What official guidance says
The National Institute of Standards and Technology sets the federal government’s own digital identity standards, and its guidelines are clear on this point: biometrics may be used only as part of multi-factor authentication, paired with something you hold in your hand, not as a stand-alone login method. That’s a real constraint on a technology most people already treat as sufficient on its own to unlock a phone or approve a payment.
The reasoning traces back to a property biometrics can’t escape. A password that leaks can be changed in minutes. A fingerprint or a face template that leaks can’t be reissued, because you only get one face and ten fingerprints for life. Security researchers have already demonstrated the real-world version of this problem. In 2025, researchers showed that local device access could let an attacker tamper with stored biometric templates so the system accepts a fingerprint or face that isn’t the real one.
Why convenience and security pulled in opposite directions here
Biometric login exists to remove friction: no code to remember, no password to type, only a glance or a touch. That convenience is real, and it’s part of why adoption spread so fast. But the same design that removes friction also removes a layer of protection a password has by default: you can’t reset a face the way you reset a password, and a compromised biometric stays compromised everywhere it was ever used.
Implemented well, biometrics raise the bar against casual theft and shoulder-surfing in ways a weak password never could. The lesson is to treat “I unlock with my face” as one piece of a system, the way NIST’s own framework does, rather than the whole system.
The practical takeaway
Keep biometric unlock enabled, but check that a second factor still guards anything that matters: financial accounts, email, anything tied to recovery access for other services. Most phones already default to this: biometric unlock backed by a PIN as fallback, which is close to the NIST model people don’t realize they’re already using. The gap shows up more in third-party apps that let biometrics serve as the entire login with no second factor behind it. Check settings on banking and financial apps in particular. That’s where a stand-alone biometric login carries the most real risk.
Biometric spoofing (fake fingerprints, AI-generated video used to defeat facial recognition) is an active and evolving area of attack. Liveness detection has improved, but no biometric system available today is unbeatable in every scenario, which is the exact gap a second factor exists to cover.
Reference
National Institute of Standards and Technology. “Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B).” https://pages.nist.gov/800-63-4/sp800-63b.html
Top comments (0)