Japanese bank uses biometrics to boost security

Japan's third-largest bank, The Bank of Tokyo-Mitsubishi, will deploy a biometric security system based on vein-pattern...

Japan's third-largest bank, The Bank of Tokyo-Mitsubishi, will deploy a biometric security system based on vein-pattern recognition technology in branches nationwide in October.

The bank will start issuing Visa credit cards with embedded integrated circuits that contain customer vein-pattern information and work with a system developed by Fujitsu.

The cards will be used to confirm the identity of customers when, for example, they want to use ATMs. The cards will be issued from 12 October, and customers will be able to use them at 267 of the bank's branches nationwide, according to a bank spokesman.

The bank did not disclose how many ATMs in each branch would be compatible with the system.
The cards function as cash cards, credit cards, and as electronic money. Palm vein patterns are read whenever cardholders use ATMs or make transactions at bank counters.

The vein-pattern technology works by shining light in the near-infrared region (the infrared region closest to visible light) on customers' palms.

The palms are held about 4cm above a scanner, which takes a snapshot of the palm, illuminating the vein patterns just below the skin. This unique pattern information becomes the basis for security applications.

The information can then be loaded into a server or, as Tokyo-Mitsubishi has done, put into an integrated circuit embedded in cash or credit cards. Users who register their identities need to have their palms scanned and the data downloaded to the cards.

To identify themselves to an ATM, card carriers place their wrist on a cradle above a scanner, a small box bolted next to the machine's input screen connected to the ATM by USB (Universal Serial Bus). When using the card at ATM, the scan usually takes about a second, according to the spokesman.

"The users' personal identification number is still required, because we wanted to make the system as secure as possible," the spokesman said.

This is the second major sale of the technology to a Japanese bank. The first, in June 2004, was with Suruga Bank, which has already installed a version of the system in 65 of its branches. Suruga, a regional Japanese bank, uses the system for over-the-counter transactions.

The Bank of Tokyo-Mitsubishi forecasts it will issue up to one million of the new cards each year after launch in October.

The bank said that it was satisfied with the security and robustness of the system after feedback from customers following a trail that used eight demonstration ATMs installed in branches in metropolitan Tokyo.

The bank trialed two types of biometrics technologies, one using the vein-pattern recognition system, and the other using finger print scanners. Of 1,000 customers polled, about 90% of respondents said that they felt comfortable adopting the vein-pattern reading system, according to the bank.

"In the poll, we asked customers what sort of biometric security they would be most comfortable with, and the vein pattern recognition technology was seen as acceptable by many customers," said the bank spokesman.

Fujitsu has been promoting the system as more secure than four-digit personal identification numbers (Pins) which can be seen by criminals who steal customer cards and use them to steal money.

In a demonstration of the system in Tokyo in August, withdrawing cash took about three to four seconds, about  the same time as inserting the card and punching in a Pin.

Fujitsu first demonstrated its vein-pattern reading technology in 2002 when it showed a computer mouse prototype. Users put their palm on the mouse to log into the PC. Fujitsu has said that it is looking to use the system in other applications, for example car keys, and to promote the system overseas.

Paul Kallender writes for IDG News Service

Read more on IT risk management