Biometrics are now part of everyday identity, yet a face or fingerprint is not a secret, cannot be reset after a breach and is among the most tightly regulated data an organisation can hold. Face and fingerprint unlock phones and laptops, banks verify new customers with a selfie, and some contact centres still recognise callers by voice. This guide covers how biometrics are used for authentication and verification, how they are attacked, what NIST SP 800-63-4 now requires on accuracy and liveness, which privacy laws apply, and how to design, monitor and measure a biometric programme. It is for identity architects, fraud and security teams and privacy officers.
Key takeaways
- Local match is safer than central storage. NIST SP 800-63B-4 says comparison should be performed locally, and the UK ICO notes that with on-device verification "no biometric data leaves" the device, only a token or proof.
- A biometric is not an authenticator on its own. NIST allows biometrics only as part of multi-factor authentication with a physical authenticator, and always with a non-biometric alternative.
- Remote capture needs both presentation attack detection and injection attack detection. Deepfakes fed through virtual cameras and emulators bypass the sensor, so liveness checks alone are not enough.
- Accuracy is a trade-off that differs by group. NIST found false positive rates across demographics "often vary by factors of 10 to beyond 100 times", so test on your own population and set one fixed, risk-based threshold.
- Biometric data is special category data. GDPR Article 9, the ICO's DPIA expectation, the EU AI Act prohibitions and Illinois BIPA all apply.
Where biometrics are used
Controls, risks and laws differ by use. The EU AI Act draws one key line: "biometric verification" is one-to-one confirmation that a person is who they claim to be, while "biometric identification" compares a person against a database of many people.
| Use | How it works | Example | Main risk |
|---|---|---|---|
| Local authentication (unlock) | A sensor on the device unlocks a private key; the server only sees a cryptographic signature | Passkeys and platform authenticators using face or fingerprint | Device theft combined with a weak fallback PIN |
| Remote verification (1:1) | A live capture is compared with a reference, such as a document photo or enrolled template | Identity proofing at onboarding; re-verification for account recovery | Deepfakes, injection and document forgery |
| Identification (1:N) | A capture is searched against a database of many people | Deduplication in national ID programmes; law enforcement search | False matches at scale, surveillance, strict regulation |
| Behavioural biometrics | Patterns in typing, mouse movement, touch or device handling are scored continuously | Fraud detection during a banking session | Opaque scoring, drift, profiling concerns |
| Voice authentication | A caller's voice is compared with an enrolled voiceprint | Contact centre caller verification | Voice cloning; NIST no longer permits it for authentication |
For authentication, treat a biometric as a way to activate a device-bound key rather than as a secret sent to a server. NIST SP 800-63B-4 describes exactly this: a "cryptographically secure device with an integrated biometric sensor that is required to activate the device" counts as a multi-factor authenticator. That is how FIDO2 passkeys and platform authenticators work. See the Passwordless and Passkeys Guide and the Windows Hello for Business Guide.
For verification, the biometric is one signal among several. See the Identity Proofing and KYC Guide.
Modalities compared
NIST SP 800-63B-4 names fingerprint, facial comparison and iris comparison as the three modalities most commonly used for authentication. Its liveness requirements differ by modality: presentation attack detection (PAD) is mandatory for facial recognition, recommended for iris and fingerprint, and voice comparison "SHALL NOT be used".
| Modality | Strengths | Weaknesses | NIST SP 800-63B-4 position |
|---|---|---|---|
| Face | Works with ordinary cameras; matches document photos | Deepfakes and injection in remote capture; demographic differentials; strong privacy concerns; capture may not show intent | PAD required |
| Fingerprint | Mature, accurate, cheap sensors on devices | Latent prints can be lifted from objects; unusable for some people and occupations | PAD recommended |
| Iris | Very accurate for large-scale identification | Specialist hardware; NIST notes iris patterns can be captured with high-resolution cameras | PAD recommended |
| Voice | Works over the phone | Voice cloning makes spoofing cheap; channel noise | Not permitted for biometric comparison |
| Behavioural | Continuous and passive | Probabilistic; drifts over time; needs careful privacy handling | Listed as a biometric characteristic; not a sole authenticator |
A face seen by a front-facing camera does not prove intent, so NIST requires "an explicit mechanism (e.g., tapping a software or physical button)" to establish authentication intent in such cases.
How biometrics are attacked
NIST SP 800-63B-4 is blunt about the root problem: "Biometric characteristics do not constitute secrets." A face can be photographed, latent fingerprints lifted from objects and iris patterns captured with good cameras.
Attacks on capture
- Presentation attacks: a physical artefact is shown to the sensor, such as a printed photo, a screen replay, a mask or a fake fingerprint. PAD checks for liveness, and NIST requires remote PAD to be tested under ISO/IEC 30107-3:2023 with an impostor attack presentation accept rate (IAPAR) below 0.07.
