The Singapore launch of ATMs using face recognition instead of cards and PIN codes actually requires a whole-of-nation framework to work.

The typical automatic teller machine (ATMs) requires users to insert the bank card, key in a personal identification number (PIN), and—under the watchful closed-circuit camera—proceed to perform various banking transactions.

Now, amid the pandemic, one bank in Singapore has just launched new ATMs that require only facial recognition and an identity card number for access. This month, OCBC Bank is launching the first batch of such ATM machines in eight locations around the island. The facial recognition/verification process is linked to the national biometric database, SingPass.

Only when the facial scan is verified, will the customer be allowed to proceed with banking transactions. This simplified process does away with the use of cards or PINs, which is faster than the card insertion and PIN entry method. Since the process does not involve contact with keypads and cards, it can also reduce infection pathways.

Is this the future of ATMs?

According to Kanv Pandit, Group Managing Director (APAC) Banking Solutions, FIS, people have already become comfortable with a variety of common biometric authentication methods such as fingerprint recognition. With the need for contactless transactions amid the current pandemic, consumers may even expect a quicker, more convenient, and contactless experience.

“While cash use is in decline, our own findings suggest that cash is still one of the most popular payment methods, accounting for over a quarter of transactions. As long as cash continues to fill consumers’ needs, ATMs remain a critical delivery channel. While in no danger of disappearing, ATMs must evolve to address challenges such as fraud, principally skimming. Facial recognition technology will not only reduce transaction time for customers, but more importantly it will enable better security as it removes the need for a physical card or PIN, thus reducing the likelihood of hacking or misuse.

What about the cybersecurity angle?

Notwithstanding the unique safety benefits of facial biometrics over PIN codes, are there vulnerabilities involved?

According to Jeffrey Kok, Vice President Solution Engineers, CyberArk Asia Pacific and Japan, with the roll out of every new technology, there will be new risks exposed and risk mitigation methods that need to be adopted. “For instance, criminals determined to steal from a victim can no longer simply attempt to steal an ATM card, but will need to force victims to visit the ATM to withdraw money. In addition, as biometric technology advances, so will the attackers’ levels of sophistication as they develop new social engineering and attack vectors.”

Kok said this risk can be mitigated by strong law enforcement measures, public cyber safety education and the surveillance methods that protect ATM infrastructure. “On top of that, OCBC has been using facial recognition for the past three years and would have been prepared for this wider rollout by strengthening security controls.”

Nevertheless, Kok said there will likely be privacy concerns around facial verification and accuracies around the technology. The possibilities of false positives and false negatives will have an impact on consumer confidence. These can be mitigated with more comprehensive public education around the facial verification technology as well as the security measures built around it.

Given all these points, it is fair to conclude that facial recognition in ATMs only works well if the city already a national register of biometric data, strong risk management mandates, widespread supporting infrastructure, law enforcement and low crime rate. While it may be practicable in Singapore, its success cannot be guaranteed in other countries, for now.