Biometric Password Risk: Why Users Can't Undo Identity Theft

Somewhere right now, a piece of malware called GoldPickaxe is asking people to record a short video of their face. It looks like a routine identity check, the kind a bank app might request. The people doing it have no idea they're handing over something they can never get back.

That's the thing most of us get completely wrong about biometric login, the face unlock, the fingerprint tap, the "say your name to verify" voice prompt. We treat it like a clever password. Fast, personal, hard to guess. And if something goes wrong? We'll fix it. Change it. Reset it.

Except you can't reset your face. You can't issue yourself a new fingerprint on Monday morning. And the people designing attacks against you are counting on the fact that you haven't really thought about that.

---

What GoldPickaxe Steals: Stolen Biometric Data

Let's start with something real. Researchers at Zimperium, a mobile security firm, tracked a piece of malware, malicious software built specifically to steal, called GoldPickaxe. It spread across mobile banking users in at least five countries: Indonesia, Malaysia, the United States, Singapore, and Saudi Arabia. Nineteen different versions of it were found in the wild.

Here's what made it different from a regular password-stealing attack. GoldPickaxe didn't just grab your login credentials. It went after your face. Specifically, it tricked victims into recording short face videos, the kind that banking apps sometimes ask for to confirm you're a real person. Then it handed those videos to attackers.

What did the attackers do with a face video? They used it to build deepfakes, AI-generated videos that look like you, talk like you, move like you. Well enough to fool the facial recognition systems that financial apps use as a security gate. Combined with stolen passwords and intercepted text messages, that face video gave criminals everything they needed to walk straight through the front door of someone's bank account.

Now here's the part that should make you pause. The victim could change their password. They could get a new phone number. They could even open a new bank account. But they could not get a new face. That video, that proof of who they are, is out there. Permanently. This article is part of a series, start with Age Verification Api How It Works.

---

Biometric Data Definition: Why It's Not Like a Password

To understand why this matters, it helps to understand what actually happens when you use face unlock on your phone.

When you first set up Face ID or a fingerprint login, your device doesn't store a photo of your face or an image of your fingerprint. That would be too easy to steal. Instead, it runs your face through an algorithm that maps dozens of specific points, the distance between your eyes, the curve of your jawline, the depth of your cheekbones, and converts all of that into a mathematical model. A string of numbers that represents you, but doesn't look like you.

That mathematical model gets locked inside a heavily protected chip on your phone, something called a Secure Enclave or Trusted Execution Environment (basically, a mini-vault inside your processor that even the phone's main software can't peek into). It never leaves your device. It never gets sent to Apple, Google, or your bank. When you press your face to unlock your phone, the camera re-maps your face, generates a fresh set of numbers, and checks whether they're close enough to the stored model. If yes: unlocked. The whole thing happens in under a second.

This is genuinely clever engineering. And for the threat it was designed to stop, someone stealing your phone and trying to unlock it, it works well.

But there's a problem that this design doesn't solve. What happens when the threat isn't someone stealing your phone, it's someone stealing the raw material your face is made of? A high-resolution video. A clear photo. A voice recording. These things exist in the world. You post them. You share them. You exist visibly. And once someone has that raw material, they can use machine learning to reconstruct your biometric signature, not necessarily on your phone, but on their system, and use it to fool other authentication checks.

As The Conversation put it plainly: if your biometric data is stolen, you cannot just change the locks.

---

The Mistake Almost Everyone Makes

Here's the part where I want to be genuinely fair to you, because this mistake is completely understandable.

Biometric login got marketed to us as the upgrade from passwords. More secure. Harder to fake. Uniquely yours. All of that is true, in the narrow sense it was meant to be true. No one can shoulder-surf your fingerprint the way they can watch you type a PIN. Previously in this series: Your Face Is Scanned Before You Grab A Basket And California.

But "more secure than a password" got quietly translated in our brains into "works the same way as a password, just better." And that's where the thinking goes wrong.

"Your fingerprints, your face and your voice are not secrets. Because your fingerprints, your face and your voice are not secrets, biometric authentication should rarely be used as a sole form of authentication." Identity Management Institute

Read that again, because it's genuinely surprising. Your face is not a secret. You show it to strangers every single day. A password, by design, is something only you know. A fingerprint, by contrast, is something you leave on every glass you touch. The security of a password comes from secrecy. The security of biometrics was never supposed to come from secrecy, it was supposed to come from being physically difficult to fake. Those are two very different things.

