Halifax replaces passwords with cardiac authentication

Nymi reads the wearer’s heart rhythms, which is said to be as unique as a person’s fingerprint, to authenticate who they are.

A built-in proximity sensor can then detect where they are, and when the wearer is close to a paired device, will automatically confirm their identity and unlock the account. The bracelet contains a HeartID sensor that measures the amount of electrical power generated by a human heart, called a cardiac rhythm tracked on an electrocardiogram, or ECG.

This ECG differs from person to person and depends on the location and size of their heart. Nymi only works with a registered person’s cardiac rhythm, meaning if the bracelet is stolen it cannot be hacked. When the wearer clasps the Nymi around their wrist, the bracelet powers on. By placing a finger on the topside sensor while the wrist is in contact with the bottom sensor, it completes an electrical circuit. Users stay authenticated until they remove their Nymi and the electrical circuit is broke.

The Nymi functions on a three-factor security system - the bracelet, a unique heartbeat and an Authorized Authentication Device (AAD), which is a smartphone or device registered with the app.

The bank - owned by Lloyds Banking Group - said the technology only works when worn by the account owner and the band has to be paired with the device being used to access the account. This removes the need to enter the username, password and memorable information every time.