Behavioural vs Physiological Biometrics: Accuracy, Spoofing and Privacy Trade-offs

Behavioural and physiological biometrics both measure the human body, but they answer different questions, fail in different ways and sit differently under privacy law, so treating them as interchangeable produces weak authentication and avoidable compliance risk. Physiological biometrics, such as face, fingerprint and iris, make an explicit match at a moment in time. Behavioural biometrics, such as typing cadence, touch pressure, mouse movement and the way a phone is held, produce a continuous probability that the same person is still in control. This guide compares the two on threat model, accuracy measures, presentation and injection attacks, GDPR special category handling and fit for fraud and workforce use. It is for identity architects, fraud teams and privacy officers deciding which to deploy, where, and with what fallback.

Key takeaways

• They are different control types. A physiological match is an authentication event; behavioural scoring is a risk signal during a session, and NIST SP 800-63B-4 treats it as session monitoring that triggers reauthentication rather than replacing it.
• Accuracy numbers are not comparable. Physiological matchers are tested to fixed targets (NIST asks for a false match rate of one in 10,000 or better per demographic group); behavioural models are scored on fraud catch and alert rates that depend on your own population and threshold.
• The attacks differ. Physiological capture faces presentation attacks and injected deepfakes; behavioural scoring faces bots that synthesise human-like input, remote access tools and coached victims who are genuinely present.
• Purpose decides the legal category. Under GDPR Article 9 biometric data is special category when processed "for the purpose of uniquely identifying a natural person", which can catch behavioural profiles as well as face templates.
• Fraud and workforce use need different designs. Behavioural scoring fits customer fraud detection; in the workforce it creates monitoring and power imbalance concerns, and inferring emotions at work is prohibited under the EU AI Act.

The short answer

Use physiological biometrics when you need a person to prove, at a decision point, that they are the enrolled user: unlocking a device-bound key, approving a payment step-up, or matching a selfie to a document during identity proofing. Use behavioural biometrics when you want to keep watching after login for signs that the session has been taken over, scripted or coached. Most mature programmes use both: a physiological factor (ideally local, activating a passkey) at login and step-up, and behavioural signals feeding a risk engine that decides when to ask for that step-up again.

The overview of modalities, NIST accuracy targets and template protection sits in the Biometrics Guide. This page goes deeper on the choice between the two families.

Side-by-side comparison

Threat model: physiological biometrics

NIST SP 800-63B-4 states the root weakness plainly: biometric characteristics are not secrets. Faces are photographed, fingerprints are left on surfaces and voices are recorded. The defence therefore rests on proving the sample came from a live person at a genuine sensor, and on binding the match to something the attacker does not hold.

• Presentation attacks: a printed photo, screen replay, mask or artificial fingerprint shown to the sensor. NIST requires presentation attack detection (PAD) for facial comparison and recommends it for fingerprint and iris, with testing to ISO/IEC 30107-3 and an IAPAR below 0.07. See the Biometric Liveness and Presentation Attack Detection Guide.
• Injection attacks: forged or deepfake media inserted between the camera and the matcher, for example through a virtual camera or emulator. NIST SP 800-63A-4 says a biometric comparison with a captured sample "does not prevent these attacks" and requires controls to confirm media comes from a genuine sensor and to analyse submitted media for manipulation. See Biometric Injection Attacks.
• Template theft: a breached central store of face or fingerprint templates cannot be rotated like a password. Local matching that only releases a signature limits this. See Biometric Template Protection.
• Fallback abuse: the matcher is strong but the PIN, help desk override or manual review is weak, so attackers route around the biometric entirely.

Physiological biometrics are strongest when the match activates a device-bound private key, as with platform authenticators and passkeys, because the server never handles the biometric and a cloned face alone gets the attacker nothing without the device.

Threat model: behavioural biometrics

Behavioural signals are rarely the target of a direct spoof in the way a face is. The threats are about evasion and about attacks where the genuine user is present.

• Automation that imitates people: credential stuffing and account takeover tooling can generate input with randomised timing and curved mouse paths. Models trained only on crude bots miss this, so test against current automation, not last year's.
• Replay of captured traces: where the client SDK sends raw or lightly processed telemetry, a malicious script or compromised device could capture and replay it. Integrity protection of the telemetry channel and device attestation matter as much as the model.
• Remote access takeover: a fraudster controlling a victim's device through a remote desktop tool produces input that looks different from the owner's, which is one of the strongest uses of behavioural signals. See the Transaction Monitoring and Behavioural Biometrics Guide for coaching and remote control indicators.
• Authorised push payment fraud: the real customer, under instruction from a scammer, makes the payment. A physiological match succeeds because it is the right person. Behavioural signals such as hesitation, long pauses and copy-pasted payee details can still flag the session.
• Drift and new devices: injury, a new keyboard or tablet, or simply time changes how a person types. Poorly managed retraining either raises false alerts or quietly absorbs an attacker's pattern into the profile.