The analogy that finally made this click for me: think about your Social Security number versus your ATM PIN. Your PIN is replaceable, forget it, reset it, choose a new one tonight. Your Social Security number is yours for life. If someone gets it, the risk doesn't end when you "change" it, because you can't. Treating your face scan like a PIN, something you can fix if it goes wrong, is the same category of mistake as treating your Social Security number like something you can reset. One is temporary. The other follows you.

As ELEKS explains in their security research: with a password breach, the response is straightforward, reset and reissue. With a biometric breach, there is no equivalent path. The people whose data was exposed cannot get new fingerprints.

---

The Spillover Problem Nobody Mentions

There's one more layer to this that makes the stakes higher than most people realize. You probably use your face or fingerprint to access more than one thing. Your phone. Your banking app. Maybe your work system. Perhaps a health app.

The same face, the same underlying biometric signature, is your key to all of them. That's convenient by design. But it means a single theft doesn't compromise one account. It potentially compromises every account that uses that biometric trait as a verification step, including future accounts you haven't opened yet.

With a password, you can use different passwords for different sites (yes, you should). With your face, you only have one. As Identity.org explains, a single biometric compromise can spread across services because the same face, fingerprint, or voice is used to verify identity in multiple places, meaning one theft can affect future logins, recovery flows, and access checks for years. Up next: That Enter Your Birthday Box Is Dead Heres What Actually Che.

How to Protect Biometric Data: Essential Steps

Look, nobody's saying stop using Face ID. The on-device protections are genuinely good for the threat they were built to handle. The point isn't to make you anxious. It's to make you precise.

The shift is this: stop thinking of biometric login as a convenience feature you're casually opting into, and start thinking of it the way you think about your passport. You don't photograph your passport and post it online. You don't hand it to someone who approaches you on the street claiming to be from your bank. You don't fill out a random form asking you to scan it "just to verify your identity."

That same instinct, the one that makes you careful with a physical document that represents youis exactly the instinct to activate when an app or a website asks for your face, your voice, or your fingerprint. One question worth asking every single time: does this data stay on my device, or is it going somewhere else? Most legitimate apps will tell you. If an app won't answer that question clearly, that's your answer.

At CaraComp, we work with facial comparison, analyzing images as evidence, side by side, in controlled contexts. The whole point is that who controls the data, and what happens to it afterward, changes everything about whether a biometric process is safe. The technology itself is not the risk. The question is always: where does it go, who keeps it, and what happens if they lose it?

Here's the question worth sitting with tonight: the next time an app asks you to verify with your face or fingerprint, do you actually know whether that data stays locked on your phone, or whether it gets sent to a server somewhere you've never heard of, stored by a company you've never vetted, in a database that could get breached next Tuesday?

If you don't know the answer, that's not a personal failing. It's exactly what the companies asking for your face are counting on.

Biometric Identity Theft vs. Ordinary Identity Theft

Ordinary identity theft usually starts with a stolen number, a credit card, a Social Security number, a login. Biometric identity theft starts with a stolen trait: your face, your fingerprint, your voice. The practical difference is recovery. Ordinary identity theft has a repair path, even if it's slow and annoying. Biometric identity theft does not, because the stolen material is the same face you will still be wearing tomorrow.

Biometric Identity: What Gets Exposed in a Breach

When people hear "biometric data breach," they often picture a stolen photo. What actually gets exposed is broader: the raw image or video, the mathematical template derived from it, and sometimes metadata showing where and when it was captured. Each piece has separate value to an attacker. Biometric identity, in other words, is not one data point, it is a small cluster of related evidence that criminals can recombine.

Identity Fraud Built on Biometric Data

Identity fraud that relies on biometric data tends to be harder to detect at the point of use, because the verification check that's supposed to stop fraud is the same check the criminal has learned to fool. A deepfake built from a stolen face video does not look suspicious to a camera, it looks like a face. That is what makes identity fraud powered by biometrics different from identity fraud built on a stolen password: the fake evidence passes the exact test it was designed to defeat.

Biometric Authentication: Where It Still Helps

None of this means biometric authentication is worthless. Used as one layer among several, alongside a password and a one-time code, for example, biometric authentication raises the cost of an attack even if it can't guarantee it's unbeatable. The mistake is relying on biometric authentication alone, as if a face scan were a complete answer instead of one piece of a layered defense.

Biometric Security Habits That Actually Reduce Risk

Good biometric security starts with the same instinct you'd apply to a passport: minimize where your face, fingerprint, or voice gets shared, and ask what happens to the copy after the check is done. Turn off biometric login for apps that don't need it. Favor services that confirm the biometric data never leaves your device. These habits won't stop every attack, but they shrink the number of places your data can be stolen from in the first place.

