A fingerprint is often described as a password that cannot be forgotten. US federal guidance reads it the other way. NIST's Digital Identity Guidelines on authentication (SP 800-63B-4, July 2025) state that biometric characteristics "do not constitute secrets": a face can be photographed, and a fingerprint lifted from a surface someone touched. Matching is also "probabilistic", where a password either matches or does not. So NIST accepts a biometric only beside something the customer holds, such as a phone. A bank meets the same face twice: during customer onboarding, when identity is proved, and at every login after it.
What is biometric authentication, and where does biometric verification fit?
Biometric authentication checks that the person at the sensor is the customer who enrolled earlier, at login or when a payment is approved. NIST defines biometrics as "the automated recognition of individuals based on their biological and behavioral characteristics". Each login compares one fresh sample with one customer's own template, a one to one match. Searching a database for who someone is would be identification.
Verification comes earlier. In eKYC, a selfie is matched to the photo on an ID document at onboarding. complead, formerly Sanction Scanner, keeps that step with the firm's IDV provider: in its customer risk assessment and KYC product, document and biometric identity verification "operates separately", and the risk model receives the verified identity as an input rather than producing it.
Picture one customer (illustrative): verified once by document and selfie when the account opens, then authenticated by face or fingerprint at every login and payment approval.
How does biometric authentication work?
At enrollment, a sensor captures the trait and the system stores a template derived from it. At each login, a fresh sample is scored against that template. The match counts only if the score clears a set threshold. NIST says the comparison "SHOULD be performed locally" on the customer's device, since attacks at a larger scale are more likely at a central verifier. When a face or fingerprint unlocks a key held on the phone, NIST treats the phone itself as the physical authenticator.
What are the main biometric authentication methods?
Table 1. Biometric authentication methods: what each reads and where a bank meets it
| Method | What it reads | Where a bank uses it | Who usually runs the match | How it is attacked |
|---|---|---|---|---|
| Fingerprint | Ridge pattern of a finger | Login, payment approval | The phone (local match) | Prints lifted from touched surfaces |
| Face | Facial features | Onboarding, login, payment approval | The IDV provider at onboarding; the phone at login | Photos, masks, injected or deepfake video |
| Iris | Pattern of the iris | Login | The device (local match) | High resolution photographs |
| Voice | Voice patterns | Phone banking login | Depends on the setup | Recorded or synthetic audio |
| Vein | Vein pattern of a finger or palm | Login | Depends on the setup | Presentation or injection |
| Keystroke and touch dynamics | Typing rhythm, swipes, pointer movement | Throughout the session | The fraud engine | Automation tools |
| Device handling | Angle the phone is held, screen pressure | Throughout the session | The fraud engine | Emulators and tampered runtimes |
Keystroke dynamics and the way a phone is held count as biometrics too. NIST's definition names keystroke patterns, the angle of holding a smartphone, screen pressure and mouse movements, and the EBA's list of inherence elements adds the way a customer types and swipes, and even heart rate.
That splits the methods into two families. Physical traits are checked at a moment: the customer presents a finger or a face and gets a match or a failure. Behavioral traits can be read across a whole session, with no step the customer notices, and give a score that keeps moving while the session runs.
Which biometric methods do EU, US and Indian rules accept?
Table 2. Which rules accept which method (as of November 2026)
| Method | EU SCA inherence (EBA, 2019) | NIST SP 800-63B-4 (US federal) | India, RBI directions | Biometric data under the GDPR |
|---|---|---|---|---|
| Fingerprint | Yes | Allowed; PAD recommended | Named | Yes |
| Face | Yes | Allowed; PAD required | As any other biometric | Yes |
| Iris | Yes | Allowed; PAD recommended | As any other biometric | Yes |
| Voice | Yes | Not allowed | As any other biometric | Yes |
| Vein | Yes | Allowed; no method rule | As any other biometric | Yes |
| Keystroke dynamics and phone angle | Yes | In the definition; no method rule | Not named | Yes, where it identifies the person |
| Memorized swiping path | No: knowledge | Not covered | Not named | No |
| EMV 3-D Secure data | No, as seen in 2019 | Not covered | Not named | No |
The EBA calls its list illustrative, with compliance "dependent on the specific approach used in the implementation of the elements". The GDPR column assumes the data is processed to identify a person.
In the EU, strong customer authentication under PSD2 rests on two or more independent elements from three categories: knowledge, possession and inherence. The regulatory technical standards require inherence readers and software to have a "very low probability" of authenticating someone other than the payer (Article 8(1)).
The EBA's June 2019 opinion makes the implementation decisive and gives its own example: a swiping path the customer memorized may count as knowledge, while the manner of typing or swiping may be inherence. The Council's position on the Payment Services Regulation, adopted on 29 October 2026, keeps these categories. It would let a provider use two inherence elements if it shows the national authority that they stay independent and that security stays high at all times. It is not law yet.
