Let The Finger Do The Talking
Retailers need to understand how access control can be integrated into identity management systems
- By Bill Spence
- Jun 01, 2012
Visualize this: You walk into a men’s store, approach the “personal
shopper” stand and place your finger onto a designated spot. A
personalized greeting appears on the monitor: “Good day, Mr.
Brigham. The last time you visited, you bought a blue pinstripe
suit. To thank you for your business, for any tie you buy today, pick
another at the same price or less for free. Your discount will appear at checkout.”
With a biometrically enabled loyalty system like that, past customers will want to
return to the store over and over again.
Today, retail decision makers can be less concerned about whether technology
works—with the introduction of multispectral imaging, even biometrics have become
reliable—and more interested in how access control can be integrated into
identity management systems for goals beyond the simple transaction of opening
a door. Also today, they can use biometrics in “customer-facing” applications like
loyalty programs. With the advent of the latest technologies, biometrics have been
successfully deployed at major theme parks and ATMs. Why shouldn’t the retail
industry take advantage of new biometrics technologies as well?
Can biometrics allow workflow to be streamlined by a single authentication
solution across an organization? Can user authentication be tied into safety systems,
as required by regulators or insurance providers? Can business patrons’ experiences
be enhanced by expanding the touch points that know who they are?
The answers to these questions are being asked today by retail CIOs who are demanding
seamless and holistic solutions to IAM challenges that revolve around
the question, “Who?”
The challenge has always been how to establish the “who” in transactions. Who
is accessing the warehouse? Who is punching the time clock? Who is the customer
standing in front of me? The question is always, “Who?”
Until now, the industry response to this question of “who” has been to use the
best available tools to approximate identity. Thus, cutomers can present a credential—
something they know like a password or something they have like a swipe
card—to authenticate their identity. However, credentials alone simply cannot
CIOs understand that others can know the password—it may have been shared,
found or observed. Cards and tokens show what somebody has, but possession
alone does not ensure identity; somebody else could have access to that card or
token via sharing or theft. Thus, while access and authorization have always been
granted to individuals, knowing a password or having a key is only superficially
related to the authorized person, and neither can establish who. Only a biometric
can do that.
Here’s an example of why it’s important to know who. Today, NFC-enabled
smartphones are starting to get a lot of press. It is now possible to replace cards
with virtual credentials on a smartphone. These credentials, when linked to one’s
unique identity, provide an easier, simpler way to pay for merchandise. The customer
just has to tap his or her smartphone to the cash register. NFC-enabled
smartphones also could provide better access to buildings, data or devices.
Nonetheless, virtual credentials still verify only that somebody has the phone.
Add a biometric to the phone and you know that the person using the phone is the
person who is authorized to use it.
Instead of a smartphone, retailers could implement finger biometrics and actually
understand who. After all, not all customers fit the phone-carrying demographic. And what about customers who forget to bring their cellphone? They
didn’t leave their finger at home! Let’s look at some retail applications and how
biometrics can help take retailers to the next level.
Eliminating the High Cost of Buddy Punching
Increasingly, retailers are discovering that time and attendance technologies, such
as barcode ID cards, proximity cards, PINs and manual punch clocks, are inexpensive
short-term fixes but, in the long run, they can be exploited and are susceptible
to fraud, rendering them a poor long-term solution. Biometrics solves this problem
by eliminating sharing, swapping, stealing and loss of PINs, passwords and ID
cards. This is especially true for big-box environments.
Every retailer knows that it is working in a very small-margin industry. Although
most employ some type of workforce management system, that initiative
is really no better than the data entered into it. And, much of that data is bad because
employees buddy-punch—clocking their friends in and out of work.
On average, 19 percent of employees admit that they have buddy-punched at
least once in the past year, and 74 percent of all companies report that they have
experienced a loss from buddy punching. It’s bad enough that the store misses
out on the expected labor of the missing employee. In addition, according to the
American Payroll Association, this practice costs companies between 5 to 7 percent
in payroll expenditures.
Wouldn’t it be nice to verify employees with the touch of a finger? A biometric
ensures that employees earn a day’s pay only when they are present to do a day’s
work. However, a biometrically enabled terminal is more than a simple time clock.
It transmits the employee’s in-and-out transactions to a company’s time/attendance/
payroll software. It also can display messages specific to an employee. Shift
schedules can be communicated and vacation balances retrieved—all enhancing
employee communication. Multiple units can be networked into a central time and
attendance recordkeeping system, and interface software can be tailored to meet
multiple recordkeeping needs, including programmable data management keys
that collect specific data when employees are verified.
Simple single-clock or multiple-unit systems can be connected at a variety of
sites over a full range of network topographies. Supervisors can enhance productivity
by performing a variety of functions at the terminal. They might override
user restrictions and input missed punches, planned vacations, sick time and other
information. This biometrically protected supervisor mode lessens the need for
computer edits, while audit trails for use of those functions ensure security. Even
bell schedules can be programmed to signal shift starts and stops as well as breaks.
For small retailers, the time and attendance application is the main incentive for
installing biometrics. But unlike the box store that might place biometric terminals
at employee doors, how does the ice cream parlor collect this data?
Who Is Operating the POS Terminal?
Small retailers have their employees clock in and out at the cash register, or the
POS terminal. How else could that biometric interface be used? What about opening
the register? Using a finger is certainly faster than using a PIN.
