Android Phones Shown to Have a Major Biometric Security Weakness

Which? has recently uncovered a major security flaw that affects the facial recognition systems of almost two-thirds of modern smartphones. According to their report, out of the 208 phones tested since 2022, a shocking 64% were easily fooled by a simple 2D photo.

The list of affected brands is extensive, including popular names like Samsung, Motorola, and Oppo. Even flagship models such as the Oppo Find X9 Pro and the Samsung Galaxy S25 range were found to be vulnerable to this crude bypass method.

The year 2024 was particularly concerning, with 72% of the phones tested failing the 2D photo hack. However, there are some exceptions. Recent Google Pixel models and the Samsung Galaxy S26 series were among the few Android phones that passed the test. Apple’s iPhone range, known for its advanced 3D facial recognition technology, also emerged unscathed.

While some Android phones may display a warning message regarding the security limitations of their facial recognition systems, Which? highlighted concerns about manufacturers not being transparent enough about these vulnerabilities. Brands like Motorola, OnePlus, and Nothing were singled out for not providing clear warnings to users.

Although these insecure facial recognition systems cannot be used for mobile payments, they still grant access to personal data such as photos, messages, and emails. This could potentially expose users to risks like unauthorized access to sensitive information or account password resets.

The recommended solution for users with affected phones is to avoid setting up face-based access altogether and rely on more secure methods like PINs and fingerprint systems. Alternatively, some Android phones offer the option to lock sensitive apps behind these more secure entry mechanisms, ensuring that 2D facial recognition only grants access to the Home Screen.

In response to the findings, Samsung emphasized that their Galaxy phones clearly indicate the security levels of different lock types, with the fingerprint reader being the most secure option. They reiterated that facial recognition on Galaxy devices is only meant for device unlocking and cannot authenticate access to high-security features like Samsung Wallet.

In conclusion, users with phones vulnerable to the 2D photo hack should take additional measures to safeguard their important data, as facial recognition alone may not provide the level of security needed. It’s crucial to stay informed about the limitations of your device’s security features and take proactive steps to protect your privacy.