MarketWatch presents: Can your quirky personality stop a thief?

Data is everywhere. When orchestrated properly, it sings. At Morningstar, we analyze and enrich data, making it actionable and powerful for you. Morningstar, where data speaks.

Hello, it's Jack Howe, but this is not the Barron's Streetwise Podcast. Not this week. I had a teensy-weensy procedure to fix a longtime back problem and it went wonderfully well, but I need just a bit longer before I get back to work. So I'll be out for 2 weeks, but our audio producer Jackson has a plan. Right now he's gonna play an episode of a different podcast called Best New Ideas in Money. It's hosted by MarketWatch editor and my pal, Jeremy Allshon, and economist Stephanie Kelton, who was good enough to appear in a past episode of the Barron Streetwise podcast. So if you like best new ideas and money, just search for that name and subscribe. Now, next week, Jackson is putting out an episode of our Barron Streetwise podcast by himself. One man band, right, Jackson?

Yeah, I got my guitar and harmonica holder and, you know, the cymbals on the knees, right? Yeah, exactly.

It's going to be great. And thank you for helping out. Just so you can hit the ground running, why don't you take over the intro from here and I'll sign off, get back to my healing regimen of walking and napping and Netflixing. And I think my wife just bought some peppermint bark ice cream, so that's part of it now too.

Well, enjoy.

Thanks, Jack.

Do you ever get stopped online by the bicycle question? You know, click all the squares that have bicycles in them. So you click the 10-speed and the kids' bike and the racing bike and the bike where you can only see half of it, and you hit enter. Only it turns out that half a bike was a unicycle, so you have to go back to the beginning. Online authentication doesn't have to be that cumbersome. There's something better than bicycles. And you'll hear about it next. Enjoy the show.

Lots of technologies seemed creepy and eventually we just sort of accept them, whether it's an X-ray machine when you're going onto a plane or full body scanners now, which have just become accepted and us privacy folks threw a tantrum over 10 years ago. But the reality is I think people are gonna embrace it, creepy or not. Especially in our world today, it's about convenience.

We're all used to using our thumbprint or even our face to unlock our phones. A few years ago, that might have felt like something out of a James Bond movie. But today, a number of companies are developing tech that looks beyond our body parts. This kind of tech learns the way we move, how we type and hold our phones, even how fast we read, and then uses all of that to identify us. It's called Behavioral biometrics. This new idea has picked up momentum recently because of a very old problem: fraud.

Every time a business loses a dollar to fraudulent activity, it actually costs that business more than $3 to replace the merchandise and then deal with other fees and costs.

MarketWatch reporter Emily Barry looked into what advances are being made in behavioral biometrics to combat fraud.

There's a dilemma that online retailers face when it comes to deciding whether or not to approve a given purchase. If you're too lenient, then you let in fraudulent purchases and then you have to incur all the costs. And then if you're too strict, then some people will just walk away before they ever go through with the purchase.

Emily found that companies are looking to increase the sophistication of the biometric identifiers they already use.

People are probably pretty familiar with traditional biometrics, and behavioral biometrics are a bit of a twist on that. They are behind-the-scenes gauges such as typing speed, swipe patterns, and phone angles that are unique to us and can help authenticate us when shopping online or browsing the web. And the idea is for you to both prove you're a human and prove you're yourself when shopping online. You end up authenticating yourself by doing the sorts of things that you'd be doing anyway by going through a checkout process, like scrolling through the page, how fast you type, whether you read a return policy, all sorts of things that are just natural parts of the browsing journey.

Biometrics are biological and behavioral.

That's Jim Wayman. He's an expert on biometric technologies.

I can make hand gestures. You could say, well, that would be biometric. And the computer has some information about you and your behaviors stored in it. And so when you present this new information, it compares the new information to the old information and says, yeah, that's probably close enough. That could be you.

With so many of our transactions now happening online, especially over the last 18 months when so many of us were stuck at home, fraud prevention has become a major priority for everyone from financial services companies to online retailers. The challenge is to stop fraud without creating so many hoops for consumers to jump through that they're discouraged from shopping at all. To increase digital security and stop online fraud, engineers are looking at new ways to try to prove you are who you say you are. Checking things like, do you hold your phone in your left hand or your right hand?

Companies like Mastercard see great potential in behavioral biometrics. They need something that goes beyond passwords or two-factor authentication if they're going to combat the rise in online fraud and identity theft they've seen in recent years. Which according to an FTC report were up almost 50% from 2019 to 2020.