Accuracy: why FAR and FRR mean different things

For physiological matchers the vocabulary is mature. A false match (often called false accept, FAR) lets the wrong person in; a false non-match (false reject, FRR) keeps the right person out. NIST SP 800-63B-4 sets an FMR of one in 10,000 or better for all demographic groups, an FNMR that should be below 5%, a single fixed threshold rather than per-group thresholds, and testing to ISO/IEC 19795-1. For remote identity proofing with 1:1 comparison, SP 800-63A-4 asks for an FNMR of 1:100 or better. FIDO Alliance runs a biometric component certification programme whose requirements cover matcher performance and PAD.

Behavioural systems have no equivalent public target. Their output is a score fed into a decision, so the useful measures are operational.

The EBA reached a similar view for payments: in its 2019 opinion on strong customer authentication elements it listed keystroke dynamics as a possible inherence element under PSD2, while stating that it is the quality of the implementation that determines whether an approach is compliant. A memorised swiping path, by contrast, it treats as a knowledge element, not inherence. Ask for evidence for your specific implementation.

Privacy and law

GDPR Article 4(14) defines biometric data as personal data from specific technical processing "relating to the physical, physiological or behavioural characteristics of a natural person" which allow or confirm unique identification. Behavioural data is therefore inside the definition from the start. Article 9(1) then prohibits processing "biometric data for the purpose of uniquely identifying a natural person" unless a condition in Article 9(2) applies, such as explicit consent, and Article 9(4) lets member states add further conditions.

The UK ICO stresses that purpose is what matters: biometric data "only becomes this", meaning special category, "if you use it to uniquely identify someone". In practice:

• Physiological authentication: almost always special category, because the match exists to confirm who the person is. Explicit consent or another Article 9 condition is needed, plus a non-biometric alternative. On-device matching reduces what you hold.
• Behavioural profile used to confirm "this is the account holder": this is unique identification, so treat it as special category. Many fraud deployments do exactly this.
• Behavioural signals used only to tell human from bot, or to spot remote control, without linking to a known person: arguably not special category, but still personal data and profiling. Document the reasoning in the DPIA; regulators may disagree with a generous reading.
• Inferred traits: behavioural data can reveal health conditions, such as tremor or impaired motor control, which is special category in its own right regardless of purpose.

The EU AI Act defines biometric data the same way (Article 3(34)) and separates biometric verification, "the automated, one-to-one verification, including authentication", from identification against a database. Its Article 5(1)(f) prohibition on AI systems that infer emotions "in the areas of workplace and education institutions", applying since 2 February 2025 with a medical or safety exception, matters for any workforce behavioural tool that claims to read stress, engagement or intent. For US exposure see the Illinois BIPA and Biometric Privacy Guide and the Biometric Privacy Laws Map.

Fraud versus workforce use cases

For employees, consent is rarely freely given, so organisations usually need another lawful basis and a strong necessity case. See Biometric Data in the Workplace.

Decision criteria

• Do you need proof of identity at a moment, or assurance over time? Moment: physiological. Over time: behavioural as a trigger for step-up.
• Is the genuine user likely to be the one acting under pressure? If APP or coached fraud is the main loss, behavioural signals add value that no physiological match can.
• Can you match locally? If yes, physiological risk drops sharply. If you must hold central templates, budget for template protection, breach impact and a stronger lawful basis.
• Can you explain a decision? If the behavioural vendor cannot give reason codes, complaints and regulator questions will be hard to answer.
• Who are the users? Customers can choose another provider; employees often cannot. Workforce behavioural monitoring needs a much higher justification bar.
• What is the fallback? NIST requires a non-biometric option for physiological authentication; behavioural alerts need a clear step-up path that does not punish legitimate users.
• Size of organisation: smaller organisations get most of the value from platform biometrics on passkeys and should buy behavioural capability inside a fraud or identity platform rather than build it. Large banks and marketplaces with fraud teams can tune behavioural models per journey.

Worked scenarios

Retail bank, mobile app. Login uses a passkey unlocked by the phone's face or fingerprint sensor, so no biometric leaves the device. A behavioural SDK scores each session. When a customer adds a new payee, the risk engine combines behavioural signals (long pauses, a call in progress, pasted account number) with transaction data. Low risk: proceed. Medium: show a scam warning and delay. High: require step-up and a call-back. The Arup case shows why recognising a face is not authorisation: in the Arup Deepfake Fraud 2024, a finance worker made 15 transfers after a video call in which every other participant was a deepfake. Out-of-band verification and second approval, not visual recognition, are the controls.

Engineering firm, privileged admin workstations. Admins sign in with a phishing-resistant authenticator unlocked by fingerprint. The security team wants to detect hijacked sessions. It scopes behavioural monitoring to the privileged access workstations only, documents a DPIA, consults staff representatives, excludes any emotion or stress inference, and uses alerts only to force reauthentication, never for performance management. Logs record the trigger and outcome, not raw keystrokes.