Plus, as a byproduct of having employees use their fingers to open the register,
the owner now has a record of exactly who was opening it during the window of
time some money was found missing—not simply a record of what PIN was keyed
in. The owner has irrefutable evidence of precisely which employees were in the
drawer. As a result, the owner knows who to talk to when there is shrinkage. Those
whose fingers were not used at that time won’t be bothered.
Of course, the same system can also be used in the big-box stores where transactions,
returns and other potentials for shrinkage run in the hundreds to thousands of opportunities per day.
Who Did What?
In auto repair and servicing, it becomes important to discern who fixed the car to
keep employees responsible for what they have done. That’s why such organizations,
which are similar to retail, have work orders that detail what was done and
by whom, which is typically noted into the system with a PIN. For instance, if Joe
isn’t really feeling up to it that day, he just enters Charley’s PIN. And when Mrs.
Jacobs’ car stalls on the freeway six miles from the shop, Joe doesn’t hear a word
about it. If Joe had to sign on with a finger, he might be a little more careful.
Creating an Enterprise Single Sign-On (ESSO) System
After considering these examples, all of which are in use today, ask yourself:
Would a retail organization like to have a system that offers authorized users
quick, easy access to specific information or use of particular data sets and enforces
document compliance with its policies and procedures? Of course, it would.
But in today’s complex world, authorized users are sometimes forced to carry different
forms of credentials for various applications and, at a minimum, remember
An ESSO system, used in concert with the latest generation of biometric sensors,
provides a better, more convenient and secure solution. Retailers realize
that security is a must, but security solutions cannot interfere with employees
doing their jobs effectively, efficiently and safely. With a biometrically enabled
ESSO, one simple enrollment allows for multiple uses across the whole enterprise—
from entering the employee-only area to going into the warehouse to using
the POS system or entering time and attendance data. This holistic view
of enterprise security is vital and provides an integrated identity management
system that is much more reliable and cost-effective because it eliminates the
problems of having multiple identities tracked over an ever-increasing number
of disconnected access points.
A biometrically enabled ESSO eliminates end-user frustrations of keeping up
with multiple passwords and lost tokens. Investing in an ESSO with a biometric
completes a retailer’s enterprise security by merging all authentication needs to a
single finger and providing an irrefutable audit trail.
Multispectral Imaging Assists Biometric Verification
For many years, retailers and other organizations did not realize the lower cost and
smaller footprint of fingerprint biometrics because legitimate, authorized employees
were rejected by the fingerprint scanning system. The optical and electronic
technologies used by conventional fingerprint scanners had error rates from 5 to
20 percent, depending on the environment. With the number of people employed
in retail chains, those error rates are just too high.
The core problem is that conventional technologies rely on unobstructed and
complete contact between the fingerprint and the sensor. This contact is hard to
achieve if the user’s hands are wet, dry or dirty.
To read a fingerprint, these units, whether optical or electrically based, need
the employee to lay a fingertip directly on the platen, and they need the fingerprint
ridges to make good electrical or optical contact with the device. In addition, they
also need the valleys between the fingerprints to fill with air. Dirt, water or any
other contaminant could fill those valleys or not allow the ridges to make good
contact with the platen. The result was bad images that lead to bad reads.
Are your employees meticulously clean? Consider that dry fingertips are common—
caused by anything from climate conditions and natural skin characteristics
to frequent hand washing and air travel. For instance, a high desert climate, like Las Vegas, causes dry fingers. In a more
humid environment, such as Miami,
moisture creates problems.
Most optical sensors are configured
to look for the presence or absence of
total internal reflectance (TIR), which is
the phenomenon in which the interface
between glass and air acts as a mirror at
certain angles. The contact between the
skin and the platen defeats the TIR, allowing
those points of contact between
the finger and the sensor to be imaged.
Thus, those points of contact must be
complete and unobscured to enable
the conventional sensor to collect a fingerprint
image. Establishing firm and
complete contact with the sensor is difficult
with dry fingers because there is
not enough moisture in the skin and the
skin is not pliable enough to facilitate
the contact necessary for TIR imaging.
A newer technology, based on using
multiple wavelengths of light and advanced
polarization techniques, can extract
unique fingerprint characteristics
from both the surface and subsurface
of the skin. It unleashes the subsurface
fingerprint to provide results that are
more consistent, more inclusive and
more tamper resistant. A dirty, calloused,
wet or dry fingerprint is still
readable with multispectral imaging
because the subsurface fingerprint can
still be read even if the outer fingerprint
Biometrics gives back what could
possibly be the most important asset
that an employee can offer in a retail
Productivity growth is important because
it means that a retailer can meet
its growing obligations and still stay
competitive or even improve its competitiveness
within its vertical market.
The Future of Biometric Deployments in Retail
Adopting biometric technology in a
retail environment eliminates the need
for log-on IDs and passwords. An employee
can’t borrow a swipe card or a
PIN to perform a transaction or override
what is above his or her permission
level because a manager must be physically
present to offer biometric authentication
for the authorization to be
completed. That’s just the beginning.
There is a burgeoning desire by retailers
to introduce the aforementioned
“personal experience” to their customers.
To launch a whole new mode of
customer service, they want to deploy
the “customer facing” technologies
decribed in the men’s store example.
What’s simpler than using a finger tap
to access a customer’s loyalty account
and provide payment?
Yes, installing and implementing
biometrics in their businesses will give
retailers added peace of mind—they
will rest easier knowing that the data
they depend on is safe and secure. As
biometric technology has improved
and more POS products have become
available, biometrics have become affordable
to retailers of all sizes.
This article originally appeared in the June 2012 issue of Security Today.