Here's Chris Reid. He's the global lead for the identity services business at Mastercard. His job is to find ways to combat fraud and make online payments more secure.

We are a pioneer of this technology of biometric authentication. We've replaced the password with the person and we use artificial intelligence to deliver the most intuitive, consumer experience, but one that is also safe and simple and convenient. What we're really looking to do is detect anomalies in behavior, in the environment that may indicate a bad actor.

With the volume of fraud financial companies are combating, 2.2 million fraud reports alone in 2020, says the FTC, they really need a strategy that can effectively weed out fraudsters without making the rest of our lives even more miserable in the process.

The way we use a particular finger to type or swipe or text is really unique to you. And you really take that for granted until you realize, yeah, you know, I keep my phone in my right pocket and I'm a two-thumb typer. And so from those individual data points, what we can generate is a valid user profile that can then be created, that can be attached to me. And then that's going to be incredibly difficult for a fraudster to spoof.

Reid described one incident where a phone lying flat on a surface was trying to make hundreds of transactions really quickly. The biometrics indicated to his team that there was no way a person could be typing that fast without actually holding the phone.

Now, given the speed at which the credentials were being typed, we knew that it was highly unlikely. And so in this way, we were able to detect that, hey, this was an attack taking place.

But it's not foolproof. Here's Jim Wayman again.

The question is, how stable are they and how distinctive are they? By stable, am I going to use the gesture the same way every time in every circumstance, independent of my caffeine consumption, for example, independent of what time of the day it is? And the second thing is, how distinctive will it be? So it's this battle between the stability and the distinctiveness, meaning the system has to accommodate the fact that I change a little bit every time, but at the same time, it has to be able to say, oh, wait, wait, wait, you've changed too much now. You might be some other person. From that point of view, my fingerprints and my irises are much better because my fingerprints stick around for a long time and my irises are pretty doggone stable.

What Jim is saying is that while we're all basically creatures of habit, we're also wildly inconsistent about so many things we do.. And this software has to kind of balance those two to create a kind of behavioral profile of each of us to determine, are we really who we say we are? The other key thing here is that from the consumer's perspective, you don't even know this is happening. It's not like the tech is prompting you to do a pirouette or a cartwheel to confirm it's you. It's all happening seamlessly in the background.

You don't know it's happening until they decide that you might not be who you say you are. Throws up a red flag that interrupts whatever it is you're trying to do.

And Mastercard's Chris Read claims they're factoring that very concern into the technology.

Here's what we tell customers about that kind of behavioral biometric capability is that it takes around 10 interactions for us to monitor and evaluate, for us to be really, really confident we're going to be able to validate whether it's you or not. And so if you think about your behavior, look, I'm sure there are some times that I am just typing with one thumb because I might have a glass of water in the other one. And so we have to train the model to be able to evaluate those subtle nuances and make sure that we get it right.

It sounds like the process of getting this right might take a while.

So maybe I'll have to put up with some added frustrations once in a while if the behavioral biometrics get it wrong.. But is that really worse than clicking through all the boxes trying to find all of the bicycles or stoplights? I never seem to get that right on the first try, and that's really frustrating.

There's nothing more infuriating than when you're trying to make a legitimate purchase and it doesn't go through.

The very first time I tried to use my watch to buy groceries, it didn't work. Everyone in line behind me was really pissed off.

It was also the last time I tried to use my watch to buy groceries. So as great as it would be if we all had to perform our signature dance move every time we needed to make a purchase, it seems that a lot of security companies are taking a multi-layered approach. They're not quite ready to replace the password with the person.

It's information that you're giving off about you. It's almost like being able to not identify you by looking at the boat you're in, but by looking at the wake that that boat leaves behind.

We talked to Edward Goodman. He's a cyber defense expert.

It isn't this magic pill that's gonna make passwords go away, but I think that it does help streamline authentication. I tend to think of security as layered or stacking on one another, so I think it's an extra layer. So the addition of something you would also know, like a password, but I think the advantage to using biometrics in addition to a password is really where the secret lay.

These layers need to balance people's frustration where the system is so finicky or complicated that they abandon what's in their online shopping cart with the added security they provide.

Except that there's no way for us to know when it's actually being used and what data companies are recording about us and who they're sharing it with.

Which is exactly why some people find this technology problematic. Goodman describes how much these new data collection techniques can potentially reveal about us.

As a privacy guy, what gives me the most concern, frankly, they're just starting to find out right now how much behavioral biometrics can actually reveal about you more than what you intended to, let's say, just validate your identity or from a security standpoint. So very interestingly, there's more than a couple studies that have shown that there's a very high ability to be able to determine whether someone is suffering, for instance, from clinical depression based on how they're texting. There's other studies that have been able to show MS prior to it really being reportable based on changes in the way that people are texting or entering texts.

