How EMVCo is Supporting the Development of Biometric Payment Cards

Consumer and industry interest in biometric payment cards is building. The pandemic transformed consumer behaviour and drove demand for touch-free payment methods, with the growing popularity of mobile payment solutions meaning consumers are more familiar and comfortable with biometrics for payments. Issuers are also exploring how biometric payment cards can help them to differentiate, while recent advances to biometric on card solution designs are leading to production efficiencies. Amid these developments, there is growing industry consensus around the benefits that could be realised by promoting increased consistency and alignment across the requirements and testing processes for biometric payment cards. In this EMV® Insights post, Jianhua Ni, Chair of the EMVCo Consumer Device Cardholder Verification Methods (CDCVM) Task Force, explores how EMVCo’s ‘Biometric on Card’ initiative is responding to this industry demand, and can further support seamless and secure payments globally. What is a biometric payment card and how does it work? Biometric payment cards include a sensor that captures the cardholder’s fingerprint as the card is inserted or tapped during the payment transaction. The fingerprint is then matched with a reference value. If it’s a match, the cardholder is authenticated. What are the current challenges associated with biometric payment cards? Using biometric cards for in-store payments presents unique performance and security considerations to successfully balance trust and convenience. However, performance and security requirements for biometric payment cards have evolved organically across the different payment systems, leading to variations that increase the cost and complexity of developing, testing and deploying solutions. Why is EMVCo best-placed to develop requirements and testing for biometric payment cards? EMVCo creates, evolves and promotes technical specifications for EMV payment cards to work seamlessly and securely, and has a proven record facilitating the approval and evaluation of these products to test for compliance with the EMV Specifications, EMVCo functional requirements, and EMVCo security requirements and guidelines. When talking about biometric payment cards, it is also important to understand Cardholder Verification Methods (CVM) and Consumer Device Cardholder Verification Methods (CDCVM). A CVM is used to confirm whether the person presenting a payment card is the legitimate cardholder. When an individual enters a PIN to authorise a transaction, they are providing a CVM. The growing use of mobile devices for payments has enabled consumer authentication to be performed on a consumer’s own device via passcodes, passwords and patterns, as well as biometrics such as fingerprint, iris, voice and facial recognition. This type of authentication on a consumer device is known as a CDCVM, and technologies that enable CDCVM are called CDCVM solutions. Over recent years, EMVCo has successfully worked to promote confidence and consistency across CDCVM solutions by identifying and addressing the specific security, functional and performance needs to enable seamless and secure payments. Supporting the growing use of biometric payment cards marks a natural evolution of this activity and similar principles apply, with the biometric payment card serving as the ‘consumer device’ and the fingerprint as the authentication method. Given these considerations, EMVCo has received direct feedback from Associates, Subscribers and the wider payments community about the potential benefits of promoting increased consistency and alignment. Following this feedback, EMVCo launched its ‘Biometric on Card’ initiative. What is the scope of EMVCo’s ‘Biometric on Card’ initiative? EMVCo has engaged with the industry to explore the development of performance and security requirements for Biometric on Card, as well as the supporting approval and evaluation frameworks, that wil