Biometrics are now part of everyday identity: face and fingerprint unlock billions of devices, banks verify new customers with a selfie, and some organisations still use voice to authenticate callers. Used well, biometrics make strong authentication easier and identity verification more reliable. Used badly, they create a permanent, unchangeable credential that can be spoofed, injected, leaked or misused, and they bring some of the strictest privacy rules in identity. This guide explains how biometrics are used in authentication and verification, how they are attacked, how to think about accuracy and bias, which laws apply, and the design choices that keep biometric data safe.
Key takeaways
- Local match is safer than central storage. A fingerprint or face that only unlocks a key on the user's device never leaves it; a central database of templates is a lasting breach risk.
- Remote biometric checks need both presentation attack detection and injection attack detection. Deepfakes and virtual cameras target the second.
- Accuracy is a trade-off. Set thresholds by risk, and measure performance across demographic groups.
- Biometric data used to identify people is special category data in the GDPR and heavily regulated elsewhere, including under Illinois BIPA and the EU AI Act.
- Voice alone is no longer a safe authenticator given voice cloning.
Where biometrics are used
| Use | How it works | Example |
|---|---|---|
| Local authentication (unlock) | A biometric sensor on the device unlocks a private key; the server only sees a cryptographic signature | Passkeys and platform authenticators using face or fingerprint |
| Remote verification (1:1) | A live capture is compared with a reference, such as a document photo or enrolled template | Identity proofing at onboarding; re-verification for account recovery |
| Identification (1:N) | A capture is searched against a database of many people | Deduplication in national ID programmes; law enforcement search |
| Behavioural biometrics | Patterns in typing, mouse movement, touch or device handling are scored continuously | Fraud detection during a banking session |
| Voice authentication | A caller's voice is compared with an enrolled voiceprint | Contact centre caller verification |
For authentication, a biometric is best treated as a way to activate a device-bound key rather than as a secret sent to a server. That is how FIDO2 passkeys work: the biometric stays on the device, and the site receives only a signature. See the Passwordless and Passkeys Guide.
Modalities compared
| Modality | Strengths | Weaknesses |
|---|---|---|
| Face | Works with ordinary cameras; matches document photos | Deepfakes and injection in remote capture; lighting and demographic performance differences; strong privacy concerns |
| Fingerprint | Mature, accurate, cheap sensors on devices | Latent print spoofing; unusable for some people and occupations |
| Iris | Very accurate for large-scale identification | Specialist hardware; public acceptance |
| Palm and vein | Hard to capture covertly | Specialist hardware |
| Voice | Works over the phone | Voice cloning makes spoofing cheap; channel noise |
| Behavioural | Continuous and passive | Probabilistic; drifts over time; needs careful privacy handling |
How biometrics are attacked
- Presentation attacks: a physical artefact is shown to the sensor, such as a printed photo, a screen replay, a mask or a fake fingerprint. Presentation attack detection (PAD), tested under ISO/IEC 30107-3, checks for liveness.
- Injection attacks: the attacker bypasses the camera and feeds recorded or generated media straight into the app or browser, using virtual cameras, emulators or tampered apps. PAD never sees a physical artefact, so separate injection attack detection is needed; CEN/TS 18099 describes how to evaluate it.
- Deepfakes and face swaps: generated faces or real-time face swaps used to match a stolen or forged document. See the Deepfake and AI Impersonation Guide.
- Voice cloning: a few seconds of recorded speech can be enough to generate convincing audio, undermining voice authentication.
- Template theft: a breached database of templates cannot be "reset" like a password. Template protection techniques (ISO/IEC 24745) and local storage reduce this risk.
- Morphing: a document photo blended from two faces can match both people.
- Process attacks: the biometric is strong but the fallback, such as a manual review or help desk override, is weak.
Accuracy, thresholds and bias
- False match (false accept) lets the wrong person in. False non-match (false reject) keeps the right person out. Raising the threshold reduces one and increases the other.
- Set thresholds by the harm of each error. A payment approval deserves a lower false match rate than a convenience unlock.
- Performance can differ by age, sex, skin tone and capture conditions. NIST's face recognition evaluations have documented demographic differentials, and the size of the gap varies widely between algorithms.
- Ask vendors for independent test results, including demographic breakdowns, and test on a population that resembles your users.
- Provide an accessible alternative route for people who cannot use a biometric, and give it its own controls.
Privacy and regulation
This is a practitioner summary, not legal advice.
- GDPR and UK GDPR: biometric data processed to uniquely identify a person is special category data under Article 9, requiring a specific condition such as explicit consent, plus a data protection impact assessment in most cases. The UK ICO has published specific guidance on biometric recognition.
- EU AI Act: since February 2025 it prohibits certain practices, including untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education (with narrow exceptions) and biometric categorisation to infer sensitive traits. Remote biometric identification systems are classed as high-risk. Biometric verification that only confirms a person is who they claim to be is treated differently from identification. See the Agentic AI Compliance Guide for AI Act timelines.
- Illinois BIPA: requires written notice, consent, a published retention policy and restrictions on sale, with a private right of action. A 2024 amendment limited damages so that repeated collection of the same biometric from the same person counts as one violation. Texas, Washington and a growing number of other US states have their own rules.
- Retention and purpose: keep templates only as long as needed, for the stated purpose, and delete them when the relationship ends.
The Identity Data Privacy and Consent Guide covers the wider privacy obligations for identity data.
Design principles
- Prefer on-device matching for authentication, with the biometric unlocking a hardware-held key.
- Combine biometric checks with document chip reading, device signals and risk scoring for remote verification, rather than relying on the face match alone.
- Require both PAD and injection detection in remote capture, and ask for independent certification against ISO/IEC 30107-3 and CEN/TS 18099.
- Protect and minimise templates: encrypt them, separate them from identity data, avoid central storage where you can and set retention limits.
- Retire voice-only authentication for anything sensitive, or combine it with other factors.
- Design the fallback as carefully as the biometric route.
Biometrics and AI agents
An AI agent has no biometric. Where agents act for people, biometrics can still play a role: a user can approve a high-impact agent action with a biometric-unlocked passkey on their own device. That keeps the human in the loop without giving the agent any biometric data. See the AI Agent Authorisation Guide.
Practitioner checklist
- Identify every place biometrics are collected, matched or stored, and why.
- Use on-device biometric activation of passkeys for authentication wherever possible.
- Require presentation and injection attack detection for remote capture, with independent test evidence.
- Set match thresholds by risk and check performance across demographic groups.
- Complete a DPIA and document the lawful basis or consent for biometric processing.
- Encrypt, minimise and time-limit template storage, and never keep templates alongside raw identity documents without need.
- Replace voice-only caller authentication for sensitive actions.
- Give every biometric route an accessible, well-controlled alternative.
Standards and references
- ISO/IEC 30107-3:2023 Biometric presentation attack detection: Testing and reporting
- CEN/TS 18099:2024 Biometric data injection attack detection
- NIST SP 800-63B-4 (biometric requirements for authentication) (2025)
- NIST Face Recognition Technology Evaluation (FRTE)
- UK ICO: Biometric data guidance
- Regulation (EU) 2024/1689 (AI Act)
- Illinois Biometric Information Privacy Act (740 ILCS 14)
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Passwordless and Passkeys Guide · Deepfake and AI Impersonation Guide · Identity Verification Buyer's Guide
