Biometric authentication is becoming an increasingly important part of how organisations verify identities, secure accounts and protect digital transactions. From facial recognition during customer onboarding to fingerprint authentication on mobile devices, biometric technologies can help businesses introduce stronger identity checks without necessarily adding more passwords or manual verification steps.
But not all biometric solutions work in the same way, and greater convenience does not automatically mean stronger protection against fraud.
A system may recognise a face accurately but remain vulnerable to attempts involving photographs, video replays or synthetic media. Another may provide robust security but reject too many legitimate customers, creating unnecessary friction and additional support costs.
For fraud prevention teams, the challenge is choosing technology that delivers the appropriate level of assurance without undermining the customer experience.
The starting question should therefore be: Are we proving the right thing, at the right moment, with the right level of security?
Understand What Biometrics Can and Cannot Prove
Biometric technologies use distinctive physical or behavioural characteristics to support identity recognition.
Common examples include facial features, fingerprints, iris patterns and behavioural signals such as typing or interaction patterns.
However, buyers should distinguish between several different functions.
Biometric verification generally involves comparing a person’s biometric characteristics with a previously established reference.
Biometric identification attempts to determine who somebody is by comparing their characteristics against a wider set of records.
Identity proofing is a separate process that establishes whether a claimed identity is genuine and appropriately linked to the individual. These distinctions matter.
A successful facial match against a reference image does not, by itself, establish that the original image came from a trustworthy identity.
Similarly, biometric authentication can confirm that the same person is returning without proving that the person’s identity was correctly established during registration.
Fraud prevention teams should therefore evaluate biometric capabilities within the wider identity-verification process.
Match the Technology to the Fraud Risk
Not every transaction or customer interaction requires the same level of verification.
Opening a financial account may require more extensive identity checks than accessing a low-risk service.
Changing sensitive account information, recovering access or authorising a high-value transaction may justify additional safeguards.
NIST’s Digital Identity Guidelines recommend taking a risk-based approach to identity assurance, considering the consequences of authentication or identity-proofing failures.
That principle should guide biometric procurement.
Buyers should identify which fraud risks they are trying to address before comparing technology.
Is the primary concern account takeover, impersonation, fraudulent onboarding or unauthorised transactions?
Different risks may require different combinations of identity evidence, biometric verification, authentication and monitoring.
The most sophisticated biometric technology is not necessarily the most appropriate for every use case.
Compare Facial Recognition and Other Biometric Methods
Facial recognition is particularly relevant to remote identity verification because many customers already have access to a smartphone camera.
It can support comparisons between a live facial capture and a reference image, such as a photograph extracted from an identity document.
Fingerprint recognition is widely used in device-based authentication, while iris recognition can provide another biometric option in suitable environments.
Behavioural biometrics may analyse interaction patterns, including typing rhythm or the way someone uses a device, to identify signals associated with unusual activity.
Each approach has different requirements, strengths and limitations.
Buyers should consider the customer devices involved, the level of assurance required and whether the biometric method is appropriate for the intended journey.
The UK National Cyber Security Centre (NCSC) warns that the security and usability benefits of biometrics depend heavily on how systems are designed and deployed.
Technology selection should therefore follow the business requirement rather than simply favouring the most familiar biometric method.
Evaluate Liveness Detection and Presentation Attack Resistance
A central concern in remote biometric verification is determining whether the system is interacting with a genuine person rather than an attempted impersonation.
Presentation attacks may involve photographs, masks, recorded video or other material intended to deceive a biometric sensor.
Liveness detection, more precisely described in many technical contexts as presentation attack detection, is designed to identify some of these attempts.
Solutions may use passive analysis, active user challenges or combinations of techniques.
Fraud prevention teams should ask how the technology has been tested and which attack types are covered.
Independent testing against recognised standards, including the ISO/IEC 30107 series for biometric presentation attack detection, can provide useful supporting evidence.
However, buyers should understand the scope of any certification or test report.
Performance against one category of attack does not demonstrate resistance to every possible form of impersonation.
Consider Deepfakes and Injection Attacks
Generative AI has increased the potential sophistication of synthetic facial and voice content.
But organisations should distinguish between attempts to deceive a camera and attacks that bypass the camera altogether.
In an injection attack, manipulated images or video may be introduced directly into an application’s capture or processing flow.
That creates a different challenge from presenting a photograph or recording to a genuine camera.
Buyers should therefore establish whether a provider’s protections address both presentation attacks and relevant injection threats.
Useful questions include how the system verifies the integrity of the capture process, detects manipulated inputs and responds when suspicious activity is identified.
The objective should be layered protection rather than reliance on a single liveness score.
Compare Accuracy Using Meaningful Measures
Biometric providers may advertise high accuracy rates, but buyers need to understand what those figures mean.
