Kenyan banks have increasingly adopted biometric authentication, allowing customers to access mobile banking services using fingerprints instead of repeatedly entering passwords or PINs.

Equity Bank, KCB Bank and Standard Chartered Bank Kenya are among financial institutions offering biometric authentication features on their digital banking platforms.

The Kenya Times spoke with Technology Executive and Digital Transformation Leader SK Wachira to understand how safe fingerprint authentication is and the risks users should watch for when using it to access banking applications.

Wachira said using a fingerprint to unlock a banking app is generally safe and can be more secure than repeatedly typing a password, provided the bank implements the technology correctly.

What Makes Fingerprint Login Secure

He explained that the fingerprint itself isn’t the main security mechanism; rather, it’s how the banking app uses biometric authentication.

On modern smartphones, the banking app itself does not access or keep a user’s fingerprint. Instead, when you scan your finger, it unlocks a secure cryptographic key stored on the device.

“Yes, it is generally very safe and recommended over typing a password every time, provided the bank implements it correctly. However, your fingerprint itself isn’t the security mechanism; how the bank’s app uses it matters.

On a modern smartphone, a secure banking app never actually sees or stores your fingerprint. Instead, scanning your finger unlocks a secure cryptographic key on your device,” he said.

However, Wachira cautioned users against relying on fingerprint authentication alone, especially for high-value transactions.

He said simply opening a banking application with a fingerprint should not automatically give a user permission to transfer large amounts of money.

The Technology Executive advised that high-value transactions should require a fresh biometric scan and additional security checks.

Wachira also recommended that banks use risk-based controls to identify unusual activity, including transactions involving unfamiliar locations, new devices or unusually large amounts of money.

Users, meanwhile, should maintain a strong phone PIN or password, which acts as an important layer of protection for the device.

Can Malware Bypass Fingerprint Authentication?

Wachira said malware can risk banking apps, although it usually doesn’t break the fingerprint authentication mechanism itself.

Instead, malicious software can target what happens before or after biometric authentication.

One method is through overlay or accessibility attacks, where malware interferes with what users see or interact with on their phones.

Such attacks could trick users into authorizing actions they did not intend.

Malware can also target an authenticated banking session through session hijacking, attempting to interfere with the session after a user has successfully logged in using their fingerprint.

Another risk is fake banking applications that imitate legitimate apps and trick users into providing sensitive information.

Wachira rated basic fingerprint login at six to seven out of 10 for security.

Fingerprint authentication on a properly secured phone, he said, can provide security of between 8.5 and nine out of 10.

Combining fingerprint authentication with transaction signing and additional checks for high-value transfers provides the strongest protection, which he rated at 9.5 out of 10.

Follow our WhatsApp Channel and X Account for real-time news updates.

Fingerprint Login Does Not Fully Protect Banking Apps From Malware - Expert
A Kenyan using smartphone. PHOTO/FILE.