WatchAuth: User Authentication and Intent Recognition in Mobile Payments using a Smartwatch

TL;DR

This paper presents WatchAuth, a smartwatch-based system that uses tap gestures as biometric signals for implicit user authentication and intent recognition in mobile payments, deployable without hardware changes.

Contribution

It introduces a software-only approach leveraging tap gestures for biometric authentication and intent detection, with no need for training data or terminal modifications.

Findings

Achieved EERs of 0.08 for authentication and 0.04 for intent recognition.

Validated system with user study involving wrist motion data from 16 users.

System is agnostic to terminal type and position, enabling broad deployment.

Abstract

In this paper, we show that the tap gesture, performed when a user 'taps' a smartwatch onto an NFC-enabled terminal to make a payment, is a biometric capable of implicitly authenticating the user and simultaneously recognising intent-to-pay. The proposed system can be deployed purely in software on the watch without requiring updates to payment terminals. It is agnostic to terminal type and position and the intent recognition portion does not require any training data from the user. To validate the system, we conduct a user study (n=16) to collect wrist motion data from users as they interact with payment terminals and to collect long-term data from a subset of them (n=9) as they perform daily activities. Based on this data, we identify optimum gesture parameters and develop authentication and intent recognition models, for which we achieve EERs of 0.08 and 0.04, respectively.