- Morphing: a document photo blended from two faces can match both people.
Attacks on the channel
- Injection attacks: the attacker bypasses the camera and feeds recorded or generated media into the app or browser. NIST SP 800-63A-4 describes these as inserting "modified or forged media between the capture point (e.g., a device) and the element conducting the comparison", and says a biometric comparison "does not prevent these attacks". PAD never sees a physical artefact, so separate injection attack detection is needed. CEN/TS 18099, published in November 2024, defines biometric data injection attacks and how to build a test plan for injection attack detection; presentation attack testing stays with ISO/IEC 30107.
- Deepfakes and face swaps: generated faces or real-time face swaps used with a stolen or forged document. In the Arup Deepfake Fraud 2024, Hong Kong police said every other participant on a video call was a deepfake, and a finance worker made 15 transfers totalling HK$200 million. See the Deepfake and AI Impersonation Guide.
- Voice cloning: Hong Kong police said the Arup fraudsters used publicly available video and audio to emulate the voices of the people they impersonated. NIST SP 800-63B-4 no longer permits voice comparison for authentication. See the Vishing and Smishing Guide.
Attacks on storage and process
- Template theft: a breached database of templates cannot be reset like a password. The ICO points to ISO/IEC 24745, which describes templates that are irreversible, unlinkable, and revocable and renewable, so a compromised template can be cancelled and replaced without a new sample.
- Process attacks: the biometric is strong but the fallback, such as a manual review or help desk override, is weak. In the MGM Resorts Breach 2023, attackers reportedly impersonated an employee in a call to the IT help desk. See the Account Recovery and Help Desk Security Guide.
Accuracy, thresholds and bias
Every biometric decision compares a score with a threshold. A false match (false accept) lets the wrong person in; a false non-match (false reject) keeps the right person out. Raising the threshold reduces one and increases the other. NIST notes the usual choice is to favour a low false match rate, "since false non-matches can often be mitigated by repeating the measurement or using an alternative authentication method".
What NIST SP 800-63B-4 requires
| Requirement | Value in SP 800-63B-4 | Practical meaning |
|---|---|---|
| False match rate (FMR) | One in 10,000 or better "for all demographic groups" | Ask for results per group, not just an average |
| Demographic categories | Sex and skin tone, where they affect performance | Test datasets must cover these groups |
| False non-match rate (FNMR) | Should be less than 5% | Usability target; track complaints and fallbacks |
| Threshold | Fixed; "not feasible to change the threshold for each demographic" | Pick one threshold that meets FMR for every group |
| Presentation attacks | IAPAR below 0.07 when tested | Demand independent PAD test reports |
| Failed attempts | Five consecutive (10 with conforming PAD), then at least 30 seconds between attempts, overall limit 50 (100 with PAD) | Configure lockout and offer another factor |
| Testing | Performance tested to ISO/IEC 19795-1 | Require a test report naming the standard |
Demographic differentials
NIST's 2019 demographic study of face recognition (NISTIR 8280) found that "false positive differentials are much larger than those related to false negatives", that false positive rates across demographics "often vary by factors of 10 to beyond 100 times", and that false positives were higher in women than men and elevated in the elderly and children. The most accurate algorithms were expected to show smaller differentials. NIST's Face Recognition Technology Evaluation (FRTE) 1:1 continues to publish false non-match rates at fixed false match rates for each submitted algorithm.
- Ask vendors for independent results, including demographic breakdowns, and test on a population that resembles your users.
- Provide an accessible alternative for people who cannot use a biometric. NIST requires that "an alternative non-biometric authentication option SHALL always be provided", and says users "should never be required to attempt biometric authentication".
Privacy and regulation
This is a practitioner summary, not legal advice.
| Law or guidance | Scope | Key obligation for biometric programmes |
|---|---|---|
| GDPR and UK GDPR, Article 9 | Biometric data "for the purpose of uniquely identifying a natural person" | Processing is prohibited unless an Article 9 condition applies; the ICO says explicit consent is likely to be the most appropriate condition |
| UK ICO biometric recognition guidance | Organisations using biometric recognition | "You must complete a DPIA before you use a biometric recognition system"; protect templates; consider on-device verification |
| EU AI Act (Regulation (EU) 2024/1689) | AI systems placed on or used in the EU market | Article 5 prohibitions; remote biometric identification, sensitive biometric categorisation and emotion recognition listed as high-risk in Annex III |
| Illinois BIPA (740 ILCS 14) | Private entities collecting biometric identifiers in Illinois | Notice, stated purpose and term, written release, retention policy; private right of action |
- GDPR and UK GDPR: The ICO says explicit consent must be "affirmed in a clear statement" and cannot be inferred from what someone does. The guidance is under review after the Data (Use and Access) Act. See the GDPR Compliance Guide for Security Teams and the DPIA Guide.