Two important measures are the false match rate and false non-match rate.
The false match rate describes how often a system incorrectly matches different individuals.
The false non-match rate describes how often it fails to match two samples from the same individual.
The appropriate balance depends on the intended use.
A system designed to protect high-risk financial transactions may prioritise reducing false matches, while an everyday authentication process must also consider the inconvenience caused by rejecting legitimate customers.
Accuracy can also vary with image quality, lighting, devices and other operating conditions.
Fraud prevention teams should ask for evidence reflecting the environments and populations in which the solution will operate.
Headline accuracy figures are not enough.
Assess Fairness and Accessibility
Biometric systems must work effectively for a diverse customer population.
Performance may vary across demographic groups or in circumstances involving disabilities, particular physical characteristics or difficulties using standard capture processes.
Buyers should ask providers about demographic performance testing, accessibility and how people can complete verification when the primary biometric method is unsuitable.
This is both a customer experience and risk-management issue.
A solution that frequently rejects legitimate customers may create financial and reputational consequences, as well as additional work for customer-support teams.
NIST’s updated guidance places greater emphasis on accessibility and usability within digital identity processes.
The aim should be to make secure verification available to the widest practical range of legitimate users.
Don’t Confuse Biometrics with Passkeys
Passkeys are becoming increasingly relevant to fraud prevention because they offer a phishing-resistant alternative to traditional passwords.
However, passkeys and biometric recognition are not interchangeable technologies.
Passkeys use cryptographic authentication. A customer may unlock a passkey using fingerprint or facial recognition on their device, but the remote service generally receives cryptographic proof rather than the customer’s biometric data.
The FIDO Alliance explains that biometric processing used to unlock passkeys remains on the user’s device.
This distinction can be important for organisations seeking stronger account authentication without centrally processing biometric information.
Fraud prevention teams should consider whether device-based passkeys, remote biometric identity verification or a combination of approaches best addresses the relevant risks.
Evaluate Privacy and Data Protection
Biometric data requires particular care because it relates to characteristics that individuals cannot simply replace if compromised.
The Information Commissioner’s Office (ICO) explains that biometric information processed for the purpose of uniquely identifying someone is special category personal data under the UK GDPR.
Organisations using biometric recognition therefore need both an appropriate lawful basis and a valid condition for processing special category data.
Buyers should establish what information is collected, where it is stored, how long it is retained and which parties can access it.
They should also examine whether the system uses raw biometric images, templates or other derived information.
A data protection impact assessment may be required, particularly where processing presents a high risk to individuals.
Organisations should involve legal, privacy and information security colleagues early in procurement rather than treating compliance as a final implementation task.
Understand Storage and Security Architecture
A biometric system can introduce new risks if sensitive information is inadequately protected.
Buyers should establish whether biometric templates are held on a customer’s device, within the organisation’s infrastructure or by a specialist technology provider.
Each approach has different operational and security implications.
Questions should cover encryption, access controls, retention, deletion, incident response and arrangements for handling compromised biometric information.
Unlike passwords, biometric characteristics cannot usually be changed.
That makes the protection of stored references and the availability of secure alternative authentication methods especially important.
Fraud prevention teams should consider the entire biometric information lifecycle, from enrolment to deletion.
Review Integration with Fraud and Identity Systems
Biometrics is rarely a complete fraud prevention strategy in isolation.
A biometric verification result may need to be considered alongside identity documents, device information, behavioural signals, account history or transaction risk.
Buyers should establish how the proposed technology connects with existing identity and fraud management systems.
Can its results be incorporated into a wider risk decision? Are relevant events available for investigation? Can additional verification be triggered when circumstances justify it?
Integration should also support consistent customer experiences.
A verification process that requires customers to repeat information already provided elsewhere may create unnecessary friction.
The strongest approach uses biometrics as part of a coordinated identity and fraud prevention framework.
Consider Enrolment and Account Recovery
An effective biometric authentication system depends on a trustworthy enrolment process.
If an attacker can register their own biometric reference against another person’s account, subsequent successful matches may simply reinforce the original compromise.
Buyers should therefore examine how biometric references are established, verified and updated.
Account recovery deserves particular attention.
What happens when somebody loses their device, changes their appearance, cannot complete biometric verification or needs to regain access?
Recovery processes should be sufficiently secure to prevent attackers bypassing otherwise strong authentication.
An organisation can invest heavily in biometric security but undermine it through weak account recovery procedures.
Measure the Impact on Customer Experience
One of the attractions of biometrics is the potential to make verification faster and more convenient.
However, the actual experience depends on how the technology performs in real conditions.
Customers may encounter difficulties with poor lighting, older devices, unreliable connectivity or unclear instructions.
Organisations should therefore assess completion rates, time to verify, abandonment and the proportion of users requiring additional assistance.
