CUNA Comment Letter

March 26, 2004

Ms. Susan Hart
Financial Economist
Office of Critical Infrastructure Protection and Compliance Policy
U.S. Department of the Treasury,
Annex Room 3174
1500 Pennsylvania Avenue, N.W.,
Washington D.C. 20220

Re: FACT Act Biometric Study
(Part 716)

Dear Ms. Hart:

The Credit Union National Association (CUNA) appreciates the opportunity to comment on the biometric study that the Treasury must conduct under the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act” or “Act”). The Act requires a study of biometrics and similar technologies to determine the feasibility of using this technology to help combat identity theft. The Act also requires the Secretary of the Treasury to submit a report to Congress containing the findings and conclusions of the study, as well as recommendations for legislative and administrative actions. CUNA, a national trade association, represents more than 90 percent of the nation’s 9,653 state and federal credit unions.

CUNA’s views on the Biometric Study:

Few credit unions use biometrics, but the credit unions that responded to our survey cited a range of biometric solutions that the private sector currently uses and could use in the future to reduce the rate and cost of identity theft. For example, a few credit unions use fingerprint recognition to identify members performing transactions such as check cashing. In the future, financial institutions may possibly use retina, iris and palm scans, and voice recognition. The ATM industry is reportedly considering the usage of retina scans and infrared sensors that read the pattern of veins in a palm.

Other technologies are currently being applied to reduce the incidence of fraud and identity theft. For instance, financial institutions monitor credit reports and place “alerts” on accounts to notify consumers when certain activity occurs on their account, such as a large purchase. Financial institutions also use electronic statements to prevent theft of statements from mailboxes. They use photo identification, passwords, pin numbers, magnetic card identification and background checks to verify a person’s identity.

In our view, the cost of biometric solutions serves as the largest barrier to adopting this technology for financial institutions. The main incentive for financial institutions to use this technology is to reduce identity theft and fraud; however, the costs of implementing this solution may be too great. For example, in some cases, the cost of adding biometric features to ATMs may outweigh the losses that the institution incurs from fraud. Such costs of implementing biometric solutions includes infrastructure and integration costs. Specific costs are purchasing and upgrading hardware and software; training staff and consumers; maintaining the technology, and safeguarding and securing all biometric data. The fact that fingerprint analysis is relatively inexpensive may be a reason it is currently the biometric technology of choice. The cost of biometric technology serves as an even stronger barrier to smaller financial institutions that are less able to absorb direct financial costs or indirect costs such as a loss of member accounts.

Another barrier to acceptance may be the risks possibly associated with the usage of biometric technology. For example, if technology fails and creates a false positive or a false negative, then access may be granted to a someone seeking to defraud the institution or access may be denied to a legitimate accountholder. Financial institutions may be exposed to new legal liability for denying legitimate accountholders. Another risk may come from the lack of universal adoption, such as if a financial institution employs an unpopular technology and loses an accountholder or if merchants fail to adopt the technology so it cannot be used to reduce fraud (e.g., credit card verification depends on the merchant and financial institutions using the same technology). Early adopters of biometric technologies risk offending consumers and spending resources on a technology that becomes obsolete. The affect of these costs and risks on implementing biometric solutions probably has discouraged adoption of this technology within the financial services sector.

Consumers also may have concerns that adoption of this technology will result in a loss of personal privacy and subject them to procedures that they may perceive as unsafe or humiliating. The public may be apprehensive about the loss of privacy caused by using the features of their person as a tool for authentication. In addition, certain procedures carry negative connotations; consumers may perceive retina and iris scanning as unsafe and associate fingerprinting with criminals. Overall, the usage of biometric technology may make it more difficult for consumers (such as a couple) to share accounts, if a financial institution’s infrastructure does not support using multiple pieces of biometric data for the same account.

Despite these concerns, consumers and financial institutions can gain greater security from the use of biometrics or similar technology. The usage of this technology could serve as a quicker and more accurate way to verify an individual’s identity; could reduce identity theft and fraud losses; and improve member services. These benefits, however, must be carefully considered only in light of the costs associated with such procedures. The study should also address possible competitive issues such as whether and to what extent institutions would be affected in the marketplace by their choice to use or not to biometrics.

According to Credit Union Magazine (November 2003), when credit unions use biometric technology they use it more often to control internal access rather than to verify member identity. Credit unions have used fingerprint biometrics to authenticate employees and to increase computer network security as well as to streamline password control and maintenance. A few credit unions prevent fraud with a fingerprint recognition system that reads current or potential members’ fingerprints and compares them to the financial industry’s only national shared database. Another credit union uses fingerprint analysis at self-service kiosks to allow credit union members to scan their fingerprints to access personal accounts. In another case, credit union members at the Texas Credit Union League’s five stand-alone branches provide their thumbprints to deposit or cash checks worth more than $100. This system is employed by shared branches, which may have infrequent contact with members, to prevent identity theft and fraud. Another credit union has used fingerprinting for nonmembers interested in such services as check cashing. This procedure helped that credit union solve several fraud cases quickly. This service was only used with nonmembers; however, some of them chose to take their business elsewhere rather than undergo fingerprinting.

Conclusion

CUNA supports Treasury’s proposal to seek public comments on biometrics before it presents its study to Congress. Any study done by the Treasury should weigh the costs and benefits of biometrics and the affects of these costs and benefits on institutions including small ones. The study should also address possible competitive issues such as whether and to what extent institutions would be affected in the marketplace by their choice to use or not to biometrics. If you have any further questions, please contact CUNA's Senior Vice President and Associate General Counsel Mary Dunn or me at (202) 638-5777.

Sincerely,

Michelle Q. Profit
Assistant General Counsel