Inferring User Height and Improving Impersonation Attacks in Mobile Payments using a Smartwatch

In this paper, we show that as a user makes mobile payments with a smartwatch, the height of the user can be inferred purely from inertial sensor data captured on the watch (with R² scores of up to 0.77). Besides unwanted information exposure, we also show that users of a similar height are more difficult to distinguish between in terms of their tap gesture data and that an attacker who chooses a victim of a similar height can improve the success chance of impersonation (by increasing the false acceptance rate by up to 20.6%).