Face Recognition iPhone: Masks, Twins and How to Reset Face ID

Here is the number everyone repeats about face recognition iPhone security: one in a million. That is Apple's stated chance that a random stranger's face opens somebody else's phone. It sounds airtight. Then comes the footnote nobody reads at 11pm: an identical twin is not a random stranger.

Face Recognition iPhone Basics: What "One in a Million" Really Means

When Apple introduced Face ID with the iPhone X, the company made a bold promise: your face is the key. Let's explore what that key really is. It is not a photo of you. It is a pile of numbers, and the whole story of twins hangs on that fact.

How the TrueDepth Camera Makes a Face Map

The TrueDepth camera at the top of the screen does something a normal selfie camera can't. It shines a grid of invisible dots onto a face and reads how they land. The dots stretch over a nose and bunch up in the eye sockets. The result is a 3D shape map, not a flat picture.

The phone turns depth information and an infrared image into a mathematical representation and protects it in the Secure Enclave (a sealed-off corner of the phone's chip, built to keep secrets like this). Each later unlock attempt captures fresh information. Then the phone asks one question: how close is this new representation to the saved one?

"Close" is a dial, not a yes or no. The score that counts as a pass is called the threshold. Set it too strict and the phone rejects its real owner after a haircut or a bad night's sleep. Set it too loose and strangers slip in. As PanicVault explains, every face unlock system lives on this trade-off. Apple turned the dial so a random stranger gets in about one time in a million, based on the statement reported by the Citizen.

A quick honesty note. That 88.9% figure comes from an academic study of face matching in general, found in Double Trouble. It is not a test of Face ID. But it shows the pattern: matching systems that are nearly perfect on strangers can do noticeably worse on look-alikes.

---

Why a Photo, a Video or a Mask Can Fail: The Design Behind Face Recognition iPhone Security

Start with the question people actually type. Can a photo do it? In hands-on tests reported by Bustle, Face ID turned down a photo held up to a face. It even turned down a silicone mask made from the owner's own face. This article is part of a series, start with Uk Shop Face Recognition Innocent Shoppers Named As Thieves.

The reason is the design. A printed photo is flat. So is a video. A video of the owner, played on a second phone, can look perfect to human eyes. But a video is just light on a sheet of glass. The depth camera isn't judging only how real a picture looks. It is also judging shape.

The same logic applies to a deepfake video (a video that AI has altered or invented so someone's face seems to do things it never did). Deepfakes can fool people on video calls. A deepfake video is still a flat screen, so it has no nose to bulge and no eye sockets to dip for the depth camera. That reasoning follows from the way the camera works, even though the tests we cite here covered photos and masks.

Does the iPad Get the Same Face Recognition iPhone Owners Use?

Some iPad Pro models carry the same kind of face unlock, built on the same idea: map the shape, compare, and apply a threshold. So the twin caveat in this article applies there as well. Not every tablet has it, so check the specific model.

Mac and Apple Watch: Where Face Scans Do Not Apply

A Mac does not unlock by scanning a face. It leans on a password, a fingerprint reader, or a paired device nearby. An Apple Watch uses a passcode and its link to the phone. An older Apple iPhone with a Home button uses a fingerprint sensor instead of a face scan. So the twin worry belongs mostly to the phone and the tablet. Still, a phone that opens for the wrong face can lead to everything else tied to it.

What is held up to the phone	What the research and tests suggest
Printed photo of the owner	Rejected in testing; a photo has no facial depth for the TrueDepth camera to read
Video of the owner on a screen	Flat glass, so no 3D shape to match; no support from the depth check
Silicone mask of the owner's face	Rejected in testing; that does not prove every mask will fail
Identical twin's real face	Documented cases of unlocking; the faces are similar enough to match

---

Can an Identical Twin Unlock an iPhone?

Sometimes, yes. Early tests found identical twins unlocking each other's iPhone X, as logged by the AI Incident Database. Apple said it was possible for twins or look-alike siblings to do this. The phone isn't broken. Two similar faces can make representations close enough to match.

