Biometric Spoofing & Consumer Data: What are We Still Missing in Terms of ID Protection?
Passwords. They’re a necessary evil; remembering dozens of different passwords is one of the biggest hassles of the internet age.
While it’s easy to acknowledge the need to keep accounts and devices, passwords almost seem like more trouble than they’re worth sometimes. Well, there’s good news on that front: new technologies like biometrics promise to help ease the password problem.
Not only are they easier to use, but biometric security tools are remarkably more secure than traditional passwords. But still, “more secure” doesn’t mean “100% safe.”
Biometrics can still be spoofed. That’s why, in this post, we’re looking at how biometric spoofing works. We’ll see why it’s a problem, and explore some new technologies that promise even greater security.
- Address Fraud: How Criminals Swap Addresses to Abuse Victims
- How do Banks Conduct Credit Card Fraud Investigations?
- The Top 5 Prepaid Card Scams to Watch Out For in 2023
- What are Disposable Email Addresses? Do They Enable Fraud?
- Ad Fraud Killing Your Budget? Here's What You Can Do.
- What is Vishing? Tips & Red Flags for Consumers & Merchants
Biometrics: A Quick Overview
To understand how this works, it will help to take a quick look at the basics of biometrics.
When most people hear of biometrics, they think of fingerprint or facial recognition. That said, there’s actually a wide (and growing) range of techniques being used to digitally identify and validate individuals. For the most part, these can be broken into two main categories:
Most biometric systems function in a similar way: a device is used to capture and read the user’s biometric identifiers. The data is then converted to a digital numeric code, which will be compared against information on file. Details are based on two factors: how the data was acquired (or created) and the type of biometric markers being used.Learn more about biometrics
What is Biometric Spoofing?
- Biometric Spoofing
Biometric spoofing is an identity theft attack method by which a fraudster attempts to compromise a system secured by biometric detection tools. This is done by using a spoofed (i.e. fake) biometric indicator based on a sample stolen from an actual user.
[noun]/bī • ō • met • rik • spo͞of • iNG/
Used as a first, second, or third form of authentication, biometrics can be an extremely efficient and reliable way to validate an identity claim, offering far more security than passwords or PINs. Biometrics work well because they’re difficult to fake; like any security technology, however, the more popular the process becomes, the more likely fraudsters will try to hijack it for their own gain.
Biometric spoofing refers to any scheme by which a fraudster defeats biometric data validation and impersonates another individual. For instance, using a fake fingerprint to unlock a device is an example of biometric spoofing. The same applies for using means like deepfake technology to bypass facial recognition technology.
While preventative techniques continue to improve, there are still a number of ways to defeat biometric systems, as we’ll see in the next section.
In 2002, Japanese researcher Tsutomu Matsumoto was curious to see how easily he could spoof a biometric identity. He managed to capture a latent fingerprint on glass, using just gelatin from a Gummy Bear candy and a plastic mold. This fingerprint was “real” enough to fool a fingerprint sensor in 80% of cases.
How Does Biometric Spoofing Work?
As an example of how biometric spoofing works, let’s look at one of the most commonly used techniques: fingerprint recognition.
Modern systems are considerably harder to fool than older ones. That said, there are still many ways to copy or create workable imitation fingerprints using a range of easily accessed materials. An individual’s fingerprints can be captured using:
Again, many of these techniques (and others) will only work with older scanners. However, the more widespread use of biometric technology is incentivizing fraudsters to do their research and discover new methods of defeating these systems.
New tech is making other biometric verification methods open to attacks. Fraudsters now have means to defeat iris, vein, and even DNA-based systems.
Even scarier? With the right biometric hacking software, fraudsters may also be able to create AI-generated deepfakes that register as authentic human beings. Deepfakes use a form of artificial intelligence (or “deep learning”) to produce bogus images of fingerprints, retinal patterns, and so on. Advanced deepfake technology can even create convincing fictional photo profiles from scratch.
The only resource you need to become an expert on chargebacks, customer disputes, and friendly fraud.Download the Guide
What Makes Biometric Spoofing Different From Other Threats?
When functioning correctly, there are many advantages to using biometrics as a form of authentication.
Unlike static forms of authentication, biometric identification is intrinsic to an individual. It cannot be lost or transferred. It is person-specific, and is easy to use. But, all these benefits depend on systems being implemented and performing correctly.
If things go awry, biometrics theft can cause more trouble for its victim than identity theft. With the latter, fraudsters steal an online profile. If biometrics are stolen, they take the entire victim, for all intents and purposes.
Think about it: if personal information gets out, passwords and account numbers can be changed. That’s not the case with biometric data. You can’t switch out your face or fingerprint; that information is permanent, and as such, is permanently compromised.
In January 2012, a journalist successfully spoofed a biometrics device used for immigration clearance at the Hong Kong-China border. His biometric hacking tool? A fingerprint cast bought online for less than $15.
