Locking your Android phone with fingerprint or face unlock: how safe is it?

Most people unlock their phone dozens of times a day, which is why a fingerprint or a glance is so appealing. It also changes the habit: a long PIN that you type twice a day is bearable, while one you type fifty times a day isn’t. Used well, biometrics let you keep a strong PIN without the pain. Used carelessly, they become the weakest part of the lock.

Biometrics sit on top of a screen lock

On Android, you can’t use fingerprint or face unlock alone. When you set one up, the phone asks for a backup PIN, pattern or password, and it falls back to that:

• after the phone restarts,
• when your finger or face isn’t recognized several times,
• after a long time without using your PIN.

So the backup lock is the real lock. If it’s a short pattern that anyone could copy by watching, the fingerprint on top doesn’t change much. Pick the backup lock first. The trade-offs are covered in PIN vs pattern vs passphrase vs biometrics.

How to set up fingerprint unlock

Menus vary by phone maker. On many phones:

1. Open Settings, then Security & privacy (or Security).
2. Tap Device unlock, then Fingerprint unlock. If you can’t see it, search Settings for “fingerprint”.
3. Confirm your screen lock, or create one if asked.
4. Follow the prompts, moving your finger a little between touches.

Add only your own fingers. Every enrolled fingerprint opens the phone.

How to set up face unlock

1. In the same Device unlock menu, tap Face unlock.
2. Confirm your screen lock.
3. Follow the prompts in good light.

The official help for one phone line notes that face unlock may not work in low light or with a face covering or sunglasses, and that the phone can be unlocked by someone holding it up to your face. Setting up both fingerprint and face gives you a fallback.

Where biometrics are weaker than a PIN

• Someone with you. A person can press your finger to the sensor or hold the phone to your face, while you’re asleep or under pressure. They can’t take a PIN out of your head the same way.
• Copies. The help pages acknowledge that a copy of your fingerprint could, in principle, be used to unlock the phone. This takes effort, but it’s possible.
• Face unlock on basic hardware. Phones that rely on the front camera alone are easier to fool than ones with dedicated face sensors.

Quick ways to switch biometrics off

Many Android phones have a Lockdown option in the power menu (hold the power button, or power and volume up). It locks the phone and turns off biometrics until you enter your PIN. If your phone doesn’t show it, look for it in the lock screen settings. Restarting the phone has a similar effect, since the PIN is required after every restart.

Theft and biometrics

Recent Android versions add theft features that work alongside your lock, such as locking the screen when a snatch is detected and asking for biometrics before sensitive changes away from trusted places. See Android theft protection explained.

Inside apps

Banking apps, password managers and vault apps can let you open them with the same fingerprint or face. That’s convenient, but it means anyone your phone recognizes can open those apps too. For an app that holds your most private things, consider an app lock that’s separate from the phone’s.

Silo, coming soon to iPhone and Android, opens with its own PIN of at least six digits, or a passphrase on Pro. Face or fingerprint unlock is optional, and your Silo PIN is still needed whenever the phone’s biometrics can’t be used.