In the US, NIST's guidelines are written for federal systems, as the publication record states. For a private bank they are a strict benchmark: biometrics only in multi factor authentication with a physical authenticator, and a non biometric option always on offer.
Voice is where the two rulebooks part. The EBA's table marks voice recognition as a possible inherence element, while NIST says biometric comparison based on voice "SHALL NOT be used", so a bank that follows NIST for its login design leaves voice out.
India's authentication directions for digital payments, effective from 1 April 2026 for domestic digital payments, accept "something the user is", naming fingerprint and "any other form of biometrics (device native or Aadhaar based)".
Under the GDPR, data from the technical processing of physical, physiological or behavioral traits that allows or confirms a person's unique identification is biometric data. Article 9(1) bars processing it to identify someone unless an Article 9(2) exception, such as explicit consent, applies.
Where do biometric methods fail?
Six weak points, and why each matters:
- Errors at one fixed threshold. NIST requires a fixed threshold, so the setting that keeps impostors out also turns away some legitimate customers, and it cannot be tuned per demographic group.
- Presentation attacks. A photo, mask or lifted print is shown to the sensor. NIST makes presentation attack detection (PAD) mandatory for face and recommended for fingerprint and iris, and counts liveness detection as one kind of PAD.
- Injection attacks. Fake media is fed in behind the camera. FinCEN's November 2024 alert on deepfake media describes webcam plugins that can display "previously generated video rather than live video".
- Unequal error rates. In NIST's 2019 face recognition tests, false positive rates across demographic groups often varied "by factors of 10 to beyond 100 times". The 2025 guidelines set the false match rate for every demographic group.
- A trait cannot be reissued. A leaked password can be changed; a face cannot. Template protection that can revoke a biometric exists, but NIST notes that "the availability of such solutions is limited."
- The fallback. NIST requires a non biometric option, and account recovery runs through saved or issued codes, recovery contacts or repeated identity proofing. A route weaker than the biometric opens the way to account takeover. The Council's PSR position would also bar making strong customer authentication depend on owning a smartphone, unless the customer agreed to app only service.
What are false match and false non match rates?
The false match rate (FMR) is the probability that an impostor's comparison counts as a match; the false non match rate (FNMR), that a genuine customer's does not. NIST sets the FMR at one in 10,000 or better for every demographic group and recommends an FNMR below 5 percent.
How many tries does an impostor get?
NIST sets the attempt budget. After five failed attempts in a row, or 10 with PAD, each further attempt waits at least 30 seconds, up to 50 consecutive failures in all, or 100 with PAD. Combine that budget with the false match rate and, assuming each try is independent, a stranger's odds at one in 10,000 come to about 1 in 2,000 over five tries, about 1 in 1,000 over 10, and about 1 in 100 over the full 100 that PAD allows.
Under the 2017 edition, with an FMR of 1 in 1,000 and the same five and 10 try limits, 10 tries gave about 1 in 100. The tenfold stricter rate alone moved those odds to about 1 in 1,000.
These odds cover a zero effort impostor only. NIST warns that the FMR "does not account for active impersonation attacks", which is what PAD is for. Real customers fail too: at the 5 percent ceiling, one legitimate attempt in 20 fails to a retry or the fallback, so the fallback carries real traffic and needs to be no weaker than the biometric.
How do behavioral biometrics work for fraud teams?
Picture a neobank customer (illustrative) who opens the app with the right face, then types a new payee's account number far more slowly than usual, pauses between fields and holds the phone flat instead of in the hand. The pattern fits a customer being talked through a payment on a call. The face check passed; the session is stepped up before the money leaves.
In EU terms, typing rhythm and phone handling can count as inherence: the EBA's opinion includes behavioral processes created by the body, and the Council's PSR text keeps that wording. Its Article 87 would let the payer's provider use the payer's typical behavioral characteristics in transaction monitoring, and Article 88 keeps them out of the fraud data providers share.
complead's device and behavior analysis follows a session from the screens before login up to payment approval. It reads typing cadence, pointer and touch dynamics, hesitation and device handling. The actual keystrokes are not recorded, and no fingerprints, face data or voice data are gathered. In complead's fraud prevention, behavioral biometrics sit beside device fingerprinting and network signals as first party signals, and every outcome, whether approve, decline, review or step up, comes with a reason.
Which biometric deadlines and drafts landed in 2026?
- 1 April. India's RBI authentication directions took effect, with biometrics among the accepted factors.
- 6 October. NIST announced an implementation resource hub for its July 2025 digital identity guidelines.
- 29 October. The Council adopted its PSR position, published on 5 November. The European Parliament's procedure file gives 14 December as the indicative plenary date for the second reading, and the regulation would apply 21 months after it enters into force.
- By the end of 2026. Each Member State must offer at least one European Digital Identity Wallet under eIDAS, an electronic identity that banks required to use strong user authentication must accept, at the customer's request, by the end of 2027.
A face that matches at login proves only that the same person is back. Who that person really is was settled once, at onboarding, by an identity document and the checks run on it. If the document was forged, every later match confirms the wrong person.
