Biometric SpoofingSafer Authentication Protocols Might Not Be Enough

Biometric Spoofing & Consumer Data: What are We Still Missing in Terms of ID Protection?

Passwords. They’re a necessary evil; remembering dozens of different passwords is one of the biggest hassles of the internet age.

While it’s easy to acknowledge the need to keep accounts and devices, passwords almost seem like more trouble than they’re worth sometimes. Well, there’s good news on that front: new technologies like biometrics promise to help ease the password problem. 

Not only are they easier to use,  but biometric security tools are remarkably more secure than traditional passwords. But still, “more secure” doesn’t mean “100% safe.”

Biometrics can still be spoofed. That’s why, in this post, we’re looking at how biometric spoofing works. We’ll see why it’s a problem, and explore some new technologies that promise even greater security.

Biometrics: A Quick Overview

To understand how this works, it will help to take a quick look at the basics of biometrics.

When most people hear of biometrics, they think of fingerprint or facial recognition. That said, there’s actually a wide (and growing) range of techniques being used to digitally identify and validate individuals. For the most part, these can be broken into two main categories: 

Most biometric systems function in a similar way: a device is used to capture and read the user’s biometric identifiers. The data is then converted to a digital numeric code, which will be compared against information on file. Details are based on two factors: how the data was acquired (or created) and the type of biometric markers being used.

Learn more about biometrics

What is Biometric Spoofing?

Biometric Spoofing

[noun]/bī • ō • met • rik • spo͞of • iNG/

Biometric spoofing is an identity theft attack method by which a fraudster attempts to compromise a system secured by biometric detection tools. This is done by using a spoofed (i.e. fake) biometric indicator based on a sample stolen from an actual user.

Used as a first, second, or third form of authentication, biometrics can be an extremely efficient and reliable way to validate an identity claim, offering far more security than passwords or PINs. Biometrics work well because they’re difficult to fake; like any security technology, however, the more popular the process becomes, the more likely fraudsters will try to hijack it for their own gain.

Biometric spoofing refers to any scheme by which a fraudster defeats biometric data validation and impersonates another individual. For instance, using a fake fingerprint to unlock a device is an example of biometric spoofing. The same applies for using means like deepfake technology to bypass facial recognition technology.

While preventative techniques continue to improve, there are still a number of ways to defeat biometric systems, as we’ll see in the next section.

How Does Biometric Spoofing Work?

As an example of how biometric spoofing works, let’s look at one of the most commonly used techniques: fingerprint recognition.

Modern systems are considerably harder to fool than older ones. That said, there are still many ways to copy or create workable imitation fingerprints using a range of easily accessed materials. An individual’s fingerprints can be captured using:

Again, many of these techniques (and others) will only work with older scanners. However, the more widespread use of biometric technology is incentivizing fraudsters to do their research and discover new methods of defeating these systems.

New tech is making other biometric verification methods open to attacks. Fraudsters now have means to defeat iris, vein, and even DNA-based systems.

Even scarier? With the right biometric hacking software, fraudsters may also be able to create AI-generated deepfakes that register as authentic human beings. Deepfakes use a form of artificial intelligence (or “deep learning”) to produce bogus images of fingerprints, retinal patterns, and so on. Advanced deepfake technology can even create convincing fictional photo profiles from scratch.

What Makes Biometric Spoofing Different From Other Threats?

When functioning correctly, there are many advantages to using biometrics as a form of authentication.

Unlike static forms of authentication, biometric identification is intrinsic to an individual. It cannot be lost or transferred. It is person-specific, and is easy to use. But, all these benefits depend on systems being implemented and performing correctly.

If things go awry, biometrics theft can cause more trouble for its victim than identity theft. With the latter, fraudsters steal an online profile. If biometrics are stolen, they take the entire victim, for all intents and purposes.

Think about it: if personal information gets out, passwords and account numbers can be changed. That’s not the case with biometric data. You can’t switch out your face or fingerprint; that information is permanent, and as such, is permanently compromised.

Biometrics information is essentially available everywhere. Wherever people go, they leave fingerprints behind on door handles, chairs, tables, or any other surface they touch. And procedural television crime dramas have shown fraudsters multiple ways to lift those prints for misuse.

Human uniqueness increases the difficulty of using capturing and reproducing biometric data, but the potential is still there. Accounts can be created with stolen fingerprints, as can “Frankenstein” profiles that combine fake prints with data from other users.

It gets worse. Researchers from NYU have demonstrated that by manually combining various features and characteristics, they can create a “master print,” or a fingerprint that can work for multiple people. That technology could function as a type of “skeleton key” to access a myriad of different systems.

How Much of a Threat is Biometric Spoofing?

At this stage: a moderate threat.

Identifying which specific person or persons have access to the correct data is comparatively easy. The same can be said about finding what kind of biometric reader is being used by the intended victim. Getting workable data, on the other hand, is more troublesome.

Biometric marker information is stored in secured databases, and like all digital storage methods, these are vulnerable to hacking. Modern biometric systems have rigid encryption protocols for the depersonification of information, though.

Personal data, biometric templates, photographs, and more are stored in separate databases. A professional hacker may steal the info, but tying all the pieces together would be next to impossible.

Biometric information from a large data breach may actually pose less of a risk than individual, dedicated fraudsters. A scammer targeting one, specific individual with silly putty is more dangerous than a hacker, from a biometric standpoint. That doesn’t mean, however, that data breaches can’t happen.

Spoofing personal traits is not the easiest way to commit fraud. Criminals are likely to try other channels or even other targets before attempting to bypass biometric security. Nonetheless, the threat is real.

Can Biometric Spoofing Be Prevented?

If they can bypass biometric roadblocks, fraudsters can access consumers’ most sensitive and vulnerable information. Anything from digital wallets and bank accounts to Social Security numbers, birthdates, and more could be at risk.

A spoof-proof biometrics authentication system doesn’t exist, but it’s not because developers aren’t trying. A couple of the more promising solutions for biometrics fraud are multi-model systems and liveness detection:

Even with this advancing technology, future ID prevention solutions still need to expand beyond conventional thinking.

Not all protection lies in biometric programs. Strategies must also incorporate such factors as scanner intelligence and geolocation capabilities.

Gauging the physical actions of the purchaser is great. That said, it would be better to include ongoing behavioral patterns that make up their purchasing history. Where and when they shop, for example, along with the profile and location of the merchant. These behavioral indicators could be the key to making biometrics a more perfect solution.

A Final Word

Unless a merchant is actively using some type of biometric identification themselves, most information on the subject is rhetorical. While over 75% of Americans have used biometric technology of some kind, widespread adoption is mostly in the areas of healthcare, banking, and law enforcement. Its use by merchants for payment authentication is still limited.

Biometrics alone are not a silver bullet to safeguarding identity. In cases of consumer fraud, it’s good to keep in mind that biometric spoofing is only one of many threats. Even if biometrics were a common verification method, it still wouldn’t help at all with post-transaction fraud such as chargeback abuse.

In the end, no single method can provide all the fraud management merchants need. The only real solution is to combine the right tools and strategies to optimize all fraud strategies.