No Timetable on Broad Rollout For Consumer Biometric Tools.

BOSTON -- Despite Citigroup Inc.'s deployment of fingerprint authentication for branch employees, observers are unsure when banking companies will encourage widespread consumer use of biometric technology.

Catherine Palmieri, the director of the New York company's Citibank.com unit, said last week that its system was designed to replace a cumbersome sign-in procedure. "Some branch people had to sign in to as many as 17 systems," and each system required a separate password that changes monthly, she said.

During her keynote address at the Road Maps for Growth conference here hosted by TowerGroup Inc., a Needham, Mass., unit of MasterCard International, Ms. Palmieri said Citi employees had so much difficulty remembering all their passwords that some took to keeping lists undea practice that mitigated the value of the security systems.

The fingerprint system, which let branch employees sign in to all 17 systems by putting a fingertip on a reader, was so popular that employees who used it were upset about going to a branch that didn't have it, Ms. Palmieri said. "We actually had a mutiny in the branches."

A Citigroup spokesman said it conducted a pilot test of the system two years ago, and the system has been in place at all branches for a year.

According to the spokesman, there outcry came from employees who "were unhappy when they went from a financial center that had the biometrics sign-on to one that didn't." Those employees "had come to appreciate the efficiency and the ease of biometrics."

Ms. Palmieri said the response from the employees is a sign of the growing acceptance of biometric authentication. "The adoption is going to start taking place as it becomes more convenient to just use your fingerprint to log on than to use a growing number of ever-changing passwords."

However, for many observers, a key test for biometrics in financial services may be whether customers are willing to use their fingers to gain access to their accounts.

Banks have often tested various authentication schemes with employees before offering them to consumers, but opinion is mixed over whether Citi's internal test may be seen as a precursor to a customer rollout, at Citi or another company.

"This could be a big step for biometrics," Christine Barry, a senior consultant with HighQuest Partners LLC of New York, said in a phone interview. Though a few credit unions have already experimented with biometrics, "a lot of smaller banks look to the larger banks to lead the way."

George Tubin, a senior analyst at TowerGroup, said banks could face resistance from customers that they do not face from their own staff. Though many employees are fingerprinted during the hiring process, customers often associate fingerprinting with being arrested and may not appreciate having their fingerprint data recorded, he said.

However, some companies use biometric systems in customer-facing situations. Technology Credit Union of San Jose and Purdue Federal Credit Union of West Lafayette, Ind., have fingerprint scanners in branches either at the teller window or at automated banking kiosks. And Bank of America Corp. of Charlotte and First Horizon National Corp. of Memphis use handprint scanners to grant access to some safety deposit vaults. B of A has said it uses a handprint scanner instead of a fingerprint one in part because it did not want its customers to feel like criminals.

Banks are more likely to consider using biometric systems in the branches than letting people use such systems at home for online banking, because the banks can better control the technology installed in branches, he said. For example, a criminal might try to fool a biometric system by using a less-effective fingerprint reader than the ones the bank would use at its branches, he said.

Modern scanners are sensitive enough to discern real skin from dead skin or fake fingertips, but older ones are less effective, Mr. Tubin said; some can even be fooled by a fingerprint left on a Gummi Bear.

Ms. Barry said banks could address this by providing specific scanners to customers rather than letting them buy their own, though this could prove expensive; in a branch, banks could install a scanner at a teller station that both employees and customers could use to authenticate themselves.

According to Mr. Tubin, biometrics in the branches "is going to be more of a reality than biometrics in an Internet environment in the short term."

In the corporate environment, he said, biometrics are better than tokens: devices small enough to fit on a key chain that generate sets of random characters to be used as passwords. The code changes every few seconds, so any single password quickly becomes useless, but critics say tokens are inconvenient to carry and often misplaced.

Until recently tokens have been used primarily for employee access, but financial services companies are starting to give the devices to some customers to use when logging in to online banking systems. E-Trade Financial Corp. of New York has said it offered tokens to its most valuable online customers, and Bank of America is considering them for corporate customers.

One of the key barriers to token-based systems is cost, which analysts say can range from $10 to $80 a customer each year.

"Biometrics are just better than tokens," because the costs are comparable, but biometric identifiers cannot be misplaced, Mr. Tubin said.

Ms. Barry said she does not expect a flood of banks installing fingerprint readers, but she predicted that "banks that aren't using tokens are going to use biometrics" when they invest in stronger authentication technology.

Reprints American Banker offers a complete professional reprint service, including high- quality print and electronic redistribution. Call 800-367-3989 or visit http://www.americanbanker.com/reprintservicesrates.html

(c) 2005 American Banker and SourceMedia, Inc. All rights reserved. http://www.americanbanker.com http://www.sourcemedia.com