Hackers are bypassing fingerprint scanners to steal your identity

Fingerprint sensors have been around for quite some time, and they've become a standard feature in most smartphones. Apple introduced Touch ID on the iPhone 5s in 2013. Since then, it has appeared on 12 major iPhone models (and some iPads as well). 

"Can a website be hacked/compromised with password and fingerprint protection (multiple verification)?"

I get what you're saying, Frank. You'd think that since a fingerprint scanner literally requires your fingerprint, it couldn't be bypassed. But you'd be wrong. While fingerprint scanners are generally more secure than facial recognition and passwords, they're not foolproof. In fact, there are several ways bad actors can bypass them to steal your identity.

There are multiple ways hackers use to bypass fingerprint scanners. Below, I will discuss five of the more prominent methods. 

On average, the fake fingerprints worked about 80% of the time. They were able to fool the sensors at least once. Interestingly, they couldn't crack the biometric systems on Windows 10 devices, but they pointed out that doesn't necessarily mean those are more secure. It just means this particular method didn't work on them.

Attackers have found a cheap way to break into smartphones by brute force fingerprint authentication. The method, called BrutePrint, lets attackers get around the usual limits that stop too many failed fingerprint attempts. It works by taking advantage of two previously unknown flaws in the fingerprint system. These flaws, named Cancel-After-Match-Fail (CAMF) and Match-After-Lock (MAL), exist because of weak protection for fingerprint data on a part of the hardware called the Serial Peripheral Interface (SPI).

Basically, BrutePrint uses a hardware-based man-in-the-middle attack to hijack fingerprint data. It sits between the fingerprint sensor and the phone's secure area (called the Trusted Execution Environment) and tries as many fingerprint images as needed until it finds a match. The relieving part is that the attacker needs to have physical access to the phone for this method to work. 

PrintListener is a side-channel attack that captures the sound of a finger swiping on a screen to extract fingerprint features. It might sound like something out of a sci-fi movie, but researchers have already built a proof of concept. By analyzing the friction sounds, attackers can reconstruct fingerprint patterns, potentially enhancing the effectiveness of masterprint attacks.

Some devices store fingerprint data without adequate encryption. If attackers gain access to this unprotected data, they can replicate fingerprints to bypass authentication. For example, in 2024, a misconfigured server exposed nearly 500 GB of sensitive biometric data, including fingerprints, facial scans and personal details of law enforcement applicants.

Fingerprint scanners make it easy and fairly secure to unlock your devices. Since everyone has unique fingerprints, you don't need to remember complicated passwords. Just a quick touch and you are in. Most modern devices store your fingerprint data in secure parts of the system, and they use things like liveness detection to make sure someone is not trying to trick the scanner with a fake finger.

Still, no security method is perfect. Skilled attackers have found ways to get past fingerprint scanners using high-resolution photos or 3D-printed fingers or by taking advantage of flaws in how the scanner communicates with the rest of the device. The risk really depends on how well the scanner is designed and how much effort someone puts into breaking it. For most people, fingerprint authentication is quick, easy and secure enough. However, if you are dealing with very sensitive information, relying only on biometrics might not be the best idea.

Safeguard your biometric identity with these essential security measures.

5. Be careful about who handles your phone: If someone else uses your phone, especially a stranger or someone you don't know well, they might be able to copy your fingerprint from the screen. It's rare, but it happens. To reduce this risk, avoid handing your phone to people unnecessarily and wipe your screen occasionally to remove any clear fingerprints.

6. Only use fingerprint login with trusted apps: Not every app that asks for your fingerprint is trustworthy. It's safest to use fingerprint login only with apps from known and reliable companies, like your bank, phone manufacturer or email provider. If an unfamiliar app asks for fingerprint access, it's better to skip it and use your password instead.

Passwords are generally easier to hack than biometric data like fingerprints or facial recognition. However, the key difference is that passwords can be changed if they're compromised. Your biometrics cannot. Most modern devices allow both options, and biometrics can offer an extra layer of security by making it harder for someone else to access your phone or apps. They're also fast and convenient, since you don't need to remember or type anything. That said, in most cases, your device still falls back on a password or PIN when biometric identification doesn't work, so both systems often go hand in hand.

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved.