MasterCard Expanding 'Selfie Pay' Following Successful Pilot Program

[MacRumors]

After an announcement last August and a successful pilot program in October, MasterCard recently announced that the company will begin expanding a feature which allows facial recognition software to act as biometric security in mobile payments (via Fortune). Unofficially dubbed "selfie pay," the program lets users confirm an online payment by holding up a smartphone's camera to their face and blinking to ensure the program isn't being duped by a still photograph.

The process would take place within MasterCard's own Identity Check app (currently unavailable in the United States) and is built to streamline the verification process of lengthy digital purchases, superseding the need for a MasterCard's PIN number or password with a quick selfie. The United Kingdom will be one of 14 total countries targeted for the summer rollout, but beyond the pilot program's support of First Tech Federal Credit Union, the expansion of supported banks was not listed.

One big motivation behind Mastercard's expansion of its selfie pay tool is cutting down false declines, which occur when a legitimate transaction is rejected because of suspected fraud. These instances cost the company some $118 billion per year--13 times more than the cost of actual fraud.

MasterCard isn't looking solely at selfies to confirm purchases, however. Last year, the company began testing a feature that worked in tandem with the Nymi band to verify mobile transactions through a user's unique heartbeat. At the time, Nymi said that its biometric technology could potentially be implemented into existing wearables for a wider adoption, but MasterCard's current focus sits on the summer's rollout of its facial recognition feature.

Article Link: MasterCard Expanding 'Selfie Pay' Following Successful Pilot Program

 

[zz2k9]

This is pretty cool, apart from the looks you'll get...

Expect Barclays to adopt this in...never

 

[andycr]

Ok, so get a video of the target, freeze frame them just before a blink and during, and swap between photos one and two every half second or so. Pretty sure that would break their 'security'.

 

[v0lume4]

So its really called Selfie Pay. Huh.

 

[macduke]

I hope this app doesn't let you retake your selfie because I could see my little sister doing this for 15 minutes while in line. I'm not joking. I really hope Apple Pay takes off at more retailers. This would erase all of their fraud concerns while streamlining the entire checkout process. I use it several times per week and it's a breeze—especially on my AW. But I can't blame them for making this at this point in time. It's one of their only options using an app without deeper hardware access. I just don't like the idea of it and think it will slow down checkout time for the rest of us having to open a special app and take a selfie.

 

[DCJ001]

" superseding the need for a MasterCard's PIN number"

Personal Identification Number number?

 

[macduke]

Ok, so get a video of the target, freeze frame them just before a blink and during, and swap between photos one and two every half second or so. Pretty sure that would break their 'security'.

Haha yep—except that retail employees might be trained to look for people doing weird tricks like this. It would come down to the human element to keep the fraud at bay. That's why Apple Pay is so fantastic. Works great at self-checkout and eliminates human error.

 

[69Mustang]

Ok, so get a video of the target, freeze frame them just before a blink and during, and swap between photos one and two every half second or so. Pretty sure that would break their 'security'.

Not sure if serious. Please say no.

 

[macduke]

" superseding the need for a MasterCard's PIN number"

Personal Identification Number number?

I'm in favor of calling it the pi number. Now I'm hungry—and not for math. Just don't set it to 3141!

 

[stulaw11]

or fingerprint.

Fingerprint is proven to be tough to crack; much harder than a selfie and starting to be built into most phones. Nothing is 100% obviously.

 

[Googlyhead]

Probably instantly defeated by Live Photos.
If you've stolen the account, look up the user for any selfies. Either hope for a live one, or simply animate one yourself. Would the software be able to identify a "real" blink?

 

[DingoDance]

This sounds like an article from The Onion

 

[69Mustang]

Haha yep—except that retail employees might be trained to look for people doing weird tricks like this.

That and the fact that I'm pretty sure facial rec takes the size of an actual face under consideration. There's a whole host of wrong with andy's comment. The least of which would be the refresh rate of the of the video source being held up to the camera. I gotta think Andy was making a funny.

 

[djbuddha]

Wow I slept for over a month, it's April 1st right?

 

[69Mustang]

Probably instantly defeated by Live Photos.
If you've stolen the account, look up the user for any selfies. Either hope for a live one, or simply animate one yourself. Would the software be able to identify a "real" blink?

