Your Face Is Not a Password — And You Can't Reset It

Somewhere right now, a piece of malware called GoldPickaxe is asking people to record a short video of their face. It looks like a routine identity check — the kind a bank app might request. The people doing it have no idea they're handing over something they can never get back.

That's the thing most of us get completely wrong about biometric login — the face unlock, the fingerprint tap, the "say your name to verify" voice prompt. We treat it like a clever password. Fast, personal, hard to guess. And if something goes wrong? We'll fix it. Change it. Reset it.

Except you can't reset your face. You can't issue yourself a new fingerprint on Monday morning. And the people designing attacks against you are counting on the fact that you haven't really thought about that.

What GoldPickaxe Actually Stole

Let's start with something real. Researchers at Zimperium, a mobile security firm, tracked a piece of malware — malicious software built specifically to steal — called GoldPickaxe. It spread across mobile banking users in at least five countries: Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia. Nineteen different versions of it were found in the wild.

Here's what made it different from a regular password-stealing attack. GoldPickaxe didn't just grab your login credentials. It went after your face. Specifically, it tricked victims into recording short face videos — the kind that banking apps sometimes ask for to confirm you're a real person. Then it handed those videos to attackers.

What did the attackers do with a face video? They used it to build deepfakes — AI-generated videos that look like you, talk like you, move like you. Well enough to fool the facial recognition systems that financial apps use as a security gate. Combined with stolen passwords and intercepted text messages, that face video gave criminals everything they needed to walk straight through the front door of someone's bank account.

Now here's the part that should make you pause. The victim could change their password. They could get a new phone number. They could even open a new bank account. But they could not get a new face. That video — that proof of who they are — is out there. Permanently. This article is part of a series — start with Age Verification Api How It Works.

Why Your Face Is Nothing Like a Password

To understand why this matters, it helps to understand what actually happens when you use face unlock on your phone.

When you first set up Face ID or a fingerprint login, your device doesn't store a photo of your face or an image of your fingerprint. That would be too easy to steal. Instead, it runs your face through an algorithm that maps dozens of specific points — the distance between your eyes, the curve of your jawline, the depth of your cheekbones — and converts all of that into a mathematical model. A string of numbers that represents you, but doesn't look like you.

That mathematical model gets locked inside a heavily protected chip on your phone — something called a Secure Enclave or Trusted Execution Environment (basically, a mini-vault inside your processor that even the phone's main software can't peek into). It never leaves your device. It never gets sent to Apple, Google, or your bank. When you press your face to unlock your phone, the camera re-maps your face, generates a fresh set of numbers, and checks whether they're close enough to the stored model. If yes: unlocked. The whole thing happens in under a second.

This is genuinely clever engineering. And for the threat it was designed to stop — someone stealing your phone and trying to unlock it — it works well.

But there's a problem that this design doesn't solve. What happens when the threat isn't someone stealing your phone — it's someone stealing the raw material your face is made of? A high-resolution video. A clear photo. A voice recording. These things exist in the world. You post them. You share them. You exist visibly. And once someone has that raw material, they can use machine learning to reconstruct your biometric signature — not necessarily on your phone, but on their system — and use it to fool other authentication checks.

As The Conversation put it plainly: if your biometric data is stolen, you cannot just change the locks.

The Mistake Almost Everyone Makes

Here's the part where I want to be genuinely fair to you, because this mistake is completely understandable.

Biometric login got marketed to us as the upgrade from passwords. More secure. Harder to fake. Uniquely yours. All of that is true, in the narrow sense it was meant to be true. No one can shoulder-surf your fingerprint the way they can watch you type a PIN. Previously in this series: Your Face Is Scanned Before You Grab A Basket And California.

But "more secure than a password" got quietly translated in our brains into "works the same way as a password, just better." And that's where the thinking goes wrong.

"Your fingerprints, your face and your voice are not secrets. Because your fingerprints, your face and your voice are not secrets, biometric authentication should rarely be used as a sole form of authentication." — Identity Management Institute

Read that again, because it's genuinely surprising. Your face is not a secret. You show it to strangers every single day. A password, by design, is something only you know. A fingerprint, by contrast, is something you leave on every glass you touch. The security of a password comes from secrecy. The security of biometrics was never supposed to come from secrecy — it was supposed to come from being physically difficult to fake. Those are two very different things.

The analogy that finally made this click for me: think about your Social Security number versus your ATM PIN. Your PIN is replaceable — forget it, reset it, choose a new one tonight. Your Social Security number is yours for life. If someone gets it, the risk doesn't end when you "change" it, because you can't. Treating your face scan like a PIN — something you can fix if it goes wrong — is the same category of mistake as treating your Social Security number like something you can reset. One is temporary. The other follows you.

As ELEKS explains in their security research: with a password breach, the response is straightforward — reset and reissue. With a biometric breach, there is no equivalent path. The people whose data was exposed cannot get new fingerprints.

The Spillover Problem Nobody Mentions

There's one more layer to this that makes the stakes higher than most people realize. You probably use your face or fingerprint to access more than one thing. Your phone. Your banking app. Maybe your work system. Perhaps a health app.

The same face — the same underlying biometric signature — is your key to all of them. That's convenient by design. But it means a single theft doesn't compromise one account. It potentially compromises every account that uses that biometric trait as a verification step, including future accounts you haven't opened yet.

With a password, you can use different passwords for different sites (yes, you should). With your face, you only have one. As Identity.org explains, a single biometric compromise can spread across services because the same face, fingerprint, or voice is used to verify identity in multiple places — meaning one theft can affect future logins, recovery flows, and access checks for years. Up next: That Enter Your Birthday Box Is Dead Heres What Actually Che.

So What Do You Actually Do With This?

Look, nobody's saying stop using Face ID. The on-device protections are genuinely good for the threat they were built to handle. The point isn't to make you anxious. It's to make you precise.

The shift is this: stop thinking of biometric login as a convenience feature you're casually opting into, and start thinking of it the way you think about your passport. You don't photograph your passport and post it online. You don't hand it to someone who approaches you on the street claiming to be from your bank. You don't fill out a random form asking you to scan it "just to verify your identity."

That same instinct — the one that makes you careful with a physical document that represents you — is exactly the instinct to activate when an app or a website asks for your face, your voice, or your fingerprint. One question worth asking every single time: does this data stay on my device, or is it going somewhere else? Most legitimate apps will tell you. If an app won't answer that question clearly, that's your answer.

At CaraComp, we work with facial comparison — analyzing images as evidence, side by side, in controlled contexts. The whole point is that who controls the data, and what happens to it afterward, changes everything about whether a biometric process is safe. The technology itself is not the risk. The question is always: where does it go, who keeps it, and what happens if they lose it?

Here's the question worth sitting with tonight: the next time an app asks you to verify with your face or fingerprint, do you actually know whether that data stays locked on your phone — or whether it gets sent to a server somewhere you've never heard of, stored by a company you've never vetted, in a database that could get breached next Tuesday?

If you don't know the answer, that's not a personal failing. It's exactly what the companies asking for your face are counting on.