Biometric trust is rising as passwords and deepfakes fail

At a glance

What this is: This is a biometric-trust statistics roundup showing that passwords are losing credibility while face biometrics and anti-deepfake controls are gaining ground.

Why it matters: It matters to IAM practitioners because identity assurance, onboarding friction, and fraud resistance are now being judged against password fatigue and synthetic media risk, not just login convenience.

By the numbers:

• 72% of consumers globally would rather use face biometrics than passwords for secure online processes.
• 48% of consumers now question the authenticity of almost everything they encounter online.
• 62% of organizations experienced a deepfake attack in the past year.
• The volume of biometrically authenticated remote mobile payments is forecast to grow by 383% between 2022 and 2027.

Context

Password fatigue is no longer just a user-experience issue. In this article, iProov frames the problem as a trust failure across digital identity, where reused passwords, forgotten credentials, and synthetic media all weaken confidence in who is really on the other side of the screen.

For identity teams, the practical question is not whether biometrics replace every password use case. It is where stronger verification is justified, where account recovery is the weak point, and where fraud pressure makes assurance more valuable than convenience.

The article spans consumer preference, onboarding, banking, KYC, payments, and deepfake risk, so the central governance issue is how to move from fragile password-centric trust to more resilient identity assurance without creating new exclusion or bypass paths.

Key questions

Q: What breaks when passwords are still the main identity control for high-risk digital journeys?

A: Passwords break down when they are reused, forgotten, phished, or shared, because the verifier can no longer distinguish legitimate use from compromise. That creates a weak trust base for onboarding, recovery, and payment flows. The real failure is not inconvenience alone, but the ease with which attackers can convert stolen credentials into account access or fraud.

Q: Why do biometrics improve security in customer onboarding and access control?

A: Biometrics improve security because they verify a live person using characteristics that are harder to guess, share, or replay than passwords or PINs. When systems compare a face, fingerprint, or voice against a trusted template and add liveness checks, they reduce account takeover, buddy punching, and impersonation while also removing dependence on memorised credentials.

Q: What are the signs that deepfake risk is undermining your identity programme?

A: Warning signs include rising doubts about online authenticity, more failed verification conversations, increased recovery friction, and growing reliance on manual review for remote identity checks. If users or staff cannot trust what they see or hear, the organisation is already depending too heavily on human judgment instead of machine-backed verification.

Q: Should organisations prioritise passwordless or identity verification first?

A: They should treat them as complementary controls rather than competing projects. Passwordless removes phishable credentials, while identity verification hardens the moments when people are asserted, recovered, or re-enrolled. If resources force sequencing, start with the workflows most exposed to impersonation and account takeover.

Technical breakdown

Why passwords break down as a trust signal

Passwords fail as an identity control because they are easy to reuse, forget, share, and steal. Once a credential is copied or phished, the verifier cannot distinguish legitimate reuse from compromise. That creates a structural weakness in any model that treats secret knowledge as proof of personhood. The article’s figures on password reuse, abandonment, and support burden show that the problem is both security-related and operational. In practice, password-based trust depends on memory and secrecy, two properties that degrade under pressure from users, support teams, and attackers.

Practical implication: treat passwords as a weak baseline for assurance and reserve them for lower-risk recovery or step-up flows.

What biometric authentication changes for digital identity

Biometric authentication shifts the trust model from remembered secrets to characteristics tied to the individual, then adds liveness or presentation-attack resistance to reduce spoofing. That does not make biometrics infallible, but it does change the attacker’s economics by forcing impersonation to move from credential theft to synthetic or physical deception. In the article, this is framed as especially relevant for secure online processes, mobile banking, and onboarding. The governance question is not just adoption, but whether the biometric system is being used for verification, authentication, or fraud resistance in a high-assurance workflow.

Practical implication: align biometric use cases to the assurance level of the workflow, not to convenience alone.

How deepfakes undermine identity assurance

Deepfakes attack the assumption that what users see or hear is an authentic indicator of identity or intent. When synthetic video, voice, or imagery can convincingly imitate a real person, the control problem shifts from credential compromise to human perception compromise. That is why the article treats deepfake risk as a direct threat to digital trust, not just a media problem. For IAM and fraud teams, the important point is that classic verification steps can be bypassed if they rely on human judgment without stronger binding between the identity claim and the underlying session or transaction.