- EU AI Act: since 2 February 2025 Article 5 prohibits AI systems that "create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage", emotion inference in workplaces and education institutions (except for medical or safety reasons), and biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Annex III excludes systems whose sole purpose is biometric verification from the high-risk category. See the EU AI Act Compliance Guide and the Agentic AI Compliance Guide for timelines.
- Illinois BIPA: statutory damages are up to $1,000 per negligent and $5,000 per intentional or reckless violation. According to Davis Wright Tremaine, SB 2979, signed on 2 August 2024, treats repeated collection of "the same biometric identifier or biometric information from the same person using the same method of collection" as a single violation and allows consent by electronic signature; the firm reports that the Seventh Circuit has since held the amendment applies retroactively. Texas and Washington have their own biometric statutes. See the US State Privacy Laws Guide.
- Retention and purpose: keep templates only as long as needed, for the stated purpose, and delete them when the relationship ends. NIST requires samples and derived data used for authentication to be erased immediately after the operation. See the Data Retention and Secure Deletion Guide.
The Identity Data Privacy and Consent Guide covers the wider privacy obligations for identity data.
Design principles
- Prefer on-device matching for authentication, with the biometric unlocking a hardware-held key.
- Authenticate the sensor and the channel where comparison is central. NIST requires the sensor or endpoint to be authenticated before capture and all biometric data to travel over an authenticated protected channel.
- Combine signals for remote verification: document chip reading, device signals and risk scoring alongside the face match. See the Device Intelligence and Fingerprinting Guide.
- Require both PAD and injection detection in remote capture. NIST SP 800-63A-4 requires controls to detect "a virtual camera, device emulator, or a jailbroken device", analysis of all submitted media for manipulation, and documented false negative rates for tested attack types.
- Protect and minimise templates: encrypt them, separate them from identity data, prefer schemes with the ISO/IEC 24745 properties, avoid central storage where you can and set retention limits. See the Privacy-Enhancing Technologies Guide.
- Design the fallback as carefully as the biometric route.
- Buy certified components: FIDO Alliance biometric component certification covers both biometric performance and presentation attack detection.
Biometrics and AI agents
An AI agent has no biometric and should never be given one, but agents still touch biometrics in three ways.
- Human approval of agent actions: a user can approve a high-impact agent action, such as a payment or a permission grant, with a biometric-unlocked passkey on their own device. The agent never handles biometric data, and the signed approval can be logged. See the AI Agent Authorisation Guide.
- Agents as attackers: generative tools make deepfake video, cloned voices and synthetic selfies cheap, and automation lets attackers repeat injection attempts at scale.
- Agents handling biometric data: an agent with access to a verification platform, a case management system or a template store becomes a privileged non-human identity with access to special category data. Scope its permissions, log its reads and include it in DPIAs. See the NHI Lifecycle Management Guide.
Detection and monitoring
Send biometric signals to fraud and security monitoring, not only a vendor dashboard.
- Capture integrity events: virtual camera, emulator, rooted or jailbroken device and media manipulation detections,.
- Velocity: many verification attempts from one device, IP range or document number, or the same face matched against several identities.
- Failed attempts and lockouts: spikes in failed comparisons or PAD rejections against one account suggest targeted attack.
- Fallback use: sudden growth in manual reviews, help desk overrides or non-biometric recovery for high-value accounts.
- Template store access: reads, exports and bulk queries.
See the Identity Fraud Prevention Guide for joining these signals with account and payment fraud detection.
Framework mapping
This is an indicative NHI Mgmt Group alignment, not an official crosswalk. Control IDs were checked against NIST CSF 2.0, the NIST SP 800-53 Rev. 5 catalogue and the CIS Controls v8.1 control list (control level); ISO/IEC 27001:2022 Annex A numbers and names come from a published Annex A index.
| Requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | CIS Controls v8.1 |
|---|---|---|---|---|
| Biometric activation of multi-factor authenticators | PR.AA-03 | IA-2(1), IA-2(2), IA-5 | A.8.5 Secure authentication | 6 Access Control Management |
| Biometric accuracy and presentation attack detection | PR.AA-03 | IA-5(12), IA-5(17) | A.8.5 | 6 |
| Remote identity proofing and injection detection | PR.AA-02 | IA-12, IA-12(3) | A.5.16 Identity management | 5 Account Management |
| Template protection and encryption at rest | PR.DS-01 | SC-28, SC-12 | A.8.24 Use of cryptography | 3 Data Protection |
| Lawful basis, consent and DPIA | GV.OC-03 | PT-2, PT-4, RA-8 | A.5.31 Legal, statutory, regulatory and contractual requirements; A.5.34 Privacy and protection of PII | 3 |
| Retention and deletion | PR.DS-01 | SI-12 | A.5.33 Protection of records, A.5.34 | 3 |
| Vendor and component assurance | GV.SC-07 | SA-4, SR-6 | A.5.19 Information security in supplier relationships | 15 Service Provider Management |
| Monitoring capture, fallback and template access | DE.CM-03 | AU-6, SI-4 | A.8.15 Logging, A.8.16 Monitoring activities | 8 Audit Log Management |
See the Control Mapping Guide.
