Credit card firm Mastercard has confirmed it will accept selfie photos and fingerprints as an alternative to passwords when verifying IDs for online payments.
It follows a trial of the software carried out in the US and Netherlands last year.
The company told the BBC that 92% of its test subjects preferred the new system to passwords.
One expert said that such biometric checks had the potential to cut fraud.
However, some security researchers have questioned how easy it might be to spoof the system.
Blink test
Mastercard announced the move at the Mobile World Congress tech show in Barcelona.
It said the rollout this summer would involve the UK, US, Canada, Netherlands, Belgium, Spain, Italy, France, Germany, Switzerland, Norway, Sweden, Finland and Denmark.
It explained that members of the public would have to download an application to their PC, tablet or smartphone to use the system.
When they make an online purchase, they will still need to provide their credit card details as normal.
But if a further authentication check is required, they will be asked to look at their phone’s camera or use its fingerprint sensor rather than be told to type in selected letters from their password, as is the case at the moment.
If the user opts for a selfie, they will have to blink into the camera to prove they are not just holding up a photo.
“Consumers hate passwords,” declared Ajay Bhalla, chief of the firm’s safety and security division.
“We know the most commonly used password is 123456, so they are not secure, and people also use the same passwords for multiple sites. If one site gets hacked all the places that you use the same password get compromised – they are a big pain.
“In the modern world everyone has a mobile phone and there is internet connectivity everywhere. So, we should be able to use biometrics [instead] to authenticate ourselves.”
Compromised checks
Mastercard is far from the only firm experimenting with facial scans as authentication tools.
China’s e-commerce giant Alibaba recently demoed a pay-with-your-face system of its own.
And both Microsoft’s Windows 10 and Google’s Android operating systems already allow users to unlock devices by looking at their cameras.
Security researchers have pointed out that both facial scans and fingerprint sensors can be compromised.
Even so, Mastercard insists its other security mechanisms should be able to prevent or at least detect suspicious behaviour.
In addition, it says the facial scans and fingerprint data will not be transmitted in a form that could be intercepted, stolen or used by scammers.
Battling fraud
Smart wallet systems including Apple Pay, Samsung Pay and Android Pay have already introduced consumers to the concept of using their fingerprints to authorise payments.
Many Japanese bank ATMs also have a reader that scans the vein patterns beneath customers’ fingers to let them withdraw cash.
One expert said other biometric tests could soon become the norm.
“Having one or more required authentication factors tied to who you are rather than what you know is going to become critical,” said Windsor Holden from the tech consultancy Juniper Research.
“The problem with online payments has always been that the card doesn’t need to be present, hence the credit card companies have charged more for the transactions to cover the costs of fraud.
“If they can introduce a mechanism that makes the system more secure than merely asking for a password, then the hope would be that fraud levels decrease and the savings can be passed back onto merchants, and perhaps consumers too.”