Biometrics information is essentially available everywhere. Wherever people go, they leave fingerprints behind on door handles, chairs, tables, or any other surface they touch. And procedural television crime dramas have shown fraudsters multiple ways to lift those prints for misuse.
Human uniqueness increases the difficulty of using capturing and reproducing biometric data, but the potential is still there. Accounts can be created with stolen fingerprints, as can “Frankenstein” profiles that combine fake prints with data from other users.
It gets worse. Researchers from NYU have demonstrated that by manually combining various features and characteristics, they can create a “master print,” or a fingerprint that can work for multiple people. That technology could function as a type of “skeleton key” to access a myriad of different systems.
How Much of a Threat is Biometric Spoofing?
At this stage: a moderate threat.
Identifying which specific person or persons have access to the correct data is comparatively easy. The same can be said about finding what kind of biometric reader is being used by the intended victim. Getting workable data, on the other hand, is more troublesome.
Biometric marker information is stored in secured databases, and like all digital storage methods, these are vulnerable to hacking. Modern biometric systems have rigid encryption protocols for the depersonification of information, though.
Personal data, biometric templates, photographs, and more are stored in separate databases. A professional hacker may steal the info, but tying all the pieces together would be next to impossible.
Biometric information from a large data breach may actually pose less of a risk than individual, dedicated fraudsters. A scammer targeting one, specific individual with silly putty is more dangerous than a hacker, from a biometric standpoint. That doesn’t mean, however, that data breaches can’t happen.
In one instance, the fingerprints, admin panels, dashboards, facial recognition data, face photos of users, unencrypted usernames and passwords of over 1 million people were discovered on a publicly accessible database.
Spoofing personal traits is not the easiest way to commit fraud. Criminals are likely to try other channels or even other targets before attempting to bypass biometric security. Nonetheless, the threat is real.
Can Biometric Spoofing Be Prevented?
If they can bypass biometric roadblocks, fraudsters can access consumers’ most sensitive and vulnerable information. Anything from digital wallets and bank accounts to Social Security numbers, birthdates, and more could be at risk.
A spoof-proof biometrics authentication system doesn’t exist, but it’s not because developers aren’t trying. A couple of the more promising solutions for biometrics fraud are multi-model systems and liveness detection:
In this exclusive guide, we outline the 50 most effective tools and strategies to reduce the overall number of chargebacks you receive.Get the FREE guide
Even with this advancing technology, future ID prevention solutions still need to expand beyond conventional thinking.
Not all protection lies in biometric programs. Strategies must also incorporate such factors as scanner intelligence and geolocation capabilities.
Gauging the physical actions of the purchaser is great. That said, it would be better to include ongoing behavioral patterns that make up their purchasing history. Where and when they shop, for example, along with the profile and location of the merchant. These behavioral indicators could be the key to making biometrics a more perfect solution.
A Final Word
Unless a merchant is actively using some type of biometric identification themselves, most information on the subject is rhetorical. While over 75% of Americans have used biometric technology of some kind, widespread adoption is mostly in the areas of healthcare, banking, and law enforcement. Its use by merchants for payment authentication is still limited.
Biometrics alone are not a silver bullet to safeguarding identity. In cases of consumer fraud, it’s good to keep in mind that biometric spoofing is only one of many threats. Even if biometrics were a common verification method, it still wouldn’t help at all with post-transaction fraud such as chargeback abuse.
In the end, no single method can provide all the fraud management merchants need. The only real solution is to combine the right tools and strategies to optimize all fraud strategies.
Can fingerprints be spoofed?
Yes. At the moment, fingerprint spoofing is technically possible, but biometric technology continues to evolve, and new techniques – combining multiple biometric authenticators, for example – promise additional protections. For now, most fraudsters still gravitate to more easily hacked protocols, such as passwords.
What is biometric spoofing?
Biometric spoofing is a term for illegally gaining access to user data by faking biometric identifiers (fingerprints, facial recognition, etc.).
Can biometric systems be hacked?
In a manner of speaking, yes. Biometrics are among the best data protections available, but to date, no form of authentication has proven to be 100% secure. With the right tools and knowledge, hackers may still be able to access information by duplicating someone's biometric signature.
What happens if biometric data is stolen?
Leaked credit card or account data can be reported and fixed by changing numbers; stolen biometric data is trickier, since people can’t easily change their face or fingerprints. Admittedly, that feature makes it hard for fraudsters to use the information, but, if the metadata associated with the bio-data were also leaked, cyber thieves might be able to access accounts in that manner.
What are the main types of biometrics?
Biometrics can cover a wide range of methods. The two main categories are physiological biometrics and behavioral biometrics. The former is more common, and refers to unique physical characteristics, such as facial recognition, fingerprints or finger geometry, retina or iris scan, and finger/hand veins. A type of behavioral biometrics would be keystroke dynamics, which measures the time it takes to press each key, delays between keys, characters typed per minute, and so on.