BIOMETRIC AUTHENTICATION can make online financial services more secure against evolving cyberthreats as the Philippines continues to see growth in digital transactions, identity verification service provider iProov said.
Many Philippine financial institutions have already replaced one-time passwords (OTPs) with stronger authentication technologies like biometric, behavioral, adaptive, or password-less solutions to comply with Bangko Sentral ng Pilipinas rules in accordance with the Anti-Financial Account Scamming Act or Republic Act No. 12010.
Dominic Forrest, chief technology officer of iProov, said this is a welcome move as OTPs are “very well known” to be insecure.
“Biometrics provide a far stronger security factor than SMS OTP ever can,” Mr. Forrest told BusinessWorld in an online interview.
This, as cybercriminals are now increasingly sophisticated methods for fraud, using deepfakes and generative artificial intelligence (AI) to intercept traditional authentication methods.
“The biggest challenge is that criminals will always adapt and, because they are not bound by the same regulations banks must follow, they can move faster,” Mr. Forrest said.
He said biometrics is a true “phishing-resistant” technology because, unlike a code or token, a user cannot share their face.
To counter deepfakes, iProov uses liveness checks to ensure a user is a “real person, right person, and present right now.”
This is achieved through a process called Dynamic Liveness, where the device screen changes colors to observe how light reflects off the user’s face. The video is then analyzed by more than 20 neural networks to detect signs of manipulated imagery or digital playback.
The company also provides a layered defense strategy to fend off attackers, he said. By passing every transaction through multiple AI networks, the system creates “information asymmetry,” where defenders learn from every attack while criminals receive no feedback on why they failed.
“This setup is deliberately completely unfair to the criminals. They have no data, while defenders have vast amounts of data to defend against them, making it not a fair competition and allowing the system to learn a lot while attackers get no useful feedback,” Mr. Forrest said.
iProov sees between 1.5 million and 2 million transactions daily, he said.
Their platform is updated regularly, similar to anti-virus software, learning from global attack patterns and a dedicated threat intelligence arm that monitors over 130 criminal forums on the dark web and messaging app Telegram.
Because biometric imagery is often deleted after a short period to protect privacy, iProov maintains technical metadata consisting of floating-point numbers from its neural networks. This data allows it to reconstruct the state of the platform anytime to provide regulators and banks with detailed audit trails.
For the everyday user, the goal is to make high-level security transparent. The authentication process typically requires a user to hold their face still for two to three seconds without needing to perform complex gestures.
Mr. Forrest added that the system is designed for inclusivity, working across different skin tones, ethnicities, and even older mobile handsets with poor connectivity.
“iProov’s job is to ‘get out of the way’ of the consumer: keep security strong, but make the process so seamless and consistent that people barely notice it’s there,” he said. — J.C.A. Gonzales
