Mobile Phones: Device-Bound Biometrics

When you save your fingerprint or face scan to your device, it is encrypted and stored to your device. That biometric data is then only used to access sensitive information and authorize certain operations, like when you pay with your device wallet, access your password manager , or unlock your phone.

This biometric data does not leave your device, and your phone’s manufacturer, like Google or Apple, does not have access to it. The biometric data is stored in isolated hardware, usually called the “secure enclave,” which is designed to compartmentalize specific operations away from the rest of the device’s ecosystem. While there are a lot of different manufactures of Android phones, most take a similar approach to protecting digital ID data.

When it comes to concerns about malware potentially accessing this data, like the possibility of downloading a malicious app that could potentially access this biometric information, it would require the secure enclave itself to be compromised, a high bar to clear (though not impossible). Instead, malware typically tries to bypass your biometric lock.

What Device-Bound Biometrics Don’t Cover #

Your device's security can be threatened in other ways. For example, law enforcement (including border agents) can try to get an individual to “voluntarily” unlock a device. These problems have much more to do with power dynamics than the hardware itself, though.

You should still use only a PIN if you are more concerned with your risk level in certain situations, like those involving law enforcement.

Implications for Digital ID #

You may also run into scenarios where it seems like your device biometrics are needed to verify your identification or for age verification.

But when it comes to the process of obtaining a digital ID or when a third-party service demands that you scan your face or upload a selfie to verify yourself, that is different from the security protections provided by the device itself. Digital ID and age verification tactics vary by location and service. The process may seem the same in practice when a website or app asks to scan your face or photo, but the technology itself—and where that data is sent or stored—is fundamentally different. Third-party services do not access the same biometric data stored on your device that you use to unlock your device.