Why are people coming up with ideas that make no sense? How is the camera going to see a live photo? How are you going to leave the payment app to go get a live photo? How a...

 

[macduke]

That and the fact that I'm pretty sure facial rec takes the size of an actual face under consideration. There's a whole host of wrong with andy's comment. The least of which would be the refresh rate of the of the video source being held up to the camera. I gotta think Andy was making a funny.

I wouldn't underestimate how inept large corporations can be when implementing security. When I was a teen Sony came out with these special copy proof discs. How were they bypassed? By using a marker. You would hope that they would take everything into account. If you had a video playing on a phablet or tablet and could get your phone to focus close enough the face might not look that small. People often post videos of themselves online, along with all their personal information and location. So you could get a large video. I would say that it might be possible. What would be more difficult to crack is having them move their head around to build a depth map. Some apps are able to do this but with mixed results—especially in poor lighting. Hopefully smartphones add depth sensors someday. Could be used with super-fast camera modules to take a series of photos at different focal lengths and create refocus-able images, or to map interior spaces in 3D. I think Apple has some patents on the latter.

 

[Iconoclysm]

Ok, so get a video of the target, freeze frame them just before a blink and during, and swap between photos one and two every half second or so. Pretty sure that would break their 'security'.

Or, just hold up another smartphone with that video.

 

[iGeek2014]

As previously posted biometrics aren't 100% foolproof but I feel more than aOK using Apple Pay on my phone/watch than I ever would taking a "selfie".

As for the poster who mentioned Barclays... Barclaycard UK are ditching MasterCard credit cards altogether and unifying them under Visa so you are right... They won't ever adopt it!

 

[69Mustang]

I wouldn't underestimate how inept large corporations can be when implementing security. When I was a teen Sony came out with these special copy proof discs. How were they bypassed? By using a marker. You would hope that they would take everything into account. If you had a video playing on a phablet or tablet and could get your phone to focus close enough the face might not look that small. People often post videos of themselves online, along with all their personal information and location. So you could get a large video. I would say that it might be possible. What would be more difficult to crack is having them move their head around to build a depth map. Some apps are able to do this but with mixed results—especially in poor lighting. Hopefully smartphones add depth sensors someday. Could be used with super-fast camera modules to take a series of photos at different focal lengths and create refocus-able images, or to map interior spaces in 3D. I think Apple has some patents on the latter.

Even the video idea stretches the realm of reality. You'd need a video of a person staring at a camera at a reasonably close range and blinking. Then you'd need the tablet to approximate the size of the face and have the selfie pay ignore the face being framed by the tablet bezel. That's asking for a lot of stupidity from MC for something like that to work. The Sony disk/marker defeat is an orange to this apple. But hey, anything is possible. The defeat suggestions coming from this thread are among the least possible imo.

 

[Iconoclysm]

Even the video idea stretches the realm of reality. You'd need a video of a person staring at a camera at a reasonably close range and blinking. Then you'd need the tablet to approximate the size of the face and have the selfie pay ignore the face being framed by the tablet bezel. That's asking for a lot of stupidity from MC for something like that to work. The Sony disk/marker defeat is an orange to this apple. But hey, anything is possible. The defeat suggestions coming from this thread are among the least possible imo.

All you need is a current selfie live photo. If you know the person, that makes it really easy...hell, maybe easier if you just met them. You're really, really stretching how difficult this is and how secure this method is.

 

[xotigu]

What in the world is going on

 

[carrrrrlos]

Kardashians everywhere rejoice.

 

[69Mustang]

All you need is a current selfie live photo. If you know the person, that makes it really easy...hell, maybe easier if you just met them. You're really, really stretching how difficult this is and how secure this method is.

Maybe I am. But I've made no claim to the level of security per se. I have implied the ease of defeating the security isn't as trivial as some in this thread have claimed. Can you walk me through how this proposed defeat would work? I'm interested in the thought process that leads to live photo being a possible vector. No snark.

 

[mgmusicman94]

" superseding the need for a MasterCard's PIN number"

Personal Identification Number number?

Yeah that thing you type into the ATM Machine

 

[naeS1Sean]

That's pretty cool...