials only when you want, protecting your privacy

7. Type of Biometrics Fingerprint
Most relevant to payment (esp. physical)
Convenient, less obtrusive/invasive, stable, reliable
Voice verification
Relevant to login or phone identification (mono channel)
Has to prove as reliable as fingerprint
Iris or Facial recognition
ATM transactions
11/11/2018

8. Benefits Biometrics only:
Positive identification/identity verification
Reduced risk of ID theft for consumers
You always have your ID with you !
Biometrics + Smart Card:
No centralized database (better privacy) – Consumer in control
Active technology (encryption, signature, etc.)
Decoupling of Identity and authentication attributes
Card form factor allows for branding
Multi-channel acceptance
11/11/2018

9. Applications Login (account access, SSO, ATMs, etc.)
Secure online payment (authentication, confidentiality, non-repudiation)
Self-service account administration (e.g., unlock PIN)
Intranet/corporate security – Data protection & access control
Account aggregation – Account referencing
Check cashing or check payment (incl. ACH transactions)
Branch automation / Teller window authentication
Background checks
11/11/2018

10. Users - Pilots
U.S. Grocery Stores for payment: Falley’s Food 4 Less in Kansas and Missouri, Thriftway Grocery in West Seattle, Kroger in Texas, etc.
Check cashing and check payment at merchant locations in 31 states – Fast & Easy Stores, CA
Bank Leumi Contact Center, Israel: Voice verification solution
International Finance Corporation / World Bank – Feasibility analysis
Wells Fargo / Innoventry: Facial recognition technology instead of PINs at ATMs
Bank of America: Fingerprint access to online banking (w/ smart card) – Pilot in 1999
11/11/2018

11. Main Barriers to Adoption
Fear of consumer backlash (social acceptance, inconvenience)
Fear of low consumer adoption rate / low transactions
CSR to support technology deployment
Training & education
Implementation costs (incl. integration w/ legacy)
Standards
Pain (fraud & legislation) is still bearable – Liability is still manageable
For how long ?
11/11/2018

12. Some Stats
U.S. consumers say the financial industry needs to do a better job of verifying the identity of customers who open bank account (66%) and credit card accounts (72%)
5.6% of consumers victim of ID theft (12m people) – 15.9% of consumers victim of credit/debit card fraud or ID theft
Credit card fraud = $2.5B in 2003 – Total ID theft = $8B
In 2003, 42% of large F.I.’s will spend between $500k and $2.5m on IT for risk management (= 9.2% of total IT spending)
Biometric revenues in the Financial sector is projected to reach $672m by 2007
Source: Star Systems – Apr 2003 (survey of 2,000 people)
Source: GartnerGroup
Source: International Biometric Group
11/11/2018

13. Legislations & Regulations
USA Patriot Act – Customer Identification Program (CIP) – Deadline = Oct 1st, 2003 – Risk based identification of all new customers
SEC Rule 17a-4 – May Logging and retention of electronic communications by financial services firms
The Sarbanes-Oxley Act of 2002 – Deadline = June Accuracy and integrity of corporate financial management
California Senate bill 1386 (Civil Code ) – Operative July 1st, Notifying California residents of security breaches to their non-encrypted information
Basel II – Deadline 2006 – Capital charge associated with operational risk
Gramm-Leach-Bliley Act (1999) - How banks can share a customer’s personal information with other companies
Privacy Act of 2003 (Bill S. 228 & S. 745) introduced on March 31st, 2003 – Federal std regulating the use of sensitive information and establishing a comprehensive national system for privacy protection
11/11/2018

14. Industry Outlook – Trends & Opportunities
State and Federal rules and regulations are putting pressure on Financial Institutions to improve customer identification, increase consumer data protection, restrict traditional ID models (e.g., SSN)  Increased liability exposure  Incentive to act & implement new security frameworks based on Identity Management
Fight against Cyber-Terrorism – Need to strengthen the security of networks and applications
Increased level of e-Transactions will call for better ways of authentication people online (2 and 3-factor auth)
Username & Passwords are outdated, Pass-phrases are a short-term fix, remote access points are untrusted
New security models require new policies + disruptive technologies, and will emerge as pain becomes less bearable
11/11/2018

15. Thank You François Lasnier VP Banking & Retail, NAM
Schlumberger Smart Cards & Terminals
Austin, TX
Tel:
11/11/2018