The rise of mobile payments has made buying things with your fingerprint commonplace, so why not put that technology in a credit card? Mastercard thinks it’s worth a shot, and has built a credit card with a fingerprint scanner built right into the bottom. The card is no thicker than normal, and lets users authorize their payments with a touch, rather than using a PIN or signature.
The company says the card works with all existing chip-and-PIN readers (no magnetic stripe-only terminals), and is currently being trialled in South Africa. Additional trials are planned for Europe and the Asia-Pacific region in coming months, with a “full roll out expected later this year.” In a press release, Mastercard’s chief of security Ajay Bhalla said the card would offer customers “additional convenience and security.”
However, Bhalla’s claim that a fingerprint is “not something that can be taken or replicated” is just wrong. As we found out when fingerprint scanners were introduced on phones, it’s actually pretty easy to steal and fake someone’s fingerprint. You can do it just with a dental mold and a bit of play-dough, and once someone has your fingerprint, they’ve got it for life. You can’t change it as easily as you can a PIN or a password.
That being said, some security experts say a fingerprint might still be better than a PIN. “With the combination of chip and PIN, the PIN is the weaker element. Using a fingerprint gets rid of that,” Karsten Nohl, chief scientist at Berlin's Security Research Labs, told BBC News. “Fingerprints have helped us avoid using terrible passwords, and even the most gullible person is not going to cut off their finger if [a criminal] asks nicely.”
To get one of the new cards, customers will have to visit an enrollment center (probably a bank), where their fingerprint will be scanned and transfer onto their card. It’ll be stored as encrypted data on the card’s EMV chip, and users will be able to save up to two prints (although you can’t put a print from someone else’s hand on there).