Marcus thought he was being smart. He stopped using passwords in 2021 after his email got compromised, switched everything to fingerprint and face authentication, and felt genuinely safer. He was wrong — and so are the 1.4 billion people worldwide currently trusting their bodies as their password.
Your fingerprint is not a password. It is evidence. And unlike a password, you cannot change it when it leaks.
That distinction changes everything about how you should think about biometric security — and almost no one is explaining it clearly. I dug into the actual research so you do not have to. Here is what I found.
The Breach You Cannot Reset
In 2019, security researchers Noam Rotem and Ran Locar discovered that BioStar 2, a biometric security platform used by banks, the UK Metropolitan Police, and defense contractors worldwide, had left its database publicly accessible. The breach exposed over 27.8 million records and, critically, more than one million unencrypted fingerprint scans and facial recognition templates, according to a VPNMentor report published in August 2019.
Read that again: unencrypted. Sitting in a database. Attached to real names and real access privileges.
When a password database is breached, the fix is straightforward — you change your password. The old one becomes useless. When a fingerprint database is breached, there is no fix. That fingerprint is your fingerprint for the rest of your life. It will be your fingerprint when you apply for a visa in 2035. It will be your fingerprint when you try to access a medical record in 2040. Once it is out there, you are not dealing with a temporary problem. You are dealing with a permanent liability.
Why You Trusted Biometrics (And Why That Was Completely Reasonable)
Here is where I want to be careful, because this is not a story about people being naive. Biometric authentication is genuinely impressive technology, and it solved a real problem. Password fatigue is not a myth. A 2022 NordPass study found that the average person manages 100 passwords, and 60 percent of people reuse the same password across multiple sites. The shift toward fingerprints and face scans was a rational response to an exhausting, broken system.
The problem is what happened behind the scenes while you were enjoying the convenience.
Did You Know: According to a 2023 IBM Cost of a Data Breach Report, the average cost of a breach involving biometric data is now 45 percent higher than breaches involving password data alone — because the damage cannot be contained through credential resets.
When you press your thumb to your phone to unlock an app, one of two things is happening. Either your device is processing that fingerprint locally — matching it against a template stored only on your hardware — or it is sending data to a remote server, where it gets stored in a database alongside thousands or millions of other people’s biometric templates. Apple’s Face ID and most fingerprint readers on modern iPhones and Android flagship devices operate locally, using a dedicated secure enclave chip. Your face never leaves your phone. But a significant portion of third-party apps, HR platforms, time-tracking software, and financial applications that request biometric access are not Apple or Samsung. They are collecting and storing that data on their own servers.
When did you last check whether the app asking for your face scan is storing that data on their servers or yours?
Apple and Samsung never made that distinction clear in their marketing. Funny how that works.
Warning: HR and workforce management platforms are among the highest-risk biometric data collectors. Companies like Clearview AI have already demonstrated that facial recognition data can be scraped, aggregated, and sold without users’ knowledge. A 2021 ACLU report confirmed Clearview had amassed over three billion facial images from public sources, linked to real identities, and sold access to more than 600 law enforcement agencies.
The Spoofing Problem Makes It Worse
Here is what this actually means for you beyond the breach risk. Researchers at Michigan State University published a 2023 study demonstrating that high-resolution fingerprint photos — including those taken from crime scenes or even sharp consumer photos — can be used to generate synthetic “MasterPrint” patterns that fool fingerprint sensors up to 76 percent of the time on low-to-medium quality scanners. Iris scan spoofing is advancing just as quickly. A 2022 paper from the University of Warsaw showed that printed iris images could defeat iris authentication systems in controlled conditions.
Think of it this way: you have been using a house key that millions of people now have a copy of — except you cannot change the lock, and you cannot change the key.
The market is not slowing down to address this. The global biometric authentication market was valued at $33.4 billion in 2022 and is projected to reach $68.6 billion by 2027, according to MarketsandMarkets research. The financial incentive to collect and store your biometric data is enormous. And who benefits from you not knowing this?
The Convenience Trade-Off Nobody Disclosed
When you enrolled your face or fingerprint into your bank’s app, into your employer’s attendance system, or into your country’s e-passport program, you likely signed a terms-of-service document that included data retention language buried deep in the legal text. Most people did not read it. That is not stupidity — those documents are deliberately dense. But the result is that millions of people have handed over permanent biometric identifiers with no clear understanding of where they are stored, who can access them, or what happens when the company is acquired, hacked, or goes bankrupt.
Pro Tip: If you live in Illinois, you have more legal protection than you probably realize. The Illinois Biometric Information Privacy Act (BIPA), passed in 2008 and still one of the strongest biometric privacy laws in the United States, requires companies to obtain written consent before collecting biometric data, disclose their retention schedule, and prohibits selling or profiting from that data. BIPA violations carry statutory damages of $1,000 to $5,000 per violation — and class action lawsuits under BIPA have resulted in major payouts, including a $650 million settlement against Facebook in 2021. If a company collected your biometric data without proper disclosure and you are an Illinois resident, you may have legal recourse. Start at the Illinois Attorney General’s website to understand your options.
What happens when the database storing your fingerprint gets breached — and your bank tells you there is nothing they can do? That is not a hypothetical. It is the documented outcome of the BioStar 2 incident, where affected individuals were told the breach occurred, given no remediation path, and sent on their way.
Your Next 3 Steps
These are not general suggestions. Run through this list tonight.
Step 1: Audit every app on your phone that uses biometrics as the only way to log in. Open your phone settings, go to your biometric or Face ID/fingerprint manager, and review which apps are listed. For every app you do not immediately recognize or have not used in the past 30 days, revoke biometric access now. For banking and financial apps that remain, go into the app settings and enable a PIN or password as a backup — not as a replacement, but as a second factor. Use Authy or Google Authenticator to add MFA on top of biometric login wherever the app allows it. Both are free and take under three minutes to set up.
Step 2: Check whether your data was in the BioStar 2 breach. Go to HaveIBeenPwned.com and search your primary email address. Then separately search your email against the BiometricDB breach tracker at biometricdb.com. If your data appears in either search, contact every financial institution you use and explicitly ask this question: “Are my biometric templates stored on-device or on your servers?” If they are stored server-side, request in writing that they add a secondary authentication layer to your account and log that request with a case number.
Step 3: Call your bank before the end of this week. Ask their security team two direct questions: Where are my biometric templates stored, and what is your breach notification protocol for biometric data specifically? If they store biometric templates on their servers, request that a PIN or one-time-code requirement be added to your account as an additional layer. Some banks offer biometric data alerts as an opt-in feature — ask whether yours does. Then set a recurring calendar reminder every six months to repeat this audit. Breach exposures are not always disclosed immediately, and your risk profile changes every time you enroll in a new service.
Your password can be changed in 90 seconds. Your fingerprint cannot. The urgency is not the same, and it is time to stop treating it that way.
