IADIS International Conference WWW/Internet 2008

THE FEASIBILITY OF BIOMETRICS AUTHENTICATION

IN E-COMMERCE: USER ACCEPTANCE

Fahad Al-harby, Rami Qahwaji, and Mumtaz Kamala

School of Informatics, University of Bradford
Bradford, West Yorkshire, BD7 1DP, UK

ABSTRACT
This study is part of a larger study focusing on the feasibility of biometric authentication systems in e-
commerce and their user acceptance in Saudi Arabia. Additionally, it will explore whether Saudis practically
and culturally are willing to accept the biometric authentication technology. For this work, three hundred and
four Saudi participants, consisting of men and women between the ages of 18 and 55, were participated. The
survey revealed that the vast majority of the participants who were familiar with the concept of biometrics
perceived the fingerprint biometric would be willing to buy and begin using fingerprint sensors as part of their
daily lives. Saudi consumers are ready to use fingerprint sensors daily and believe the technology would add
additional value to existing devices by offering greater security, convenience, and personalisation.

KEYWORDS
Authentication, Biometrics, e-commerce, Saudi Arabia, user acceptance.

1. INTRODUCTION
Although a biometric authentication system appears to be the best method to secure online businesses, some
obstacles exist to their widespread adoption. Not all biometric systems are popular, due to privacy issues and
other sociological factors. Furthermore, some individuals prefer fingerprints and others face recognition.
However, the major obstacle is that of acceptance and trust, because it matters little how secure or efficient a
system is if nobody is willing to use it. This study will look at making the identification system requirements
as flexible as possible in order to solve the problem of adopting this technology in Saudi society. Security is
now becoming a more important issue for business, and the need for authentication has therefore become
more important than ever. The use of biometric systems for personal authentication is a response to the rising
issue of authentication and security. The most widely used method of biometric authentication is fingerprint
recognition. Generally, a fingerprint is known to be unique for each person, and for that reason is considered
a secure method for authentication (Jain, 2004). This study will give an indication about the feasibility of
adopting the use of biometric identification systems for online services, and its user acceptance in Saudi
Arabia. This paper is organised as follows: by now, the reader is already familiar with the content of section
one which consisted of an introduction followed by the concepts of Biometrics in section two, the study
objectives and the hypothesis in section three, followed by the investigation methods and the survey in
section four. Finding and results in section five. In the final section the conclusions and recommendations
will be proposed as well as suggestions for further research in section six.

2. BIOMETRICS
The term biometrics comes from the Greek words bios, meaning life, and metron, meaning measure.
Biometrics can be defined as measurable physiological or behavioural characteristics, or both, that can be
utilized to verify the identity of individuals, and include fingerprint verification, hand geometry, retinal
scanning, iris scanning, facial recognition, and signature verification (Ashbourn, 2000). Biometric

527
ISBN: 978-972-8924-68-3 © 2008 IADIS

authentication is considered the automatic identification, or identity verification, of an individual using either
a biological feature they possess (physiological characteristic like a fingerprint) or something they do
(behavioural characteristic, such as a signature) (Wayman and Alyea, 2000). For authentication purposes, an
individual must first be enrolled in a biometric system and the system must verify the claimed identity by
comparison with a reference template. (Newton and Woodward, 2005).

3. THE OBJECTIVES AND HYPOTHESIS

The objectives of this survey are to (a) provide an indication of the current degree of familiarity with the
concept of biometrics in Saudi Arabia, (b) find an answer for the centrally important question of whether
Saudis are likely to accept and be encouraged to use biometric authentication systems, and (c) Discover
which biometric authentication method is most suitable for Saudis. In statistics, a null hypothesis is a
hypothesis set up to be nullified or refuted in order to support an alternative hypothesis. When used, the null
hypothesis is presumed true until statistical evidence (Christensen et al., 2007). The null hypotheses for this
study were (a) in general, Saudi users are insufficiently familiar with the concept of biometrics, (b) Saudi
users are likely to accept biometric authentication systems rapidly, and (c) as a result of some religious
and cultural factors, such as women’s facial recognition is prohibited in some Muslim countries such as
Saudi Arabia, the fingerprint is likely to be the most suitable method for authentication in Saudi Arabia.