They should also distinguish between genuine fraud prevention and unnecessary customer rejection.
A solution that blocks more transactions is not necessarily performing better if it is disproportionately affecting legitimate users.
The objective should be to reduce fraud while preserving appropriate access.
Compare Total Cost and Operational Requirements
Biometric solutions may be priced according to verification volumes, transactions, subscriptions or wider platform arrangements.
However, the headline technology price is only one part of the overall cost.
Buyers should consider integration, ongoing management, support, manual reviews, alternative verification processes and the consequences of unsuccessful customer journeys.
A lower-cost solution may become expensive if it generates substantial volumes of manual intervention.
Conversely, additional investment in stronger verification may be justified where the potential consequences of fraud are significant.
The appropriate comparison is between total operational cost, fraud risk reduction and customer experience.
Questions to Ask Biometric Authentication Providers
Before selecting a solution, fraud prevention teams should consider:
- Which fraud risks and customer journeys is the technology designed to address?
- Does it support identity proofing, authentication or both?
- Which biometric methods are available?
- How are genuine users distinguished from presentation attacks?
- What protections exist against deepfake and injection attacks?
- Has the technology undergone independent testing?
- What are the false match and false non-match rates?
- How does performance vary across devices and user groups?
- What alternative verification methods are available?
- Where is biometric information stored and processed?
- What retention, deletion and access controls are provided?
- How does the solution integrate with existing fraud systems?
- How are enrolment and account recovery protected?
- What reporting supports fraud analysis and operational monitoring?
- What is the total cost, including manual review and customer support?
Frequently Asked Questions
What is biometric authentication?
Biometric authentication uses physical or behavioural characteristics, such as fingerprints or facial features, to help verify that somebody is an authorised user.
How does biometric authentication prevent fraud?
Biometrics can strengthen identity checks and make certain impersonation attempts more difficult. Effectiveness depends on the enrolment process, resistance to attacks and how the technology is integrated with other security measures.
What is biometric liveness detection?
Liveness detection is a term commonly used for technologies that help distinguish genuine biometric presentations from attempted attacks involving photographs, recordings or other artificial material.
Can biometric systems be fooled by deepfakes?
Some attacks may attempt to use synthetic or manipulated media against biometric systems. The level of protection varies, and buyers should evaluate both presentation attack detection and safeguards against manipulated inputs.
Are passkeys the same as biometric authentication?
No. Passkeys use cryptographic authentication. Biometrics may be used locally to unlock a passkey, but the remote service does not generally receive the biometric information.
Is biometric data covered by UK GDPR?
Yes. Biometric data used to uniquely identify an individual is special category personal data under the UK GDPR and is subject to additional legal requirements.
Product & Services Guide
The Fraud Prevention Summit brings together senior fraud, risk and identity decision-makers with relevant solution providers through pre-arranged one-to-one meetings, offering an opportunity to explore biometric authentication, digital identity, fraud detection and related security technologies.
Choose Assurance, Not Just Authentication
Biometric technology can provide valuable protection against identity fraud while making verification easier for legitimate customers.
But selecting the right solution requires more than comparing recognition accuracy or the speed of a facial scan.
Fraud prevention teams need to understand what the system establishes, which attacks it can resist, how customer information is protected and what happens when verification fails.
A useful buying framework is: risk → identity → verification → protection → experience → review
Identify the fraud risk.
Establish the identity assurance required.
Select an appropriate verification method.
Evaluate security, privacy and attack resistance.
Test the experience for genuine customers.
Then review whether the system delivers the intended reduction in risk.
The best biometric solution isn’t necessarily the one that recognises a face most quickly. It’s the one that helps an organisation make the right decision about who to trust.
The Fraud Prevention Summit brings together senior fraud, risk and identity decision-makers with relevant solution providers through pre-arranged one-to-one meetings, offering an opportunity to explore biometric authentication, digital identity, fraud detection and related security technologies.
Related Reading
This is the first article in our November Biometrics series.
It provides a buyer’s guide to evaluating biometric authentication solutions, including technology selection, security, accuracy, privacy, integration and customer experience.
The next article will examine how organisations can strengthen biometric verification against evolving impersonation threats while maintaining an effective experience for legitimate users.
Sources
- NIST – Digital Identity Guidelines, SP 800-63-4
- NIST – Digital Identity Guidelines: Authentication and Authenticator Management
- NCSC – Understanding Biometrics
- ICO – Biometric Recognition
- ICO – How Do We Process Biometric Data Lawfully?
- FIDO Alliance – Passkeys
- ISO – ISO/IEC 30107-3 Biometric Presentation Attack Detection Testing and Reporting
Image credit: https://unsplash.com/photos/abstract-geometric-pattern-with-glowing-blue-and-yellow-lines-AkukBHn1NJU