Practical implication: add anti-spoofing controls wherever users, staff, or agents rely on visual identity proof.

Threat narrative

Attacker objective: The attacker wants to impersonate a legitimate user well enough to bypass verification, gain access, or trigger fraudulent transactions.

1. Entry occurs when attackers exploit stolen credentials, reused passwords, or synthetic media to reach identity-controlled services.
2. Credential access is achieved through phishing, password reuse, or deepfake-enabled impersonation that defeats human verification.
3. Impact follows when fraudsters open accounts, take over sessions, or induce transfers in environments that still trust weak identity proof.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password-based trust is collapsing because the identity verifier no longer controls the weakest link. The article shows that users forget passwords, reuse them, and share them, while attackers increasingly steal or guess them. That makes the credential itself an unreliable proxy for the person, especially when account recovery and support processes remain weak. The implication is that identity programmes should stop treating passwords as a durable trust anchor.

Biometric trust is rising because assurance is being measured against fraud pressure, not just login friction. The article connects biometric preference with onboarding, banking, KYC, and mobile access, which are all contexts where false acceptance has real cost. This is not a claim that biometrics solve every identity problem. It is a sign that practitioners need assurance models that match the risk of the transaction, not the convenience of the channel.

Deepfake risk turns identity assurance into a verification problem at the point of interaction. Once people doubt whether what they see or hear is real, trust can no longer depend on human recognition alone. That shifts the field toward stronger binding between the claimant, the device, the session, and the transaction. For practitioners, the lesson is that perception-based trust has become a governance liability.

Identity programmes now need to manage a trust recession, not just authentication friction. The article’s mix of fraud data, consumer preference, and deepfake concern shows that assurance gaps are visible to end users as well as defenders. When users stop trusting online signals, the organisation inherits both security risk and abandonment risk. The practical outcome is that identity design must be evaluated as a trust system, not just an access system.

What this signals

Biometric verification is moving from convenience feature to trust control. The article suggests that end users now judge identity systems against fraud exposure and synthetic media, not only against login speed. For IAM teams, that means assurance design has to be tied to the risk of each workflow, especially onboarding, recovery, and transaction approval.

Deepfake resilience belongs in identity architecture, not just fraud operations. Once attackers can imitate people convincingly, the control challenge extends beyond credential theft to presentation attack resistance and stronger session binding. Teams should review where human review is still acting as the last line of defence and decide whether that is sustainable.

Password-centric assurance creates a trust gap that users can feel. When consumers reuse passwords, abandon purchases, or question online authenticity, the identity programme is already affecting business outcomes. Security leaders should treat that as a signal to redesign proofing and step-up flows around actual risk, not around legacy login habits.

For practitioners

• Reassess password-dependent journeys Map which onboarding, recovery, and high-risk transaction flows still depend on reusable passwords as the main proof of identity. Replace them first where fraud or impersonation would create material loss.
• Introduce biometric step-up at high-risk points Use biometrics where the transaction requires stronger identity assurance than a password can provide, especially for onboarding, account recovery, and payment approval.
• Harden anti-deepfake verification paths Require liveness, presentation-attack resistance, or equivalent anti-spoofing checks when users or staff could be targeted with synthetic media during remote verification.
• Review fraud and recovery controls together Treat account recovery as part of the identity threat surface, not a support afterthought, because weak recovery is where credential theft and impersonation often convert into account takeover.

Key takeaways

• Passwords are losing credibility as a primary trust mechanism because reuse, theft, and recovery friction make them easy to abuse.
• The article combines consumer preference data, fraud statistics, and deepfake concern to show that identity assurance is becoming a board-level trust issue, not just a login issue.
• Practitioners should focus biometrics and anti-spoofing controls on the highest-risk journeys, where impersonation would create the most damage.

Key terms

• Biometric Authentication: Biometric authentication verifies a person using physical traits such as a fingerprint, face, iris, or voice pattern. It can reduce password use, but it is not a revocable secret in the same way a password is. Security teams must therefore pair biometrics with fallback controls, attestation, and recovery safeguards.
• Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection.
• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.

Deepen your knowledge

NHI governance, human identity, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.