So while that might sound actually helpful in some ways, the privacy implications are potentially concerning. Who's going to get this information about you? Do you really want your insurance company to know all of this? Is it going to raise your premiums? These are questions we should be asking.

Yeah, it's kind of scary. People are pretty protective of their health records, and I don't know that I want companies trying to decipher movements and different behaviors and make conclusions about my personal health.

While there are definitely potential pros to this technology, there there are still some reasons to be wary.

More on those after the break.

Stay with us. Data is everywhere, but is it ready for consumption? Morningstar developed the language of global investment data so you have the right ingredients to help you shine. Morningstar, where data speaks.

Before the break, cybersecurity expert Edward Goodman told us about some surprising privacy implications with behavioral biometrics. The question is, will people be willing to overlook those concerns for the sake of convenience.

Lots of technologies seemed creepy and eventually we just sort of accept them. But the reality is, I think people are gonna embrace it creepy or not because, you know, especially in our world today, it's about convenience. If I can bypass having to enter a 10-digit code to get onto my phone and I can just look at it, well, I'm just gonna look at it, right? The problem is we just, as consumers, need to be aware it's a slippery slope. Like, what are you doing with that data? Most people don't ask. Most people don't know that, hey, is this going to show up in some weird report that you're giving to my life insurance company in 10 years?

When we use facial recognition to open our phones, we're giving our consent. We know the software is being used to recognize our face. But with gestures, typing pressure, I don't think most people realize that stuff can be captured. I might not care that my credit card company knows I'm right-handed, But the idea that this information can be used to reveal depression or MS? I don't know about that.

The Federal Trade Commission has voted to fine Facebook nearly $5 billion for mishandling users' personal information.

Google may be tracking your location even if you told the company not to. With a new technology like behavioral biometrics, there's going to be a lag between the time tech companies and the big financial institutions adopt them and when small businesses can afford to start using them.

That's who's using it right now are big organizations that have the money and are looking at high fraud risks. So typically financial services are the ones that are starting to kind of implement that first. For a major financial institution now, it is cheap, especially when you're looking at financial services who are much more willing to institute security because for them, fraud means bleeding money. Now, your average mom and pop, yeah, it is cost prohibitive. It's cost prohibitive now though. In another 3 to 5 years, it's gonna be an off-the-shelf capability.

So it sounds like we have just a few short years to consider the ramifications here. After that, behavioral biometrics will be everywhere. Stephanie, at the end of the day, do you think people will accept this technology?

The data that behavioral biometrics collects is basically invisible to the customer, so it's It's hard to know how much shoppers will resent this form of tracking. Will they even notice? And if they do, maybe they'll just come to accept it. So I don't know that I have an answer, but here's what Jim Wayman thinks. He's the expert on biometric technologies that we met earlier.

Everybody, both the consumers and the suppliers, have overreacted to biometrics. They've seen them either as a scourge— someone once said to me, it will end Western democracy as we know it. Or they see it's a salvation for the end of all security problems. And biometrics is neither. Biometrics is neither the end of Western civilization or the end of privacy as we know it, nor is it the end of all security problems. Biometrics is just one more tool in the tool chest that has its place in security applications, but doesn't solve all problems.

Thanks for listening to The Best New Ideas in Money. You can subscribe to the show on Apple, Spotify, or wherever you listen to podcasts. If you like what you heard, please leave us a review. And if you have ideas for future episodes, drop us a line at bestnewideasinmoney@marketwatch.com. Thanks to Emily Berry, Jim Wayman, Chris Reed, and Edward Goodman. To learn more about behavioral biometrics, head to marketwatch.com. I'm Stephanie Kelton.

And I'm Jeremy Olshan. The Best New Ideas in Money is a podcast from MarketWatch produced by Best Case Studios. Devin Maverick Robbins and Suzanne Myers are our producers, and our associate producers are Hannah Lebowitz Lockhart and Allie Gallo. The executive producer for Best Case Studios is Adam Pinkus, and Melissa Haggerty is the executive producer for MarketWatch. Stephanie Kelton is an economist and a professor of economics and public policy at Stony Brook University and not part of the MarketWatch newsroom. We'll be back next week with another new idea.

Data is everywhere. When orchestrated properly, it sings. At Morningstar, we analyze and enrich data, making it actionable and powerful for you. Morningstar, where data speaks.