Touch Here and You're All Clear: Honda Federal Credit Union Goes Biometric

Credit Union Times
January 8, 2009 | COMMENTS

A bit of social engineering assessment by a visiting auditor was all it took to convince management at Honda Federal Credit Union to take up fingerprint authentication.

And the help desk couldn't be happier.

Honda Federal Credit Union is using biometrics in the form of fingerprint authentication to provide access to about 30 different websites and applications used by the 130 or so full-time staffers at the 53,000-member credit union's eight locations in California, Ohio, South Carolina and Alabama .

Since deploying it about a year and a half ago, calls to the four-person help desk for password resets have dropped from about 20 a day to almost none, said Bill D'Camp, IT manager at the $463 million credit union.

And the NCUA is pleased, too, D'Camp said, since it's a sharp improvement from the situation an outside auditor found a few months earlier.

"We did a social engineering engagement and found that people were writing down passwords and keeping them in, ahem, secure places such as under their keyboards and in desk drawers," D'Camp said.

"So we decided we needed to do something to make it easier for everyone to get to their applications and websites without running the risk of compromising the security of log-ins and passwords," he added.

A range of solutions were considered, including smart cards, but the decision was made to go with something the staffers couldn't leave at home or in their cars—their fingerprints.

In addition to providing secure log-ins without lost, forgotten, or plain-view passwords, after the user presses his or her finger to the reader, the DigitalPersona system shows a list of authorized applications and websites, allowing for much quicker access than having to clear authentication for each individual use, D'Camp said.

While the base technology is not particularly new, fingerprint authentication is really getting legs now that major PC manufacturers are incorporating it into millions of consumer laptops, according to Jim Fulton, vice president of marketing at DigitalPersona in Redwood City, California.

"Even six months ago, this technology was slightly out on the edge for people who aren't techies or looking for niche technology," Fulton said. "Now it's absolutely moving into the mainstream."

DigitalPersona has been in business for about 10 years and now has an installed base of more than 90 million users worldwide, Fulton said. Its client list has grown to more than 900, including Honda Federal Credit Union and Advantis, Mountain America , Travis, Telesis and Allegiance credit unions.

D'Camp said the initial deployment included the biggest challenge so far, integrating the authentication application with the credit union's Symitar core processing system. He said his project leader accomplished that by working with DigitalPersona support and colleagues from other credit unions, including Mountain America , to create a customized template.

D'Camp said he also now regularly gets updates from DigitalPersona, for software upgrades and security patches. For instance, the biometric software was not compatible with Internet Explorer 7 when that new browser came out, requiring updates to bring that back in line.

"But, so far, every time we've had to do something like this, it's improved performance," the IT manager said. "Generally we see a faster response time to putting your finger on the reader and seeing the menu pop up on the screen."

Despite the international boom in consumer adoption, D'Camp said he doesn't see the technology going to the teller line anytime soon at Honda Federal.

"We have members who see our staffers using it and telling us, 'You're not going to get me using that thing,'" he said. "I guess they see it as some kind of privacy issue.”

"But we are looking at using a solution from MagTek that allows the member to do PIN verification at the teller line just by swiping a debit or ATM card," D'Camp said. “We think members will accept that better than using their fingerprints. I think there are still some challenges ahead for that," he said.

Internal acceptance also isn't universal. There are still a couple holdouts "entering passwords by hand" at Honda Federal, D'Camp said, "and they're the people who still call for password resets."

This article was originally published in Credit Union Times and is reprinted with permission.