How do biometric cards work?
Biometric smart cards with embedded fingerprint sensors for use in payments or access control applications have been developed and released around the world in a series of pilots and commercial launches.
These fingerprint-enabled cards vary somewhat in the technologies they use, but most are designed to function very similarly to existing contactless credit and debit cards, and enterprise access control credentials.
There are some biometric cards that include a battery, but most harvest current from the electro-magnetic field produced by the terminal that reads them.
Fingerprint matching
The fingerprint template is stored in the secure element of a biometric card. The secure element is one of the components found in every biometric card, along with a sensor for collecting a reference fingerprint image when the card is used, and a processor to perform feature extraction to convert that image into a template and match it against the stored one. The secure element also manages the transaction itself. These components are not necessarily separate, however.
When a match is detected, the card will perform a transaction, whether a payment or grant of access. When a match is not detected, the card will not carry out the transaction. In this way, biometric security is provided without transmitting any fingerprint data to or from the card.
Biometric cards perform either ‘on-chip’ or ‘off-chip’ matching. ‘On-chip’ matching is performed by cards in which the sensor and processor are combined in a system-on-chip. In ‘off-chip’ matching, the components are discrete.
The components are typically combined in an inlay which connects them, and is built into the card itself.
Enrollment
Before the card-holder can use their biometric card, their fingerprint must be enrolled to the secure element.
To do so, the card must be activated with a power source, usually a terminal in a bank branch or office, or a home-enrollment sleeve (basically a piece of paper with a small battery inside). Once the card is activated, the user presses their finger on the sensor, similarly to how they would enroll their fingerprint on a smartphone.
Home enrollment is often preferable, as it is more convenient for consumers and eliminates the need to staff the process. This introduces the risks of card interception or user uncertainty about how to complete the process, however.