Online lender, onboarding. Remote proofing matches a selfie to a document with PAD and injection attack detection. Behavioural signals during form filling flag applicants who type their own date of birth slowly or paste it, a pattern associated with stolen identity data. Flagged applications go to manual review with a trained referee, rather than automatic decline, to limit unfair outcomes. See the Deepfake-Resistant Identity Verification Guide.

How to implement

1. Define the decision: write down which decision each biometric informs (login, step-up, payment hold, session termination) and the fallback for each.
2. Run the DPIA first: record purpose, whether processing is for unique identification, the Article 9 condition, retention and the non-biometric alternative.
3. Prefer local physiological match: use platform authenticators and passkeys for authentication; reserve central templates for proofing and keep them protected.
4. Specify test evidence: for physiological, demand FMR, FNMR and IAPAR reports naming ISO/IEC 19795-1 and 30107-3; for remote capture, injection detection evidence. For behavioural, demand back-test results on comparable data and reason codes.
5. Pilot behavioural scoring in observe-only mode: log scores without acting for several weeks, compare with confirmed fraud, and set thresholds per journey.
6. Introduce actions in rings: start with soft actions (warnings, step-up) on a small user share, measure complaints and abandonment, then expand. Keep a feature flag to revert to observe-only.
7. Protect the telemetry channel: sign or attest client data, detect emulators and rooted devices, and minimise what is collected (features, not raw keystrokes or content).
8. Govern retraining: define how profiles update, who approves model changes, and how to reset a profile after confirmed takeover.

Detection and measurement

Log biometric attempts and outcomes (match, non-match, PAD failure, injection flag), lockouts under the attempt limits, fallback use, behavioural scores and reason codes, the action taken and the eventual fraud outcome. NIST SP 800-63B-4 notes that most session monitoring characteristics have privacy implications and must be covered in the privacy risk assessment, so log decisions rather than raw behaviour.

• Takeover detection rate: share of confirmed account takeover sessions flagged before loss.
• False positive rate per journey: genuine sessions stepped up or blocked, broken down by device type and, where lawful, accessibility needs.
• Fallback rate: share of physiological attempts ending in the non-biometric path; rising rates suggest sensor or demographic problems.
• PAD and injection flag rate: attempts rejected for liveness or media integrity, trended weekly to spot campaigns.
• APP fraud losses: value of losses where behavioural signals were present but no action was taken.
• Complaint and abandonment rate: customer friction caused by step-ups.

Framework mapping

See D3-BAN Biometric Authentication.

Common failure patterns

• Calling a behavioural score "authentication": removing a real factor because the risk score is low leaves the account protected by a probability. Keep the factor; use the score to decide when to add more.
• Trusting a face on a screen: remote capture without injection detection, or people approving payments because they recognise a colleague on video, as in the Arup case.
• Collecting raw keystrokes: SDKs that capture field content or raw timing for every key create a sensitive dataset far beyond what the model needs.
• A generous reading of "not special category": using a behavioural profile to confirm the account holder while documenting it as non-identifying.
• Workforce scope creep: a session hijack control later used for productivity or stress monitoring, which breaks the original purpose and may fall under the AI Act emotion recognition ban.
• No reset after takeover: the attacker's behaviour absorbed into the profile, so the next session looks normal.

Practitioner checklist

• Map every biometric to the decision it informs and its non-biometric fallback.
• Use physiological biometrics locally to activate device-bound keys wherever possible.
• Treat behavioural scores as session monitoring that triggers reauthentication, not as a factor.
• Require FMR, FNMR and IAPAR evidence to named standards, and injection detection for remote capture.
• Back-test behavioural models on your own confirmed fraud and run observe-only before acting.
• Complete a DPIA that states whether each use is for unique identification under GDPR Article 9.
• Exclude emotion or stress inference from any workforce tool.
• Minimise telemetry to derived features and protect its integrity in transit.
• Reset behavioural profiles after confirmed takeover and govern model retraining.
• Track detection, false positive, fallback and complaint metrics per journey.

Standards and references

• NIST: SP 800-63B-4 Authentication and Authenticator Management
• NIST: SP 800-63A-4 Identity Proofing and Enrollment
• GDPR: Article 9 Processing of special categories of personal data
• GDPR: Article 4 Definitions
• ICO: Biometric data guidance, key data protection concepts
• EU AI Act: Article 5 Prohibited AI practices
• EBA: Opinion on the elements of strong customer authentication under PSD2
• FIDO Alliance: Biometric Component Certification

Related NHI Mgmt Group resources: Biometrics Guide · Biometric Verification vs Identification · Biometrics vs Possession Factors · Behavioural Biometrics Buyer's Guide