Fingerprint Authentication — What It Is, How It Works, and Applications

What Is Fingerprint Authentication?

Fingerprint authentication is a biometric identification method that analyzes the unique papillary pattern on the surface of a finger to verify a user's identity. Each person has an individual pattern of ridges and valleys that forms at the 12th week of prenatal development and remains unchanged throughout life, except for physical injuries.

A fingerprint is one of the three types of biometric characteristics recognized as the most reliable for automatic identification, along with the iris of the eye and the retinal pattern. Papillary lines form characteristic features — minutiae: endings, bifurcations, dots, and crossovers. The uniqueness of a fingerprint is determined by the location and type of 40–100 minutiae in the scanning area, giving a mathematical probability of a match of 1 in 64 billion for two different people.

The first automated fingerprint identification systems (AFIS) appeared in the 1970s for law enforcement agencies. Mass adoption in consumer devices began in 2013 with the iPhone 5S and Touch ID. Today, fingerprint scanners are installed in smartphones, laptops, tablets, door locks, and payment terminals.

How Does a Fingerprint Scanner Work?

Regardless of the sensor type, the fingerprint authentication process consists of three stages: image capture, processing and feature extraction, and comparison with a reference template. Each stage can be performed either at the OS level or at the Trusted Execution Environment level, depending on the implementation.

Fingerprint Image Capture

The sensor captures the physical pattern of the finger. Capacitive arrays read the difference in electrical potential between ridges (touching the array) and valleys (not touching). Optical scanners illuminate the finger with LED lighting and capture the reflected light through a CMOS sensor. Ultrasonic sensors emit a sound wave and analyze the echo reflected from different depths of the skin — this provides a three-dimensional image that is resistant to surface contaminants on the finger.

Minutiae Extraction and Template Creation

The captured image undergoes filtering: noise removal, contrast normalization, and binarization (conversion to black and white). The algorithm identifies papillary ridge lines, skeletonizes them (thins to 1-pixel width), and finds minutiae — ending and bifurcation points of lines. Each minutia is described by coordinates (x, y), direction angle, and type. The mathematical template is 2–10 KB in size, does not contain the original image, and cannot be used to reconstruct the fingerprint.

Comparison and Decision Making

The template obtained during scanning is compared with the reference template saved during enrollment. The algorithm calculates the number of matching minutiae. Successful verification requires a match of at least 12–15 minutiae (adjustable by the manufacturer). If the number of matched points exceeds the threshold, authentication is considered successful. In mobile devices, the threshold is set so that FAR does not exceed 0.001% with an FRR of about 2%.

Types of Fingerprint Scanners

Modern mobile devices use three main types of fingerprint scanners, differing in sensing technology, accuracy, and production cost. The choice of type depends on the device's price segment and security requirements.

In 2025–2026, in-display scanners integrated directly under the OLED screen are gaining popularity. They can be either optical (budget segment) or ultrasonic (premium segment). The advantage is the absence of a separate button or zone on the body, allowing for a bezel-less display. The disadvantage of optical in-display scanners is vulnerability to bright sunlight, which saturates the CMOS sensor through the screen pixels.

Fingerprint vs. Face Recognition Comparison

Fingerprint authentication and face recognition are the two dominant biometric technologies in mobile devices. Each has strengths and weaknesses that influence the choice for specific use cases.

• Accuracy (FAR) — Ultrasonic fingerprint scanner: 0.0005%, 3D Face ID: 0.0001%. Face recognition is more accurate when using a depth camera
• Speed — Capacitive scanner: 200–300 ms, optical: 400–600 ms, 3D face: 600–1000 ms. Fingerprint is faster in static scenarios
• Contactless — Face ID and 2D face do not require touching the device; fingerprint requires physical contact with the scanner
• Conditions — Fingerprint does not work with wet fingers but works with masks and gloves; Face ID does not work with masks (without Apple Watch) and when the IR camera is obstructed
• Sensor cost — Capacitive scanners: ~$0.5–1.5, ultrasonic: ~$3–5, 3D TrueDepth camera: ~$12–15

For mobile app developers, it is important to note that BiometricPrompt on Android and LocalAuthentication on iOS abstract away the sensor type. However, on older Android devices (API < 28), only FingerprintManager may be available — in this case, the app must explicitly check the sensor type and offer an alternative authentication method.

Implementing Fingerprint Auth on Android

Before Android 9 (API 28), the only way to integrate the fingerprint scanner was the FingerprintManager class, added in API 23. Starting with Android 9, Google recommends using BiometricPrompt, which unifies work with all types of biometric sensors. However, for devices with API 23–27, developers may still need FingerprintManager.

class FingerprintAuthHelper(
    private val context: Context
) {
    private val manager =
        context.getSystemService(Context.FINGERPRINT_SERVICE)
            as FingerprintManager?

    fun isFingerprintAvailable(): Boolean {
        return manager?.isHardwareDetected() == true
            && manager?.hasEnrolledFingerprints() == true
    }

    fun authenticate(callback: FingerprintManager.AuthenticationCallback) {
        if (isFingerprintAvailable()) {
            manager?.authenticate(
                null,
                CancellationSignal(),
                0,
                callback,
                null
            )
        }
    }
}

// Usage:
val helper = FingerprintAuthHelper(context)
helper.authenticate(object : FingerprintManager.AuthenticationCallback() {
    override fun onAuthenticationSucceeded(
        result: FingerprintManager.AuthenticationResult
    ) {
        // Fingerprint recognized — access granted
        binding.showContent()
    }

    override fun onAuthenticationFailed() {
        binding.showError("Fingerprint not recognized")
    }
})

The code above demonstrates the full authentication cycle using FingerprintManager for older Android devices. It is important to note that FingerprintManager does not use TEE by default — the authentication result is returned to userspace, making it less secure than BiometricPrompt with the BIOMETRIC_STRONG flag. For new projects, BiometricPrompt should always be used, and FingerprintManager should only be used for backward compatibility with API 23–27.

When migrating from FingerprintManager to BiometricPrompt, consider the change in the security model: BiometricPrompt guarantees that all biometric operations are performed in the TEE (Trusted Execution Environment). The authentication result, signed by a cryptographic key inside the TEE, cannot be forged from userspace code. The AndroidX Biometric library additionally provides the BiometricPrompt.AuthenticationResult.getCryptoObject() interface for binding biometric authentication to cryptographic operations — key encryption and data signing.

Security Standards and Spoof Protection

Protection against fingerprint spoofing is one of the key challenges for scanner manufacturers. Modern sensors use a combination of hardware and algorithmic methods for liveness detection and blocking replicas. Each method has its limitations, but together they make spoofing economically unviable for mass attacks.

Key protection methods include: skin depth analysis (ultrasonic scanners determine the thickness of the epidermis by the echo return time), spectral skin analysis (optical scanners evaluate the reflection coefficient of skin at different wavelengths — silicone and gelatin have different spectra), pulse detection (micro-vibrations of blood flow in finger capillaries), and potentiometric verification (living skin has a specific electrical impedance that differs from synthetic materials).

The ISO/IEC 30107-3:2023 standard defines levels of biometric system resistance to presentation attacks (presentation attack detection, PAD). For financial applications, Level 2 (PAD Level 2) is recommended, requiring automatic detection of at least 95% of attacks using replicas with an FAR of no more than 0.01%. Samsung and Qualcomm 3D Sonic Sensor ultrasonic scanners meet PAD Level 2 requirements, while budget optical scanners typically do not pass certification above Level 1.