Fingerprint Scanner in Mobile Devices — What It Is, Types of Sensors and Operating Principle

What Is a Fingerprint Scanner?

A fingerprint scanner is an electronic device that captures an image of the papillary pattern on a person’s finger and converts it into a digital template for subsequent comparison. Each papillary pattern is unique — even identical twins have different fingerprints in terms of ridge placement, bifurcations, and endings (minutiae).

Modern fingerprint scanners are divided into three types based on their physical operating principle: optical, capacitive, and ultrasonic. All three types are used in mobile devices: capacitive — in iPhones and high-quality Android devices, optical — in budget models, ultrasonic — in Samsung and Xiaomi flagships.

According to NIST SP 800-63B, a properly implemented fingerprint scanner provides a FAR (False Acceptance Rate) from 1:50,000 to 1:100,000, which is acceptable for most scenarios except government security. The average response time varies from 0.15 to 0.4 seconds depending on the sensor type.

Types of Fingerprint Scanners in Phones

Each scanner type uses its own physical principle to capture a fingerprint. The choice of technology determines cost, accuracy, resistance to external factors, and the possibility of under-display integration. Let’s look at the three main types used in modern smartphones.

Optical Scanners

An optical scanner takes a photo of the finger using a CMOS or CCD sensor with a resolution of 300 to 1000 dpi. The finger is illuminated by LEDs or a miniature lamp, and the reflected light hits the sensor through a prism or microlenses. Optical scanners are the cheapest (sensor cost from $1 to $3), but they are easily fooled by a high-quality fingerprint photo.

Capacitive Scanners

Capacitive sensors consist of an array of capacitors on a silicon chip. The ridges of the papillary pattern change the capacitance of individual cells, creating an electrical image of the fingerprint. The advantage of capacitive scanners is that they only work with living tissue (measuring electrical conductivity), which protects against silicone fakes.

Ultrasonic Scanners

An ultrasonic scanner (Qualcomm 3D Sonic, Goodix) emits high-frequency sound waves (20–40 MHz) and measures the echo reflected from the finger. The waves penetrate dirt, protective glass, and even thin gloves, creating a 3D map of the papillary pattern at a depth of up to 0.5 mm. The accuracy of ultrasonic scanners reaches 98.6% with FAR 1:100,000.

Comparison: Optical, Capacitive, and Ultrasonic Sensors

Optical scanners are suitable for budget devices due to their low cost but fall short in security. Capacitive sensors are the gold standard for built-in button scanners (Touch ID, Google Pixel Imprint). Ultrasonic scanners are expensive but the most reliable, used in Samsung Galaxy S24/S25 flagships and Xiaomi 14 Pro.

When choosing a scanner type, manufacturers consider not only cost but also design requirements. Under-display optical and ultrasonic scanners allow the front panel of the phone to be completely smooth without visible buttons. Capacitive scanners require a separate button or area, which limits design options but provides a more predictable sensor location and tactile feedback on touch. According to Counterpoint Research, 76% of users find the fingerprint scanner on the side button to be the most convenient location.

In-Display Fingerprint Scanners

In-display fingerprint scanners are built directly under the display matrix. The first commercial device with such a scanner was the vivo X20 Plus UD in 2018. Today, the technology is used in most Android flagships and mid-range models.

There are two types of in-display scanners: optical (work only with OLED screens, through which light passes) and ultrasonic (work with any type of display). Optical under-display scanners illuminate the finger through the gaps between OLED pixels, and the sensor under the panel reads the reflection. The scanning area is usually highlighted by a green ring on the screen.

Disadvantages of in-display scanners include a smaller scanning area (12×8 mm for optical vs. 20×10 mm for button-based) and the need to accurately place the finger over the sensor area. Ultrasonic under-display scanners (Qualcomm 3D Sonic Gen 2) have an area of 64 mm² and support two simultaneous fingerprints for increased accuracy.

Manufacturers are constantly working on improving under-display scanners. In 2024, Qualcomm introduced the 3D Sonic Gen 3 with an increased scanning area of up to 100 mm² — this allows unlocking the phone by touching almost any area on the lower half of the screen. Goodix, the second largest supplier of optical under-display sensors, achieved a response time of 0.12 seconds — faster than any button-based scanner.

Security and Anti-Spoofing

Fingerprint scanner security is determined by two factors: hardware protection against fakes and cryptographic protection of stored templates. Liveness detection is the key technology that distinguishes living tissue from a fake. Capacitive sensors check electrical conductivity, ultrasonic sensors check skin acoustic resistance, and optical sensors (in modern versions) check blood pulsation in capillaries.

According to a study by Kaspersky Lab, 72% of tested optical scanners in budget phones were fooled by silicone casts. Apple Touch ID capacitive scanners are resistant to this attack, but in 2017, researchers from Tencent demonstrated an attack using an ultrathin 3D-printed overlay. Qualcomm ultrasonic scanners have not been fooled by any known methods.

At the software level, modern Android implementations store fingerprint templates in the Trusted Execution Environment (TEE) or a hardware security module (StrongBox KeyStore on Titan or Qualcomm SPU chips). iOS uses the Secure Enclave. The template is encrypted and not accessible to applications — this is a mandatory requirement of the Android CDD and Apple App Review Guidelines.

Each manufacturer implements protection differently. Samsung Knox uses its own TrustZone with isolated storage for fingerprints. Google Pixel with the Titan M2 chip provides isolation at the bootloader level. Qualcomm Secure Processing Unit (SPU) — a dedicated core in the Snapdragon processor that processes biometrics without involving the main CPU. Independent audits by NCC Group and Kryptowire confirm that all three implementations provide hardware isolation of templates at a level sufficient for Android Strong certification.

Users should remember that a fingerprint scanner is primarily a convenience tool, not absolute protection. For financial transactions and access to critical data, it is recommended to use two-factor authentication: fingerprint or face plus a password or hardware token. Biometrics are convenient as a first factor but should not be the only barrier between an attacker and confidential data.

Code Example: BiometricManager on Android

Android BiometricManager allows checking the presence and type of fingerprint scanner on the device before calling authentication. This is important to correctly handle scenarios when the biometric sensor is missing or damaged. Below is an example of checking scanner availability.

class FingerprintChecker {

    fun checkSensor(context: Context) {
        val biometricManager =
            context.getSystemService(BiometricManager::class.java)

        val authenticators =
            BiometricManager.Authenticators.BIOMETRIC_STRONG

        when (biometricManager.canAuthenticate(authenticators)) {
            BiometricManager.BIOMETRIC_SUCCESS -> {
                println("Scanner available")
            }
            BiometricManager.BIOMETRIC_ERROR_NO_HARDWARE -> {
                println("No fingerprint scanner")
            }
            BiometricManager.BIOMETRIC_ERROR_HW_UNAVAILABLE -> {
                println("Scanner temporarily unavailable")
            }
            BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED -> {
                println("No fingerprints registered")
            }
        }
    }
}

The canAuthenticate method with the BIOMETRIC_STRONG flag checks whether the device has a Class 3 sensor (the most secure). For under-display scanners and ultrasonic sensors, Android returns BIOMETRIC_SUCCESS only if the sensor is certified as Strong. If the fingerprint scanner is absent, alternative authentication methods should be offered to the user: PIN code, password, or face unlock.