Biometric Authentication in Mobile Apps: What It Is, Types of Sensors, and How It Works

What Is Biometric Authentication?

Biometric authentication is the process of verifying a user's identity based on their unique physiological or behavioral characteristics. In mobile devices, the technology is used for screen unlocking, payment confirmation, and access to protected applications.

A biometric system consists of three components: a sensor that captures a biometric sample (fingerprint, face, voice), an algorithm that extracts unique features, and a matching module that compares them against a stored template. According to NIST, modern face recognition algorithms make errors in only 0.08% of cases under standard lighting conditions.

Biometric methods are replacing traditional passwords because they are tied to the person and cannot be intercepted during transmission. According to a Goode Intelligence report, by 2027 more than 80% of smartphones will be equipped with biometric sensors.

An important advantage of biometrics is speed. The average authentication time for a fingerprint is 0.2 seconds, for face — 0.4 seconds. In comparison, entering a six-digit PIN code takes an average of 2.5 seconds. Across dozens of unlocks per day, this provides significant time savings and reduces cognitive load on the user.

Biometric sensors are classified by security level according to Android CDD and Apple App Review. Class 3 (Strong) — the most reliable sensors certified for payments. Class 2 (Weak) — regular cameras for face recognition, suitable only for screen unlocking. Class 1 — for convenience only, with no security guarantee.

Main Types of Biometric Sensors

Modern mobile devices use four main types of biometric sensors. Each has its own characteristics of accuracy, speed, and resistance to attacks. Sensor selection is determined by cost, form factor, and security requirements of the specific phone model.

Fingerprint Scanner

This is the most common type of biometric sensor in smartphones. Capacitive scanners, used by Apple in Touch ID, analyze the difference in electrical potential between ridges and valleys of the papillary pattern. Ultrasonic scanners (Qualcomm 3D Sonic) penetrate through dirt and protective glass, providing 98.6% accuracy.

Face Recognition

2D cameras use regular photography and work faster, but are less secure. 3D systems (Face ID, Huawei 3D Face Unlock) project 30,000 infrared dots onto the face and build an accurate depth map. The probability of accidental unlocking by another person's face is 1 in 1,000,000 — 20 times lower than Touch ID.

Iris Scanner and Voice Recognition

An iris scanner uses an IR-illuminated camera to analyze up to 200 unique points on the iris. The technology was used in Samsung Galaxy Note 7–9 but gave way to 3D face recognition due to usability issues. Voice biometrics builds a voiceprint based on 100+ acoustic parameters: timbre, fundamental frequency, and articulation. It is used in banking systems for phone verification.

How Biometrics Works in Mobile Devices

The biometric authentication process is divided into two stages: enrollment and verification. During enrollment, the sensor takes multiple captures of the biometric sample, the algorithm extracts distinctive features and saves them as a mathematical template. A template is not an image but a set of numerical vectors that cannot be reversed into the original image.

During verification, a new sample is compared against the stored template, and the system outputs a result: match or reject. Modern algorithms based on neural networks (Neural Engine in Apple A-chips, NPU in Snapdragon) process this comparison in 100–400 milliseconds. According to Apple Security Guide, the Neural Engine performs up to 1 trillion operations per second exclusively for biometric computations.

A key feature of mobile biometrics is that all computations are performed on-device, in an isolated processor area. For Android this is the Trusted Execution Environment (TEE), for iOS — Secure Enclave. Biometric data never leaves the chip and is not transmitted over the internet.

Security of Biometric Data

Biometric security is ensured by hardware isolation and cryptographic protection of templates. The Secure Enclave in Apple A7–A18 processors is a separate coprocessor with its own firmware that encrypts biometric data with a key unique to each device. Only the operating system has access to the Secure Enclave through a secure channel.

On Android devices, the role of Secure Enclave is performed by the Trusted Execution Environment (TEE) based on ARM TrustZone. TEE isolates biometric computations from the main OS and applications. According to the Google Security Blog, Android 12+ requires mandatory use of TEE for all Strong-level biometric operations.

Biometric sensors are also protected against spoofing attacks. Fingerprint sensors check for blood flow or pulse, and Face ID infrared cameras recognize live skin texture and do not respond to photographs, masks, or silicone molds. Liveness detection is a mandatory component of Android Biometric Class 3 certification.

Advantages and Disadvantages of Biometrics

Biometric authentication is significantly more convenient than passwords: the user does not need to remember character combinations, and the process takes fractions of a second. Speed is the main driver for adopting biometrics in mobile payment systems like Apple Pay and Google Pay.

The main disadvantage of biometrics is the inability to change the identifier if compromised. While a password can be changed, a fingerprint or face pattern stays with the person forever. For this reason, biometric systems are always supplemented with a PIN code or password as a backup method.

Additional risks include reduced accuracy with changes in appearance (scars, swelling, age-related changes) and legal precedents of forced unlocking. The US Supreme Court ruled in 2019 that police can demand phone unlocking via Face ID or Touch ID but cannot compel password entry (Fifth Amendment).

Code Example: Using Biometric API on Android

Android provides a unified BiometricPrompt API for all biometric sensors. Below is an example of authentication using the Jetpack Biometric Library. The library automatically detects available sensors on the device and displays the appropriate dialog.

class BiometricAuthActivity : AppCompatActivity() {

    private lateinit var biometricPrompt: BiometricPrompt

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContentView(R.layout.activity_auth)

        val executor = ContextCompat.getMainExecutor(this)
        val callback = object : BiometricPrompt.AuthenticationCallback() {
            override fun onAuthenticationSucceeded(
                result: BiometricPrompt.AuthenticationResult
            ) {
                unlockApp()
            }

            override fun onAuthenticationFailed() {
                showError("Biometric authentication failed")
            }
        }

        biometricPrompt = BiometricPrompt(this, executor, callback)

        val promptInfo = BiometricPrompt.PromptInfo.Builder()
            .setTitle("Confirm your identity")
            .setSubtitle("Use fingerprint or Face ID")
            .setAllowedAuthenticators(
                BiometricManager.Authenticators.BIOMETRIC_STRONG
            )
            .build()

        biometricPrompt.authenticate(promptInfo)
    }
}

The example uses BIOMETRIC_STRONG — the highest security level according to Android classification. It supports only Class 3 sensors: built-in fingerprint scanners and 3D face recognition. Class 2 (BIOMETRIC_WEAK) includes regular cameras and is not certified for payments.

Future of Biometric Authentication

Biometrics is actively evolving: new identification methods are replacing fingerprints and face recognition. Behavioral biometrics (keystroke dynamics, gait analysis) analyzes typing patterns and walking style without requiring a dedicated sensor. The technology is already used in banking systems for fraud detection.

Multimodal biometrics — a combination of multiple methods in a single system — is becoming the standard for high-end smartphones. For example, the Samsung Galaxy S25 combines an ultrasonic fingerprint scanner and 3D face recognition, selecting the best method depending on lighting conditions and hand state. According to Goode Intelligence, the multimodal biometrics market will grow to 12 billion USD by 2029.