1. What Is Behavioral Biometrics, and How Is It Different from Physical Biometrics?
With physical biometrics, identity is established by a physical trait, such as a fingerprint or a face. Behavioral biometrics can include how an employee acts, such as typing rhythm, mouse movement or the speed at which an employee fills out a form.
READ MORE: How financial services are pulling ahead with predictive analytics.
In finance, Davies says the main uses of behavioral biometrics include catching account takeovers midsession, spotting fraud at account opening and adding a low-friction check on staff members when an unauthorized user may be relying on valid credentials. “To give an example, a real applicant knows their own details, while a fraudster often pauses to look them up,” he says.
2. Where Does Employee Authentication Diverge from Customer Fraud Detection?
“For employees, you have managed devices and a steady baseline, so the system is mainly asking whether this is still the same person who signed in and whether they're behaving as they normally do,” Davies says. “It's trying to catch stolen credentials, hijacked sessions or someone else at the keyboard, and thresholds can trigger a step-up check instead of an outright block, since false alarms cost staff time.”
DISCOVER: The segment of one is coming to banking.
On the customer side, the signals are “broader and noisier” because people use many devices, he adds, so the system is looking for bots and scams where a real customer is being manipulated. “Thresholds here usually scale with the risk of the action being taken, like a large wire transfer,” he says.
3. How Do Behavioral Biometrics Intersect with Regulatory and Compliance Measures?
“Behavioral data that can identify a person is generally treated as personal data, and in some places, as biometric data,” Davies says, citing privacy laws such as the European Union’s General Data Protection Regulation and the California Consumer Privacy Act, which bring requirements around notice, consent where it applies, purpose limits, retention and deletion.
In finance, particularly, behavioral biometrics can support anti-money laundering and user verification needs. However, Davies adds, “institutions must be able to explain and audit how a risk decision was made. Employee use adds another layer, since workplace monitoring and biometric rules vary by country and state, so legal review before rollout is essential.”
4. What Infrastructure Does a Financial Institution Need To Support Behavioral Biometrics?
There should be a way for IT teams to feed behavioral signals into identity and access management systems to drive real-time decisions such as increasing or easing friction, Davies says. “That means connecting data across onboarding and fraud tools instead of keeping them in silos,” he adds.
DIVE DEEPER: How should banks prioritize cybersecurity spending?
5. What Governance Should Be in Place Before an Organization Deploys Behavioral Biometrics on Employee Devices?
Organizations should inform employees about what’s being collected and why, keep data collection to a minimum and for a discrete period of time, encrypt it and limit access to it. “There should also be a simple way back in for someone who's wrongly flagged, plus regular testing of accuracy and fairness, with a human reviewing any decision that has real consequences,” Davies says.