4. INVESTIGATION METHOD AND THE SURVEY

The survey was designed according to the methods introduced in (Churchill, 1999). In (Churchill, 1999),
three types of research design methods which depend on the research questions and aims were presented.
These are exploratory research, descriptive research, and causal research. The initial investigation was a
cross-section survey of a sample of three hundred and four Saudi participants. The purpose was to investigate
a small sample of people from a chosen population, and then draw conclusions from the results and apply
these to the larger population. The advantages of examining a sample are reduced costs, time efficiency, and
ease of testing. The method used in this survey integrated the use of (1) electronic mail and (2) interviews.
Email was used for its low cost and reduced transfer time, while interviews were used to provide more
information and explanations from the participants so that the process could produce more reliable results.
Because this investigation meant to discover and clarify the feasibility of biometric authentication in e-
commerce in Saudi Arabia and the acceptance of this new method by Saudi society, it is intended to form the
base of another technical investigation with over 300 participants which will also consist of an exploratory
research design. To ensure that the surveys are distributed to a sufficient number of respondents, the
following formula will be used (Creative Research Systems, 2001):
Minimum Sample Size (n) = t2 * p * (1 - p)
2
M
Where: n= required sample size (minimum size), t= Confidence level at 95% (standard value of 1.96)
p= Estimated fractional population of subgroup, m = Margin of error at 5% (standard value of 0.05)
In the group called customers, the sample size was calculated based upon these factors:
Population of Saudi Arabia 100% (CSI, 2008) = 22,673,538
Percentage of adults 75% (CIA, 2008) = 17,069,168 , Banking customers: 45% est. (Almogbil, 2005) =
6,094,655
p = 6,094,655/22,673,538= 26%, Customers minimum Sample Size (n) = 301.
The variables measured in this survey were ordinal. An example of an ordinal scale commonly used in
measuring attitudes is the Likert scale (Likert, 1932). This scale helps to facilitate a more efficient collation
and summarization of data, to aid in extracting meaningful information about the data. The researcher chose a
sample from the population, deciding that three hundred and four participants should be sufficient for the
initial investigation. To increase the reliability of the survey, the researcher invited people with various
backgrounds and different experiences to participate in the survey. A survey was developed to investigate the
level of user acceptance for biometric authentication systems. The survey was planned to take approximately
30 minutes. Before the actual survey, two respondents were asked to help in pre-testing the questionnaire.

528
 IADIS International Conference WWW/Internet 2008

They commented that the language used had to be suitable for the population tested, and this resulted in an
effort to make the questions understandable and answerable.

5. FINDINGS AND DISCUSSION

A statistical analysis website1 called ‘Survey Methods’ was used to analyze the respondents’ responses. A
variety of statistical methods based on the Statistical Package for the Social Sciences (SPSS) was used to
analyze the data this study collected. Below is a more detailed discussion of the findings. The actual study
population consisted of three hundred and four participants, of whom 165 (54.27%) were male and 139
(45.72%) were female. Their ages ranged from 18 to over 50 years, with 94 (30.2%) being between 26 and
35, 91 (29.93%) being between 18 and 25, 80 (26.31%) being between 36 and 50, 39 (12.82%) being over
50, and none being under 18. The following figure showing distribution of age by gender.
40.00%
35.04%
35.00% 32.20% 33.49%
30.77%
30.00%
26.29%
Under 18
25.00%
18-25 21.65%
26-35 20.00%
36-50
15.00% 13.38%
Over 50
10.00%
5%
5.00% Under 18, 2.00% Under 18, 3.00%

0.00%
Male Female

Figure 1. Distribution of Age by Gender.

85 (27.98%) of the respondents had postgraduate degrees, 99 (32.57%) undergraduate degrees, and the
remaining 120 (39.2%) had a secondary-school education. The survey found that the male respondents were
more likely to use online banking, e-commerce, and online shopping. This was expected due to cultural
factors. For example, the management and organization of family budgets is often the responsibility of men
in Saudi culture. Surprisingly, 71% of the men and 56% of the women claimed to be familiar with the
concept of biometrics, which contradicts the first hypothesis. Since the selected sample did not consist only
of those with high levels of competence in information technology, biology, or both due to diversity being a
consideration during participant selection, the first result is an encouraging indication that the adoption of
biometric authentication methods in Saudi Arabia may be well-received. The following figure showing
familiarity with Biometrics by Gender.

