Swipe, Tap, Slide: New ‘Gesture’ Passcodes Could Replace Your PIN

New system turns credit card swipes and taps into secure authentication method

VANCOUVER — Researchers have developed a touchless password system that could let people authorize purchases by swiping their credit card up in the air, tapping twice, sliding horizontally, then swiping right. It’s a gesture combination much harder to observe or copy than traditional codes.

Near Field Communication technology appears in billions of devices worldwide, powering contactless payments, building access cards, and transit systems. But despite this ubiquity, NFC interactions remain limited to tapping. Payment terminals require touchscreens or keypads for any additional functions, like selecting tip amounts or entering security codes.

The new device, dubbed “NFCGest,” transforms ordinary payment terminals into gesture-recognition devices. The system distinguishes nine different hand movements by analyzing radio signals that credit cards and terminals already exchange during contactless transactions.

Bu Li and Robert Xiao from the University of British Columbia’s Department of Computer Science built the technology around a security gap: contactless payments remain vulnerable for lost or stolen cards. Adding a gesture-based authentication layer as a second factor could stop unauthorized users even if they possess the physical card.

Li and Xiao recognized untapped potential in the electromagnetic signals NFC devices produce. When someone moves a card near a reader, the magnetic field fluctuates in distinct patterns. These signals operate at 848 kHz, which the researchers captured using a custom high-speed converter built around a microcontroller.

Two signal channels, called in-phase and quadrature, create unique signatures on what researchers call an amplitude-phase plot. A swipe produces a different curve than a tap, which differs from a shake. Machine learning algorithms trained on these patterns can identify specific gestures.

Breaking the Symmetry Problem

Standard NFC antennas present a challenge: their radially symmetric magnetic fields mean a leftward swipe looks identical to a rightward swipe. Li and Xiao solved this by placing small copper coils at strategic locations around the terminal, deliberately distorting the field. This asymmetry enables the system to distinguish all four cardinal directions.

The coils measure 35mm by 8mm and 45mm by 15mm, with 10 turns of copper wire each. Testing showed these additions barely affect performance, reducing maximum sensing distance from 8.87 cm to 8.67 cm and decreasing signal strength by just 0.339 dB.

The researchers designed a nine-gesture vocabulary: four directional swipes (up, down, left, right) performed with the card held horizontally, a vertical swipe performed in mid-air, a slide along the terminal’s front face performed with the card held vertically, a center tap, a double-tap, and a horizontal rub.

A four-gesture passcode drawn from the nine possible movements offers 6,561 combinations. That’s slightly fewer than a PIN’s 10,000, but harder to guess by watching. Shoulder surfing, where thieves watch victims enter PINs, becomes more difficult when authentication involves three-dimensional card movements rather than button presses. A swipe up looks different from a swipe down only when the terminal’s asymmetric field is present, making the gestures context-dependent.

Testing With Real Credit Card Users

Ten participants, ages 22 to 32, tested the system by performing each gesture 40 times across four sessions. The study accommodated natural variation, accepting differences in speed and slight deviations from perfect alignment.

Results showed 94.3% accuracy when the system was trained on data from the same person and 91.8% accuracy for completely new users. This cross-participant performance demonstrates NFCGest can work across different interaction styles.

Double-tap and rub gestures showed the highest confusion rates because both produce multiple amplitude peaks in the signal. Fast swipes also sometimes confused the system. Participants occasionally triggered false positives on the tap-center gesture when holding cards at angles rather than horizontally.

Most participants responded positively when asked about using NFCGest for gesture passcodes, viewing the technique as an extra security layer requiring no additional hardware on their end. However, some found certain gestures awkward, particularly the vertical swipe and upward swipe. Some raised concerns about shoulder surfing, though the researchers argue that someone who finds a lost card is unlikely to have observed the owner’s gesture passcode. One participant suggested creating multiple gesture codes for different transaction types, such as groceries versus entertainment versus commuting.

Applications Beyond Fraud Prevention

In the researchers’ demonstration, a user taps their card to authenticate it normally, then the payment terminal requests a four-gesture PIN code for larger purchases as a second authentication factor. In their prototype, users navigated tip menus by swiping up and down and confirmed selections with a leftward swipe, all without touching potentially contaminated screens.

Vending machines could accept directional swipes for item selection and slide gestures for purchase confirmation. Door access systems without displays could request gesture PINs during unusual hours or let building administrators control unlock duration through specific sequences, using LED flash patterns for feedback.

The current prototype streams data to a computer for processing, but the computational requirements remain modest. The system could be fully integrated into the terminal’s firmware, or would require an additional microprocessor costing at most $20 per terminal.

The NFC terminal’s test pins provide only 4-bit converted signals because they’ve already undergone low-resolution analog-to-digital and digital-to-analog conversion, losing detail. Access to truly raw analog signals would improve performance.

Different NFC protocols in credit cards versus transit cards may have varying timing characteristics requiring adjustments. Each interference coil weakens the magnetic field slightly, potentially limiting how many directions could be distinguished using this approach.

Participants found the vertical swipe gesture difficult because it lacks physical guidance, and the upward swipe felt unnatural as it moves away from the user. Some suggested mounting terminals vertically instead of horizontally to make upward movements more comfortable.

NFCGest shows that existing terminals can support richer interactions, offering a potential path to more secure, touch-free authentication without forcing people to memorize more PINs or touch more screens.

---