What Is Biometric Authentication?

Biometric authentication uses a physical or behavioural characteristic — fingerprint, face, iris, voice — as evidence of identity. It is convenient, increasingly accurate, and carries one property that distinguishes it from every other factor: it cannot be changed.

A compromised password is rotated. A compromised fingerprint is compromised permanently.

Where it is genuinely strong

Device-local biometrics are the best current implementation. The characteristic never leaves the device, it is stored in a secure hardware element, and what is transmitted is a cryptographic assertion rather than the biometric itself. That is how phone unlock and passkey authorisation work, and it is sound.

The security property comes from the hardware binding rather than from the biometric. The fingerprint unlocks a key that was already bound to the device, which is why this arrangement resists phishing while a biometric transmitted to a server does not.

Where it is weaker than assumed

Server-side biometric matching requires transmitting and storing biometric data, creating a database whose breach is permanent for every person in it. Several privacy regimes treat biometrics as a special category with heightened obligations for precisely this reason.

Presentation attacks — photographs, recordings, moulds, synthetic voice — remain a live contest between spoofing and liveness detection. And accuracy varies across populations, which is both a fairness problem and an operational one where a system fails more often for some users than others.

Accuracy is a distribution, not a number

Vendor accuracy figures describe average performance. Real systems perform unevenly across populations, and the variation matters operationally as well as ethically — users for whom recognition fails repeatedly will find a workaround, and the workaround is usually a weaker factor.

Environmental conditions compound this. Fingerprint readers struggle with gloves, damaged or wet hands. Facial recognition struggles with masks, lighting and angle. In clinical and industrial settings those conditions are normal rather than exceptional.

Evaluating against your actual user population and environment, rather than a vendor benchmark, is the only way to know whether a deployment will be used or circumvented.

The regulatory position is distinct

Several privacy regimes treat biometric data as a special category, with stricter consent requirements, explicit justification for collection and heightened breach consequences. Some jurisdictions have specific biometric legislation with private rights of action.

That changes the calculation for centrally stored templates in particular. Device-local biometrics where the characteristic never leaves the user’s hardware frequently avoid the obligation entirely, because the organisation never processes biometric data at all.

Where central storage is genuinely required, it needs a documented assessment, explicit consent and protection proportionate to data that cannot be reissued after a breach.

The thing most worth getting right

Where to start

Establish whether any system stores biometric templates centrally. If one does, it carries privacy obligations and permanent breach consequences that device-local alternatives avoid entirely.

See deepfake voice fraud for why voice in particular has weakened. GuardsArm runs security risk assessments.