Figure 2. Familiarity with Biometrics by Gender.

Acceptance of the use of biometric authentication methods was particularly high (65%) among
participants who did not object to the registration of biometric data for authentication in Saudi Arabia.
Moreover this acceptance was higher with females, as 54.89% of those who thought biometric methods
would be acceptable were women. In terms of enthusiasm to use biometric authentication methods. In
addition, 93.3% of those enthusiastic respondents agreed that biometric authentication methods would
improve e-commerce security. All of these findings support the second hypothesis and strongly indicate the
likelihood of the acceptance of biometric authentication systems in Saudi society. The third hypothesis
stated that the use of fingerprinting would be the most suitable method for authentication. The results
match what had been suggested in this hypothesis, as 81.2% of the respondents said they would prefer the use

1
www.surveymethods.com

529
ISBN: 978-972-8924-68-3 © 2008 IADIS

of a fingerprint authentication method. 51.7% of them were female. Additionally, 50.4% of those who would
prefer to a use fingerprint authentication method held a postgraduate diploma. On the other hand, the survey
shed some light upon some other important issues. The most significant of these was the recognition of some
major obstacles and barriers to the adoption of biometric authentication in Saudi Arabia. Overall, the
respondents perceived a lack of appropriate legislation and regulation, the lagging of security and privacy
reservations, and cultural influences to be the three greatest obstacles facing Saudi consumers in
implementing biometric authentication. Table 1 provides further details on these and other types of barriers,
and makes it easier to evaluate their relative strengths. Another important survey question involved the
perceived benefits and advantages of adopting biometric authentication in Saudi Arabia. It presented the
respondents with four significant benefits for rating. The question was phrased: ‘In the case of the
implementation of biometric authentication, how beneficial would it be for you and for Saudi society?’ In
brief, the majority of the respondents had the same strong opinions. about these four benefits, agreeing that
Saudi society would acquire the advantage of all four benefits should biometric authentication be
implemented. Table 2 provides further details on these four benefits.
Table 1: Obstacles to the adoption of biometric authentication in Saudi Arabia.

Obstacles to the adoption of biometric Score Total

authentication Strongly Agree Neutral Disagree Strongly
Agree Disagree
Lack of legislation and regulation 89(29.2%) 133(43.7%) 45(14.8%) 20(6.5%) 17(5.59%) 304
Lagging of Telecommunications 15(5%) 73(24%) 91(30%) 52(17%) 73(24%) 304
Security and privacy reservations 51(17%) 110(36%) 100(33%) 27(9%) 16(5%) 304
Biometrics devices and software cost 15(5%) 64(21%) 61(20%) 91(30%) 73(24%) 304
Cultural influence 73(24%) 88(29%) 52(17%) 49(16%) 42(13%) 304
Low intention to use Biometrics and 40(13%) 85(28%) 121(40%) 37(12%) 21(7%) 304
inflexible resistance to change

Table 2: The perceived benefits of adopting biometric authentication in Saudi Arabia.

The perceived benefits of adopting Score Total
biometric authentication in Saudi Arabia Strongly Agree Neutral Disagree Strongly
Agree Disagree
Security and confidentiality of e- 161(53%) 106(35%) 27(9%) 6(2%) 4(1%) 304
commerce
Increase of e-commerce process 40(13%) 197(65%) 52(17%) 9(3%) 6(2%) 304
Protect against any anticipated threats 140(46%) 104(34%) 39(13%) 12(4%) 9(3%) 304
Reduce of password management cost 94(31%) 109(36%) 74(24%) 18(6%) 9(3%) 304

