Android Biometrics Done Right: Fingerprint and Face

I used to think face unlock was the ultimate convenience until I tried using it in a dark room or with sunglasses on. Biometrics—fingerprints and face scans—are supposed to make our lives easier, but on Android, not all biometrics are created equal. I’ve seen people assume their $200 budget phone is just as secure as a flagship Pixel because both have "Face Unlock," but that's a dangerous mistake. Under the hood, Android treats these sensors very differently. I’ve had to learn the hard way which sensors I can trust with my banking apps and which ones are basically just for show.

Biometric classes 1-3

Google actually rates biometric hardware into three classes: Class 1 (Simple), Class 2 (Weak), and Class 3 (Strong). This is something most sales reps won't tell you. Class 3 is the only one Google considers secure enough for things like Google Pay or signing into your bank. To be Class 3, the sensor has to have a "Spoof Acceptance Rate" of less than 7%. If your phone only has a Class 1 sensor, Android won't even let you use it for apps that require high security—it'll force you to type your PIN instead. I found this out on an older budget Motorola I was testing; the face unlock worked to get to the home screen, but my banking app wouldn't even show the option. It's a good safety rail, though it can be confusing if you don't know why it's happening.

Face unlock variants

There are two main ways Android phones "see" your face. The first is just using the regular front-facing camera. This is software-based 2D imaging. It's fast, but it's easily fooled by a high-resolution photo of you or even a video playing on another screen. Most cheap phones use this. Then there is 3D mapping, which uses infrared sensors to create a depth map of your face. This is much harder to trick. If you're using a phone that only uses the 2D camera, I honestly suggest turning it off if you care about privacy. It’s too easy for someone who looks vaguely like you—or even just a sibling—to get in. It stays in the "Class 1" category for a reason.

Pixel face unlock

Google did something interesting starting with the Pixel 8. They managed to get a "Class 3" rating using just the front camera by leveraging some heavy-duty AI and the Tensor chip. I was skeptical. I tried to trick my Pixel 8 Pro with photos and even a mask, and it held up. It looks for "liveness"—tiny movements and depth cues that a flat photo doesn't have. If you have a Pixel 8 or 9, you can go to Settings > Security & privacy > Device unlock > Face & Fingerprint Unlock. Make sure you toggle on "Require eyes to be open." This is a huge privacy win. It prevents someone from pointing your phone at your face while you're asleep to unlock it. I’ve made that mistake before, and it’s a lesson you only want to learn once.

Samsung ultrasonic fingerprint

Samsung’s high-end phones, like the S23 and S24, use "ultrasonic" fingerprint sensors built into the screen. Instead of taking a picture of your thumb (optical), it uses sound waves to map the ridges of your print in 3D. It’s generally faster and works better with wet fingers than the optical ones found on the Pixel 6 or 7. However, I’ve found that some thick glass screen protectors can mess with it. If you’re using an ultrasonic sensor, I highly recommend re-registering your fingerprints after you apply a screen protector. Go to Settings > Security and privacy > Biometrics > Fingerprints and add the same finger twice. It’s a little "pro tip" that makes the recognition much more reliable in my experience.

Legal protections vs PIN

This is the part that surprises people the most. In many places, including parts of the US, the law treats biometrics and PINs differently. A court might be able to compel you to put your finger on a sensor or look at your phone, but they usually can't force you to give up a PIN or password in your head (the "Fifth Amendment" protection). If I'm ever in a situation where I'm worried about my phone being searched without my consent—like at a border crossing or a protest—I use "Lockdown Mode." You can enable this by going to Settings > Display > Lock screen > Show lockdown option. Once it’s on, you can hit the power button and tap "Lockdown." This instantly disables all biometrics and requires your PIN for the next unlock. It’s a powerful tool to have in your pocket.

When to use biometrics

So, should you use them? Personally, I use a fingerprint for everything. It's the best balance of speed and security. I'm more cautious with face unlock unless it's a Class 3 system like on the newer Pixels. My rule of thumb: use biometrics for the 100 times a day you check your notifications, but always have a strong 8-digit PIN as the foundation. And if you're on a budget phone with a 2D camera-only face unlock? Just stick to the fingerprint sensor on the back or the side. It's slightly less "cool," but it's significantly more private. No one wants their phone unlocked by a Facebook profile picture held up to the lens.