If I won’t give Amazon my palm print to pay at Whole Foods, why the f would I give Mastercard a pair of retinal scans?
Seems like MC executives grew up on “Minority Report” and thought, damn this is a good idea!
Seems like MC executives grew up on “Minority Report” and thought, damn this is a good idea!
It requires a decent camera with very good optics or short distance from your eyes to get a meaningful identification, so your casual CCTV mass surveillance isn't a problem. If I want anonymity, irises are going to be very low on my list of potential worries.
Also, I consider those to be public data (just like my face, fingerprints, overall appearance, voice or DNA), because anyone willing within a reasonable proximity can get this data anyway and there's no stopping it. So, if some company wants to use that as an authenticator... well, that's a stupid idea that I would protest for anything sensitive (unauthorized access to which could actually cause me some griefs), but as long as it's not my liability (and for a credit card it is not - fraud disputes aren't fun but it's not my money either) they can do... whatever, I guess.
Or am I missing something?
And if some credit organization or airport security says they're fine with using it - I see this as their risks, not mine. And giving them my biometrics isn't hurting me because I won't use it for anything I care about. Unless, of course, I'll be forced to, somehow - but I doubt that's likely.
I see MasterCard doing this as they estimated a risk-to-profit factor to be satisfactorily low. My overall impression of banking/finance industry is that they're very different when it comes to security - they tend to have what we'd call poor security practices, but they compensate this by taking responsibility for when things fail, swallowing the losses (cheaper than upgrading everyone and everything) and just making sure they earn more than they lose. It's more prominent in US (where half of the industry relies on knowing last four of secret SSN number that you have to share-not-share with a lot of companies, and some very "secret" questions like my birthday - and the economy still works somehow!) than in EU, though.
The security issue.
I.e., Mastercard treats their technology as infallible and the people who find an exploit select you as the victim. Mastercard fails to take responsibility and continues to allow you to be exploited with absolutely no mechanism to defend yourself.
Credit card numbers can be changed a lot easier than eyeballs can be.
They're not unlikely to claim that it was me because machine reports seeing my eyes (because it doesn't hurt them to try to deny the claim), but generally industry is well aware that fraud exists.
> Mastercard fails to take responsibility and continues to allow you to be exploited
True for debit, but for credit the idea is that it's card issuer's problem if they still authorize those biometrics-authenticated transactions afterwards. The most probable scenario is that they'll immediately block the card and ability to use biometric payments after receiving the fraud report. Then start figuring out what happened.
So, I guess, as long as I don't have all eggs in one basket (MasterCard), I will be inconvenienced but not really exploited.
And given that it's not exactly trivial to quietly steal then impersonate someone's eyes and face, until that actually happens (low-probability event) it seems convenient to pay (high-frequency event) without reaching for a wallet or device.
Isn't it the reverse, with the issuer declining fraud allegations as they can "prove" you originated the transaction ?
That's the building block of 3DSecure and other additional authentication, where the merchant is protected from chargebacks in exchange for pushing stronger check on the customer.
Also, in my experience, when a fraudulent transaction happens, banks tend to not challenge it much. When someone impersonated my card (I'm not sure but I suspect it was a BIN stuffing attack, since it was a sock drawer card) they just handled it without any issues.
3-D Secure shifts the risk/convenience balance and adds additional security checks, but it doesn't make customers liable for fraud.
I trust federal agencies more than private corporations, having seen the inside of both.