Picture a bouncer who knows a guest by face. He turns away almost every stranger, but occasionally lets one in by mistake. Then the guest's identical twin walks up. The bouncer isn't sloppy, but the resemblance might give him a reason to let the twin in. That is the core of face recognition iPhone security: it checks whether a face matches, not whether it belongs to the right person.

Twins, Kids and the Tech Limit: Where Recognition Runs Out of Clues

Twins aren't the only weak spot. Apple says the chance of a wrong match is higher in children under 13, because their distinct facial features may not have fully developed. The mechanism is similar: when faces are too alike, the representations can land too close together.

Researchers work on this problem. One study on facial marks (freckles, moles, scars and other tiny skin details) reached 96.6% accuracy at telling twins apart, as described in NIH/PMC. Notice what that means. Tiny surface details can offer clues that separate twins beyond their overall face shape. The study was not a test of Face ID.

Other body ID tech has the same trouble. One study on fingerprints, in the Journal of Image and Video Processing, found twins got falsely accepted about four times as often as people who aren't twins. Previously in this series: Uk Shop Face Recognition Innocent Shoppers Named As Thieves.

---

Is Face Recognition iPhone Security Unhackable? The Myth of "Photo-Proof Means Twin-Proof"

Here is the belief: "If it rejects my photo and a mask of my face, nothing can fool it." It makes sense. Demos show fakes failing. Reasonable people stretch that into "fakes fail, so everything fails."

But those are two separate defenses. Anti-spoofing (checks designed to catch fake faces such as photos, video and masks) guards against forgeries. A twin isn't a forgery. A twin is a real, living face that can be similar enough to match. In the documented cases, the twin's face passed the checks and landed inside the threshold. Rejecting a flat image does not prove the phone can always tell similar real faces apart.

Matching a face to the wrong person can go wrong in other settings too. According to a lawsuit, as described in coverage of the case, a teenager named Ousmane Bah was arrested in 2019 over thefts from stores after a security system allegedly tied a thief's face to Bah's name. The thief had reportedly used Bah's lost permit, which carried no photo. Later, an NYPD detective who viewed surveillance video said the suspect:

looked nothing like

NYPD detective, describing the suspect compared with Ousmane Bah, as reported in coverage of the lawsuit

Charges were dropped in several states. Different setup, related lesson: associating a face with a name depends on the information behind that association. CaraComp's work covers how facial recognition systems turn faces into numbers and where those numbers mislead. Knowing the limits is what makes the tool useful rather than scary.

A Pro Move Before Bed: Set the Phone Up to Be Hard to Open

Now the practical part, because a phone opened while its owner sleeps is a risk worth considering. Open the Face ID settings on a phone and look for the attention option (it asks the phone to confirm the eyes are open and looking at the screen). It is normally on by default, but checking takes ten seconds. With attention required, a sleeping person's closed eyes should prevent their own face from unlocking the phone. It does not prevent an awake look-alike from trying their own face.

Accessories play a part too. Glasses are usually fine, but a sleep mask or sunglasses can hide the eyes the check depends on. If an identical twin or a look-alike sibling lives nearby, consider switching face unlock off and using a long passcode instead. Boring, yes. Also effective.

If a phone ever does open for the wrong person, turn off Face ID and secure any affected accounts. You can also reset Face ID in Settings and enroll only the right face again. Change the passcode if it may have been seen or compromised. If the device is missing, sign in to your own account to lock or locate it and contact the carrier. If money or private messages were touched, contact the affected provider and consider reporting it to the police.

So here is the twist to repeat at breakfast. The face that opens a phone might not be a clever fake. It can be a real face that is honestly, innocently similar. If this were happening tonight, would you know where to look first? Now you do: the eyes-open setting for your sleeping face, and the passcode if a look-alike might try their own.

face recognition iphone: Frequently Asked Questions