Why Biometrics Alone Are No Longer Enough in 2026

Single-factor biometric authentication relies on a physical characteristic as the sole credential, with no second factor behind it. In August 2026 a national cyber security agency advised against exactly this, warning that high-resolution images circulating on social media now enable AI-assisted spoofing attacks, and recommending that biometrics be paired with a knowledge factor rather than used alone.

The advisory is worth reading carefully, because the reasoning generalises well beyond phone unlocking.

Key takeaways

• Publicly available high-resolution imagery is now sufficient raw material for AI-assisted biometric spoofing.
• The advisory recommends pairing biometrics with a second factor, not abandoning them.
• Biometrics are identifiers, not secrets, and they cannot be revoked or reissued after compromise.
• Presentation attack detection raises the cost of an attack; it does not change the underlying property.
• The durable pattern is a biometric used once, at enrolment, to bind a revocable credential.

The property that makes biometrics different

A password is a secret. If it leaks, you replace it and the exposure ends.

A biometric is not a secret. Your face appears in every photograph of you. Your fingerprints are on every surface you touch. Your voice is in every recording. These characteristics were never confidential; they were merely expensive to reproduce with sufficient fidelity. Security rested on that cost, not on secrecy.

Generative AI has collapsed the cost. What once required specialist skill, equipment and a physical sample can increasingly be derived from publicly available media. And when a biometric is compromised, there is no reissue path. You cannot rotate your fingerprint.

This is the core asymmetry:

The last two rows explain the advisory. The bottom row explains why it arrived in 2026 and not earlier.

What presentation attack detection does and does not do

Modern biometric systems layer on liveness and presentation attack detection: depth sensing, texture analysis, challenge-response, injection detection. These are worthwhile and they raise attack cost materially.

But they are a cost control, not a category change. They make forgery harder without making the biometric secret, revocable or reissuable. Each generation of detection is answered by a generation of attack, and the defender must win every time while the attacker needs to win once.

Building an authentication system whose security depends entirely on staying ahead in that race is a structural bet, and it is the bet the advisory is warning against.

The pattern that holds: biometric at enrolment, credential at use

The resilient architecture uses the biometric where its properties are a strength and avoids it where they are a weakness.

Enrolment. A biometric is excellent for establishing that a specific, unique person is present, once, under controlled conditions, with a qualified issuer, with liveness and attack detection applied at full strength. This is the moment where uniqueness genuinely matters and where the environment can be controlled.

Use. What the person presents afterwards is a credential, not the biometric. The credential is cryptographic, so it is revocable, reissuable, scopeable and expirable. It carries the assurance established at enrolment without re-exposing the characteristic that produced it.

This yields three properties single-factor biometrics cannot provide:

1. Revocation. A compromised credential is revoked and reissued. The person's biometric is unaffected because it was never the credential.
2. Minimised propagation. The biometric exists at the issuer, under audit. It does not accumulate across every service the person uses, so it cannot be stolen from services that never held it.
3. Selective disclosure. A relying party confirms the specific assertion it needs, through a zero-knowledge proof, without receiving the biometric, the document or any raw personal data.

The advisory's practical recommendation, pair the biometric with something else, points in this direction. The credential model is that recommendation made structural: the biometric establishes uniqueness once, and a revocable cryptographic object carries the assurance from then on.

AIR Identity implements this pattern. Verification happens once with a qualified partner. What travels afterwards is a proof, not a template. For fintech and regulated platforms, that also means the number of institutions holding a biometric copy stops growing with every new integration.

Frequently asked questions

Is fingerprint unlock still safe?

For low-value convenience use it remains reasonable. A national cyber security agency advised in August 2026 against relying on it as the sole factor, on the basis that high-resolution imagery available publicly now supports AI-assisted spoofing. For anything protecting significant value, pair it with a second factor.

Can AI fake biometrics?

Increasingly, yes. Generative models can produce facial imagery, voice and document artefacts of sufficient fidelity to defeat weaker checks, and can reconstruct usable fingerprint detail from high-resolution photographs. Liveness and presentation attack detection raise the cost of these attacks but do not eliminate the category.

What is the difference between a biometric and a credential?

A biometric is a physical characteristic: not secret, not revocable, permanently tied to the person. A credential is a cryptographic object issued after verification: revocable, reissuable, scopeable and expirable. The durable pattern uses the biometric once at enrolment and the credential thereafter.

Should biometric data be stored centrally?

Central storage concentrates risk in a way that is difficult to justify, because a compromised biometric cannot be reissued. The lower-risk pattern keeps the biometric with a single qualified issuer under audit, and distributes only cryptographic assertions to relying parties, so that no relying party holds data worth stealing.

What is presentation attack detection?

Presentation attack detection is the set of techniques used to determine whether a biometric sample comes from a live person rather than a photograph, mask, replay or injected synthetic feed. It includes depth sensing, texture analysis, challenge-response and injection detection. It raises attack cost but does not make a biometric secret or revocable.

Related reading

• Biometric data retention is a liability
• Proof of human: bot detection at the login layer
• Age assurance accuracy standards: the 2026 benchmarks

More from AIR: AIR Identity, developer documentation, or browse the full AIR blog.

Deciding where a biometric belongs in your authentication design? See how AIR Identity uses verification once and cryptographic proofs thereafter, or read the developer documentation.