Biometric identity theft is also harder to price than ordinary identity theft, because the damage doesn't stop at one stolen account. A single leaked face template can be reused years later, against a service that didn't exist when the theft happened. That's part of why privacy advocates keep pushing companies to explain, in plain language, how long they keep biometric data and why.

Fraud built from stolen biometric data also travels faster than fraud built from a stolen password, because a convincing deepfake can be reused across multiple targets with small edits. A criminal who has one good face video doesn't need to steal a new one for every attempt at fraud, that single asset can be recycled repeatedly until someone notices.

Recognition systems, the cameras and software that compare your live face to a stored template, are only as trustworthy as the data feeding them. If the input has already been manipulated by a deepfake, the recognition system will confirm a match that shouldn't exist. That's why security researchers keep stressing liveness checks: technical tests, like asking you to blink or turn your head, designed to prove a real person is in front of the camera rather than a recording.

Privacy matters here in a very specific way: the less biometric data a company collects and stores, the less there is for an attacker to steal in the first place. Before you hand over a face scan or fingerprint for a discount, a login, or a "faster checkout," it's worth asking whether that convenience is worth adding one more place where your identity theft risk can start.

None of this is a reason to panic every time a phone asks for your face. It's a reason to treat that request the way you'd treat someone asking to photocopy your passport, with a quick, reasonable question about why they need it and what they'll do with the copy afterward.

It helps to name the specific biometric threats people actually face, instead of treating "biometric risk" as one vague blob. There is theft of the raw image or video. There is theft of the stored mathematical template. There is deepfake creation from stolen footage. And there is simple misuse by a company that collected biometric data for one purpose and quietly repurposes it for another. Each of these biometric threats calls for a slightly different defense, which is exactly why a single password-style fix can't cover all of them.

Biometric identifiers are the specific measurable traits a system uses to confirm who you are: your fingerprint ridges, the geometry of your face, the pattern of your iris, even the rhythm of your voice. These biometric identifiers are useful precisely because they are hard to fake casually. But that same permanence is what makes them dangerous once they leak, since you cannot issue yourself a new set of biometric identifiers the way you can issue yourself a new card number.

Biometric templates deserve a plain definition, since the word gets thrown around loosely. A biometric template is the mathematical summary a system creates from your face, fingerprint, or voice, not a photo, but a set of measurements converted into numbers. Well-designed systems store only the biometric template, not the original image, and treat that template with the same protection they'd give a password database, sometimes stronger.

Selfie-based biometric authentication is highly effective at confirming that a real, live person is present during a login, which is exactly why banks lean on it so heavily. That effectiveness is also what attackers are trying to defeat when they build deepfakes from stolen selfie videos. The strength of selfie checks and the risk of selfie theft come from the same source: a selfie is a very rich, very personal piece of biometric threat data once it leaves your control.

It's worth being precise about the word "theft" here, because biometric theft doesn't always look like a dramatic hack. Sometimes biometric theft is a data broker quietly scraping public photos. Sometimes it's an app with weak storage practices getting breached. Sometimes it's malware, like GoldPickaxe, asking you directly for a video and you handing it over because the request looked routine. Each path counts as biometric theft, and each one deserves the same seriousness.

A useful mental model: identity criminals use your personal information the way a locksmith uses a blank key, they need a real, working pattern to copy before the copy works anywhere. A stolen password gives them one lock. A stolen biometric template gives them a master pattern that can be reshaped, through deepfake tools, to open several locks that all check the same face or voice. That's why identity criminals use your personal information most efficiently when that information is biometric rather than a simple number.

Biometric verification exists to answer one narrow question: is the person presenting this face, fingerprint, or voice actually the person they claim to be, right now, in this moment? Good biometric verification pairs a stored template with a liveness check, so a photo or recording of you isn't enough on its own to pass. Weak biometric verification skips that liveness step, which is exactly the gap that deepfake-based fraud is built to exploit.

None of this changes the basic advice: fewer places holding your biometric data, clearer answers from any app that asks for it, and a habit of treating your face and fingerprint the way you'd treat a passport rather than a password. The technology isn't the enemy. Carelessness about where the data goes is.

Biometric Password Thinking: Where the Term Comes From

People increasingly call face unlock and fingerprint login a "biometric password," even though that phrase is a little misleading. A biometric password is not a secret string you type, it is a physical trait a system reads and matches against a stored template. Calling it a password at all is what causes the confusion this article keeps circling back to: passwords are secrets you choose and can change, while a biometric password is a measurement of your body that you cannot change.