6 CONCLUSION AND FUTURE WORK

The findings in regard to the motivations for and acceptance of biometric authentication in e-commerce
clearly indicate that security, convenience, ease of use, and greater privacy act as strong motivators when
present. However, this study does have some limitations that need to be acknowledged and addressed in
future studies. First, although its sample provided a good understanding of the likelihood of user acceptance
in biometric authentication by highly educated people and those who are familiar with the Internet, they may
not provide insight into consumers who are not regular Internet users, but who sometimes use online services.
Furthermore, the research findings concern perceptions and do not address how well a biometric
authentication system would actually meet consumer needs. To our knowledge, this is the first systematic
study of this issue carried out by academic and non-biased researchers in Saudi Arabia. After the encouraging
results that we obtained from this experiment, an initial system will be developed which can reliably
authenticate a user based on his/her biometric data. The system should also protect against access from non
authorized users. By using this system a larger experiment will be conducted to get an idea of the possibility
of implementing such system more widely.

530
 IADIS International Conference WWW/Internet 2008

REFERENCES
Ashbourn, J. (2000) Biometrics: Advanced Identity Verification: The Complete Guide, London, Springer-Verlag, London.
Albrecht, A. (2002b) Understanding The Issues Behind User Acceptance Biometric Technology Today. 9(1): P. 7-8.
Almogbil, A. (2005) Security. Perceptions And Practices: Challenges Facing Adoption Of Online Banking In Saudi
Arabia. The George Washington University.
Christensen, E. H., Coombes-Betz, K. M. & Stein, M. S. (2007) The Certified Quality Process Analyst Handbook
Milwaukee, William A. Tony.
Churchill, A. G. J. (1999) Marketing Research: Methodological Foundation, Hinsdale, Il, The Dryden Press.
Creative Research Systems. 2001 [Cited 2008 Feb 12]; Available From:Http://Www.Surveysystem.Com/Ssformu.Htm.
Dugelay, J. L., J. C. Junqua, Et Al. (2002). Recent Advantages In Biometric Person Authentication. Icassp International
Conference On Acoustics, Speech And Signal Processing. Orlando, Usa.
Furnell, S., P. Dowland, Et Al. (2000). "Authentication And Supervision: A Survey Of User Attitudes Authors."
Computers And Security 19(6): 529-539(11).
Jain, A. K. (2004) Biometric Recognition: How Do I Know Who You Are? Signal Processing And Communications
Applications Conference. Proceedings Of The Ieee 12th: 3-5.
Klosterman, A. J. And G. R. Ganger (2000). Secure Continuous Biometric-Enhanced Authentication Pittsburgh, Pa
Carnegie Mellon University: 16.
Laurie, A., I. Annie, Et Al. (2007). Towards Understanding User Perceptions Of Authentication Technologies. . Acm
Workshop On Privacy In Electronic Society, Alexandria, Virginia, Usa.
Morris, M. G. And A. Dillon (1997). "How User Perceptions Influence Software Use, Decision Support Systems." Ieee
Software July-August: 58-65.
Likert, R. (1932) A Technique For The Measurement Of Attitudes. Archives Of Psychology, 140, 1-55.
Newton, E. M. & Woodward, J. D. (2005) Biometrics: A Technical Primer. Digital Government Civic Scenario
Workshop.
Prabhakar, S., S. Pankanti, Et Al. (2003). "Biometrics Recognition: Security And Privacy Concerns." Ieee Security &
Privacy 1(2):33-42.
Shankar, V., G. L. Urban, Et Al. (2002). "Online Trust: A Stakeholder Perspective, Concepts, Implications, And Future
Directions." Journal Of Strategic Information Systems 11: 325-344.
The Central Depatment Of Statistic & Information (Csi). 2008 [Cited 2008 Feb 12];Available
From:Http://Www.Citc.Gov.Sa/Nr/Rdonlyres/722d574c-F670-48d1-A9fd-4ff6c53aaf91/0/Atlascensus1425h.Pdf.
The Central Intelligence Agenct (Cia). 2008 [Cited 2008 Feb 12]; Available From:
Https://Www.Cia.Gov/Library/Publications/The-World-Factbook/Print/Sa.Html.
Wayman, J. L. & Alyea, L. (2000) Picking The Best Biometric For Your Applications. National Biometric Test Center
Collected Works, 1, 269-275.

531