Consumer Group Warns Smartphone Facial Recognition Apps Are Vulnerable to Spoofing

By B.N. Frank

Over the years, it has been reported numerous times that artificial Intelligence (A.I.) technologies are highly susceptible to inaccuracies, biases, and various other risks (see 1, 2, 3, 4, 5, 6, 7, 8). Nevertheless, controversial A.I. applications – including facial recognition – continue to be created and unleashed on the public with often disastrous results.

From Biometric Update:

Native smartphone face biometrics can be spoofed; UK consumer groups freaks out

Chris Burt

Smartphone face biometrics from many leading brands are vulnerable to spoof attacks with 2D photographs, according to a new report from UK-based consumer testing and review group Which?, according to Yahoo Finance UK.

The group says the vulnerability is “unacceptable,” and has “worrying implications” for user’s security.

On-device biometrics are used for device unlocking and local authentication, while KYC processes for customer onboarding and strong remote identity verification is typically carried out with server-side biometrics and other signals, with a layer of liveness or presentation attack detection.

The phones tested include Honor, Motorola, Nokia, Oppo, Samsung, Vivo and Xiaomi handsets. Apple’s 3D FaceID biometrics were not fooled by the photos. The devices tested range in price from £89.99 to nearly £1,000 (approximately US$112 to $1,244), but the majority of phones that failed the test are lower-cost or mid-range models.

Out of 48 new smartphone models tested, 60 percent were not vulnerable to spoofing with a photograph.

Become Bulletproof Online Today With ZERO RISK!

Google says that Class 3 biometric unlock is required for contactless payments above £45 ($56), which means the vulnerable models should not support those payments through facial unlock.

“We would strongly advise anyone using these phones to turn off face recognition and use the fingerprint sensor, a strong password or long PIN instead,” says Which? Tech Editor Lisa Barber. “This needs to be a wake up call for manufacturers – they need to step up and improve the security of their biometric systems against spoofing.”

Data from roughly one-third of Americans is hacked each year, mostly due to insecure usernames and passwords and low digital literacy, according to career consultancy Zippia.

Chris Burt is managing editor and industry analyst at Biometric Update. He has also written nonfiction about information technology, dramatic arts, sports culture, and fantasy basketball, as well as fiction about a doomed astronaut. He lives in Toronto. You can follow him on Twitter @AFakeChrisBurt.