Photos hoodwink face recognition tools on banking apps

Banking applications using facial biometric authentication can easily be tricked with photos, as several users have found out.

With effect from July 1 online transactions of VND10 million (US$390) or more than VND220 million a day need biometric authentication.

Some people testing if facial recognition could be circumvented used photos instead of their face, and reported that it worked like a charm.

Binh Minh, a tech worker in HCMC, said: “I used three banking accounts and two e-wallets to test. The e-wallets did not recognize the photo but of the three banking apps only one found out something was wrong, while the other two allowed the transactions of over VND10 million.”

Worse still, he said, the photo was scanned instantly while scanning of his actual face takes a long time, sometimes requiring three or four attempts before signing in.

A spokesperson for an e-wallet company said his platform had considered a scenario where biometric measures could be bypassed even before the new policy was announced by the State Bank of Vietnam.

A company that provides biometric solutions to banks said the sheer number of users has overloaded the database, leading to certain banking applications encountering problems like failing to detect photos.

Some banks said they had updated their software to prevent bypassing of biometric measures.

Huynh Tuan Kiet, technology director at a finance startup in HCMC, said several banks have resorted to acquiring biometric solutions from third parties.

Complex measures to differentiate between still photos, actual faces and deepfakes would require a lot of time and resources, he said.

By Khuong Nha – VnExpress.net – July 3, 2024