When it comes to on-device authentication, facial recognition is one of the most secure ways to prevent unwanted access. Depending on the implementation, facial recognition may be more secure than fingerprint scanning. Unlike a passcode, pattern or password, a person’s face, which is biometric, cannot be guessed or forgotten. On top of that, it allows you to unlock your phone hands-free by looking at it and instantly accessing your device. Android phones and iPhones have facial recognition. On an iPhone it’s called Face ID, while on Android phones it’s called Face Unlock.
The biggest difference between Face ID and Face Unlock is that the former is hardware-based while the latter is software-based. This difference is important because it affects the security and reliability of these facial recognition systems. Face ID is miles ahead of Face Unlock, and it’s worth asking whether security features weigh heavily in your decision between an iPhone and an Android phone.
Face ID uses depth perception in facial recognition
Face ID came with the iPhone X, replacing Touch ID when Apple removed the Home button. When you set up Face ID, the TrueDepth camera projects tiny dots on your face to create a 3D map, while capturing an infrared image. It converts this information into a unique digital facial print consisting of a digital code before storing it securely on the phone. When unlocking your iPhone, the TrueDepth camera scans your face and compares it to the faceprint for a match. So Face ID does not compare the pixels of a flat image, but a 3D representation of your face. It also works with sunglasses, hats or in low light conditions.
Face ID is widely accepted for authenticating logins and purchases across the Apple ecosystem and several third-party apps. It is common knowledge that it cannot be fooled by a photograph since it is a 2D representation without depth data. It also can’t be fooled by a very detailed mask. Face ID is also attention-aware, meaning it can tell when you’re not looking at your phone. This way no one will be able to hold the phone in front of your face when you sleep to unlock it. Apple says Face ID has a false positive rate of 1 in 1,000,000, with the likelihood being higher for siblings who look like you and children under 13.
Face unlock is entirely algorithm-based (no hardware)
If you’re using a budget or mid-range Android phone with face unlock, it probably uses 2D-based facial recognition. The facial print stored by these phones does not include any 3D data. This means that the scanning verifies the flat image which is stored as the faceprint. It also doesn’t take an infrared image, which means it may struggle in low light conditions. Without depth perception like the iPhone’s TrueDepth camera, the selfie camera can also struggle with hats and sunglasses. Plus, he can’t tell if it’s a real person or a picture, making it easier to deceive.
Which?, the UK’s largest consumer protection organisation, has been testing facial recognition on Android phones since 2022. Of the 208 phones tested, 133 (64%) were fooled by a printed 2D photo. These phones were from popular manufacturers like Samsung, Motorola, Asus, OnePlus, and Nothing. Which? recommends using fingerprint scanning or a password rather than basic facial recognition on these phones.
The few Android phones that weren’t fooled were recent flagships like the Samsung Galaxy S26 and Google Pixels. Google Pixels deserve a mention because face unlock on the Pixel 8 and later is classified as biometric class 3 (the highest an Android can achieve). It can even open banking applications. It’s still software, but the Pixel’s face unlock uses very advanced machine learning (powered by its Tensor chips) to prevent identity theft.
