India lets banks use face recognition, iris scan for some transactions: sources

THE Indian government is allowing banks to verify individual transactions that exceed a certain annual limit using facial recognition and an iris scan in some cases, three sources said. The move is intended to reduce fraud and tax evasion.

A few large private and public banks have begun using the option, said one of the sources, who declined to name the banks. The advisory allowing the verification is not public and has not previously been reported.

The verification is not mandatory and is intended for cases where another government identification card used for tax purposes, the Permanent Account Number (Pan) card, is not shared with banks.

The prospect of banks using facial recognition has concerned some privacy experts.

“This raises substantial privacy concerns, especially when India lacks a dedicated law on privacy, cybersecurity and facial recognition,” said Pavan Duggal, an advocate and cyberlaw expert.

The government has said that it is targeting parliamentary approval of a new privacy law by early 2023.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

The new measures can be used to verify the identities of individuals making deposits and withdrawals exceeding two million rupees (S$32,471) in a financial year, where the Aadhaar identity card is shared as proof of identity, said two government officials, who asked not to be named.

The Aadhaar card has a unique number tied to an individual’s fingerprints, face and eye scan.

India’s finance ministry in December asked banks to take “necessary action” on a letter by the Unique Identification Authority of India (UIDAI), which suggested that verification should be done through facial recognition and iris scanning, especially where fingerprint authentication of an individual fails.

The letter from the UIDAI, which is responsible for Aadhaar card issuance, makes no mention of a consent framework for the verification. Nor does it say whether banks can take any action if a customer refuses.

A UIDAI spokesperson said that Aadhaar verification and authentication happens only with the explicit consent of the user. The use of Aadhaar-based biometric authentication helps in guarding against possible misuse, he said.

“UIDAI regularly advises all authentication and verification entities to use face or iris authentication to cater to residents whose fingerprint authentication fails.” He added that authentication and verification do not mean storing of data.

The latest advisory follows a government order last year that mandated the quoting of an Aadhaar card or Pan number for making deposits or withdrawals exceeding two million rupees in a financial year.

The federal finance ministry did not respond to requests for comment. REUTERS