Still, the label sticks because a biometric password does the same job a password does: it proves who you are so a system unlocks. That shared job is exactly why so many people assume a biometric password can be reset the same way a password can. It cannot. Once the local biometric template behind a biometric password is copied or reconstructed by an attacker, there is no reset button, no new fingerprint, no new face, which is the entire reason this article treats "biometric password" as a term worth handling with care rather than as a casual synonym for security.

Multi-factor biometric setups try to soften this risk by pairing a biometric password with something else you know or have, such as a passcode or a physical device. Biometric passwords used inside a multi-factor biometric arrangement are safer than biometric passwords used alone, because a stolen face or fingerprint no longer opens the account by itself. This is the same layered thinking security teams apply to authentication biometric checks in banking apps: no single factor, biometric or otherwise, should be trusted to carry the full weight of access on its own.

Local biometric storage, keeping the template on your own device rather than sending it to a company's server, is the strongest protection currently available for a biometric password. When biometric authentication happens locally, the raw scan never travels anywhere an attacker could intercept it in transit. That is why security guidance keeps repeating the same instruction: prefer biometric systems and biometric technology that process your biometric credential on-device, and be wary of any biometric unlock feature that quietly uploads your face or fingerprint to a remote server you cannot see or audit.

A biometric scanner is simply the hardware doing the reading, the camera mapping your face, the sensor reading your fingerprint ridges, the microphone capturing your voice. The scanner itself rarely stores anything permanently; it feeds raw data to software that builds and checks the template. Understanding that distinction helps explain why access to the scanner is not the same as access to your identity, but access to the stored template is, which is the real target behind most biometric password attacks.

Access to a biometric password should always be treated as access to something permanent, not something disposable. Every time you grant an app access to face unlock or fingerprint login, you are granting access to a credential you cannot reissue. That single fact, more than any single security feature, is why the phrase "biometric password" deserves the same caution people already apply to their Social Security number, and why access to it should be limited, questioned, and reviewed far more often than access to an ordinary password ever needs to be.

A user weighing whether to enable face unlock is really weighing a tradeoff between convenience and permanence, and most users never get to see that tradeoff spelled out plainly. Every user who taps "allow" on a biometric prompt is trusting that the app on the other end built secure authentication into its design from day one, not bolted on after a breach. A cautious user checks the settings menu for authentication methods before agreeing to anything, because some apps quietly default to sending biometric data off-device unless a user changes that choice.

Android phones and iPhones both offer biometrics passkeys as an alternative to typed passwords, and for most users this is a genuine improvement, since a passkey tied to on-device biometric authentication cannot be phished the way a typed password can. Still, a user should understand that biometrics passkeys inherit the same permanence problem as any other biometric authentication method: the passkey can be revoked, but the underlying face or fingerprint that unlocks it cannot. Any android user setting up a new phone will usually be prompted to enable biometric authentication during setup, and it is worth reading that prompt rather than tapping through it.

Security researchers keep repeating one blunt fact for a reason: biometric data is permanent in a way that no other login credential is. A user can rotate a password, a PIN, or a security question, but a user cannot rotate a face. This is precisely why biometric authentication provides real convenience for everyday identity checks while also carrying a risk that a typed password never carried, since a leaked password can be discarded and a leaked face cannot.

Part of what makes biometric authentication attractive to banks and app developers is that a face scan or fingerprint provides physical evidence that a real person, not a script or a stolen credential list, is present at the moment of login. A password only proves someone knows a string of characters; a live face scan provides physical evidence tied to a specific body in a specific moment. That is a meaningfully different kind of proof, and it is why so many identity checks now lean on it.

The strongest argument for biometric login is not that it is unbreakable but that, layered correctly, it can reduce credential exposure across a user's accounts. A user who relies on biometric authentication instead of typing the same password into five different apps has fewer opportunities for that password to be intercepted, guessed, or leaked in a breach. Reducing credential exposure this way does not eliminate risk, but it does shrink the number of doors a typical password attack can walk through.

There is also a plain usability story here that is easy to overlook in a security discussion. Biometrics improve usability for the millions of users who struggle to remember complex passwords, type accurately on small screens, or manage a growing list of logins across devices. A user with a face scan enabled unlocks a banking app in under a second instead of typing a long password character by character. That convenience is real, and it is part of why biometric authentication and biometrics passkeys have spread so quickly across security-conscious apps despite the permanence tradeoff described throughout this article.