Biometric authentication, such as fingerprints and facial recognition, has made mobile financial services more convenient. On an M-PESA app, being able to unlock the application using a fingerprint or face can save time and eliminate the need to type a PIN every time. However, convenience should not come at the expense of security.
One important weakness of biometrics is that your biometric information cannot simply be changed if it is compromised. A PIN or password can be changed immediately if someone discovers it. Your fingerprint, facial characteristics or other biometric identifiers, however, are essentially permanent.
There is also a risk associated with physical access to your phone. Depending on the device and its settings, another person may potentially gain access through a biometric method—for example, if the device recognizes an enrolled fingerprint or face under circumstances the owner did not intend. Unlike a PIN, a biometric identifier is also physically associated with you and cannot be replaced after compromise.
Another concern is that people sometimes become overly dependent on biometric authentication. If an application allows users to access sensitive financial information with a simple fingerprint or face scan, users may become less careful about protecting their phones. A lost or stolen phone can therefore become a much more significant security concern if additional safeguards are weak.
For financial applications such as M-PESA, users should consider:
- Keeping a strong M-PESA PIN and never sharing it with anyone.
- Using a secure phone screen-lock PIN/password rather than relying exclusively on fingerprint or facial unlocking.
- Disabling biometric authentication temporarily when travelling, lending the phone to someone, or when there is a concern that someone may attempt to access the device.
- Avoiding predictable PINs such as birthdays, 1234, or repeated digits.
- Enabling transaction notifications so suspicious activity can be detected quickly.
- Keeping the phone’s operating system and M-PESA application updated.
- Never entering an M-PESA PIN after following an unsolicited link or responding to a suspicious message or call.
Convenience Should Not Replace Security
Biometrics are useful, but they should ideally be treated as a convenience layer rather than the only line of defence for financial accounts. A PIN or password gives the user something that can be changed, revoked and kept secret.
The fundamental principle is simple: your fingerprint and face are part of your identity, but your PIN is a secret. For financial services, maintaining that secret and using it as an additional security layer can provide important protection when a phone is lost, stolen, compromised or accessed by someone else.
Biometric authentication is therefore best viewed as a complement to strong security practices—not a replacement for them.
No responses yet