Common failure patterns
- Liveness without injection detection: a vendor passes presentation attack testing, but the app accepts a virtual camera feed, so deepfakes never meet the PAD check.
- A strong biometric with a weak fallback: the face match is excellent, yet a help desk will reset access on a phone call. The MGM Resorts Breach 2023 shows how much a single help desk call can unlock.
- Trusting a face on a video call: staff treat a familiar face and voice as proof of identity for payment instructions. The Arup Deepfake Fraud 2024 is the reference case.
- Average accuracy only: the vendor quotes one overall false match rate; the NIST requirement is one in 10,000 or better for every demographic group.
- Unprotected central templates: raw templates sit beside names and document images, so one breach exposes permanent credentials.
- No DPIA or consent record: facilities or HR deploy a biometric time clock without a privacy review.
Metrics that show progress
| Metric | What it shows | Target direction |
|---|---|---|
| Share of biometric authentication performed on-device | Reduction in central template risk | Up |
| Measured FMR and FNMR per demographic group on your population | Fairness and conformance with NIST thresholds | FMR at or below one in 10,000 for every group; FNMR down |
| Remote capture sessions covered by injection detection | Exposure to deepfake and virtual camera attacks | Up, to 100% |
| Fallback and manual override rate for high-value accounts | Whether attackers are routing around the biometric | Down, with every override logged |
| Biometric processing activities with a current DPIA and lawful basis | Privacy compliance coverage | Up, to 100% |
| Sensitive actions still using voice-only authentication | Exposure to voice cloning | Down, to zero |
See the Identity Security Metrics Guide.
Implementation roadmap
| Phase | Actions | Exit criteria |
|---|---|---|
| First 30 days | Inventory where biometrics are collected, matched or stored, including HR, facilities and contact centres; record purpose, lawful basis, vendor and storage; list voice-only flows | Complete inventory with an owner for each processing activity |
| Days 31 to 90 | Complete or refresh DPIAs; require vendors to supply PAD, injection detection and demographic test evidence; move workforce authentication to biometric-activated passkeys; set lockout limits in line with NIST | DPIAs signed off; vendor evidence on file; voice-only removed for high-risk actions |
| Days 91 to 180 | Test remote verification on your population and against injected media; protect or remove central templates; feed capture and fallback events into monitoring; harden recovery routes | Per-group accuracy measured; monitoring live; retention enforced |
| After 180 days | Re-test after vendor model changes; review metrics quarterly; red team the full journey including fallbacks | Metrics trending in the right direction; findings tracked to closure |
Practitioner checklist
- Identify every place biometrics are collected, matched or stored, why, and under which lawful basis.
- Use on-device biometric activation of passkeys for authentication wherever possible.
- Never accept a biometric as the only factor, and always offer a non-biometric alternative.
- Require presentation and injection attack detection for remote capture, with independent test evidence.
- Set one fixed, risk-based threshold and check performance across demographic groups on your own users.
- Complete a DPIA and document explicit consent or another valid condition before go-live.
- Encrypt, minimise and time-limit template storage, and prefer revocable template protection schemes.
- Replace voice-only caller authentication for sensitive actions.
- Give every fallback route, including the help desk, controls as strong as the biometric route.
- Monitor capture integrity, failed attempts, fallback use and template store access.
Standards and references
- NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
- NIST: SP 800-63A-4 Digital Identity Guidelines, Identity Proofing and Enrollment
- NIST: Face Recognition Technology Evaluation (FRTE) 1:1 Verification
- NIST: NISTIR 8280 Face Recognition Vendor Test Part 3, Demographic Effects
- BSI: PD CEN/TS 18099:2024 Biometric data injection attack detection
- FIDO Alliance: Biometric Certification Resource Documentation
- UK ICO: Biometric data guidance, biometric recognition
- UK ICO: How do we keep biometric data secure?
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- GDPR-Info: Article 9 GDPR, processing of special categories of personal data
- Davis Wright Tremaine: Illinois revises biometrics law to reduce the prospect of ruinous damage awards
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Passwordless and Passkeys Guide · Deepfake and AI Impersonation Guide · Identity Verification Buyer's Guide · Phishing-Resistant MFA Guide