Biometric Authentication: What It Is, Types and How It Works

What Is Biometric Authentication?

Biometric authentication is the process of verifying a user’s identity based on their unique physiological or behavioral characteristics. Unlike traditional methods — passwords, PIN codes or one-time tokens — biometrics is tied to the person themselves and cannot be transferred to another individual.

The method is based on measuring and comparing biometric traits against a pre-stored template. The technology has evolved from expensive corporate systems to mass adoption in consumer devices. The first mass-market smartphone with a fingerprint scanner was the Motorola Atrix 4G in 2011, and today biometric sensors are installed in devices starting at $100.

Biometrics solves the key problem of password authentication: human memory. According to a study by Hypr (2024), the average user has over 100 online accounts but uses only 5 unique passwords. Biometrics eliminates the need to remember complex combinations.

How Does Biometric Authentication Work?

The biometric authentication process consists of two phases: enrollment and verification. During enrollment, the system captures a biometric sample, extracts characteristic features, and creates a reference template. During verification, a new sample is compared against the stored template — the algorithm calculates the degree of match and makes a decision.

Biometric Sample Capture

The device sensor captures a raw biometric signal: a fingerprint image through a capacitive matrix, a 3D face map through a dot projector, or a voice spectrum through a microphone. Capture quality directly affects the accuracy of subsequent recognition. Modern sensors use 50 to 300 measurement points per millimeter for fingerprints and up to 30,000 points for the face.

Feature Extraction and Template Creation

The algorithm extracts unique characteristics from the raw data: for fingerprints — minutiae (endings and bifurcations of papillary lines), for the face — distance between eyes, nose shape and jaw contour. These features are converted into a mathematical template of 2 to 20 KB. The original image is not stored — only the feature template, from which the original cannot be reconstructed.

Matching and Decision Making

The system compares the obtained template against the reference, calculating a similarity metric. If the value exceeds a set threshold, authentication is considered successful. The threshold determines the balance between convenience and security: a low threshold increases the False Acceptance Rate, a high one increases the False Rejection Rate. For mobile devices, a typical threshold is set at FAR 0.001% with FRR around 2%.

Types of Biometric Authentication

Mobile devices support several types of biometric sensors, differing in accuracy, speed and resistance to spoofing. Each type has its own application area and security level.

Fingerprint Scanner

The most common type of biometrics in mobile devices. Capacitive scanners create an image of the papillary pattern based on the difference in electrical potential between ridges and valleys of the skin. Ultrasonic scanners, first used in the Galaxy S10, use sound waves for 3D reconstruction of the fingerprint — they work even with wet fingers and are resistant to silicone fakes.

Facial Recognition

Two approaches: 2D camera (simple front-facing camera) and 3D scanning (structured light or ToF). Apple Face ID projects over 30,000 infrared dots onto the user’s face, creating an accurate 3D map. The algorithm on the Neural Engine processes the data in milliseconds and adapts to appearance changes — beard, glasses, hairstyle.

Iris Scanner

The iris of the eye is one of the most stable biometric traits: it practically does not change with age and is not subject to injuries like fingerprints. Iris scanners from Samsung (Galaxy S8–S10) use an IR camera to analyze up to 240 unique iris characteristics. The FAR of such systems is less than 0.0001%, but the capture speed is lower than that of face scanners.

Voice Recognition

Voice biometrics analyzes the physical characteristics of the vocal tract: fundamental frequency, formants and timbre. The technology is used in voice assistants — Siri and Google Assistant — for recognizing a specific user. The main drawback is sensitivity to ambient noise and the possibility of voice recording by an attacker.

Implementing Biometric Authentication in Android

Starting from Android 9 (API 28), Google provides a unified BiometricPrompt API that abstracts work with all types of biometric sensors on the device. The developer does not need to write separate code for the fingerprint scanner and facial recognition — BiometricPrompt itself detects available sensors and shows a standard dialog.

val executor = ContextCompat.mainExecutor(context)
val biometricPrompt = BiometricPrompt(activity, executor,
    object : BiometricPrompt.AuthenticationCallback() {
        override fun onAuthenticationSucceeded(
            result: BiometricPrompt.AuthenticationResult
        ) {
            // Access granted — can show content
            binding.showContent()
        }

        override fun onAuthenticationFailed() {
            // Biometrics not recognized — notify user
            binding.showError("Fingerprint not recognized")
        }

        override fun onAuthenticationError(
            errorCode: Int,
            errString: CharSequence
        ) {
            // Unrecoverable error — biometrics unavailable
            binding.showFallback()
        }
    }
)

val promptInfo = BiometricPrompt.PromptInfo.Builder()
    .setTitle("Sign in to the app")
    .setSubtitle("Confirm identity with fingerprint")
    .setNegativeButtonText("Use PIN")
    .build()

biometricPrompt.authenticate(promptInfo)

The above code demonstrates the full biometric authentication cycle through BiometricPrompt. The onAuthenticationSucceeded callback is called after successful template verification in the Trusted Execution Environment. On devices without a biometric sensor, BiometricPrompt automatically displays the PIN or pattern entry screen — the developer does not need to handle this scenario separately.

An important security requirement: all biometric operations must be performed on the TEE (Trusted Execution Environment) — a hardware-isolated area of the processor. Android BiometricPrompt guarantees the use of TEE through the BiometricManager.Authenticators.BIOMETRIC_STRONG provider, which cannot be tampered with from user space.

Advantages and Disadvantages of Biometrics

Biometric authentication offers significant advantages over passwords, but also has fundamental limitations that the developer must consider when designing application security.

• Speed — fingerprint recognition takes 200–400 ms, Face ID about 1 second, which is significantly faster than entering an 8+ character password
• Convenience — the user does not need to remember and enter credentials; authentication happens subconsciously when touching or looking at the screen
• Inseparability — a biometric trait is always with the user; unlike a token or smart card, it cannot be left at home or lost
• Irreversibility upon compromise — if a biometric template is leaked, it cannot be changed, unlike a password; this is a key drawback of biometrics
• False positives — although FAR is low, it is not zero; 3D face systems have a FAR of about 0.0001%, meaning 1 false recognition per million attempts

A critical limitation — biometrics is not proof of intent. A user can be forced to unlock the device physically or under duress. Therefore, regulators of banking-grade applications (PSD2, PCI DSS) require multi-factor authentication, where biometrics serves only as one factor.

Security of Biometric Data

The security of biometric templates is ensured by hardware protection mechanisms: Secure Enclave in iOS and Trusted Execution Environment (TEE) in Android. These isolated co-processors perform the capture, processing and comparison of biometric data without access from the main processor and operating system.

A key security principle — non-retention of the original sample. The sensor passes only the mathematical representation of features to the TEE, not the fingerprint image or face photo. In Android 13+, the BiometricPrompt API additionally encrypts the authentication result with a cryptographic key generated inside the TEE. This approach makes stealing a biometric database from the server useless — the attacker gets only encrypted templates, not the original data.

International standards ISO/IEC 24745:2022 and FIDO2 regulate biometric storage requirements: original images must not be stored, templates must be irreversibly transformed, and the data channel between the sensor and the comparison module must be hardware-protected. When developing mobile applications, it is recommended to use FIDO2 WebAuthn — a protocol that ensures end-to-end encryption of biometric transactions.