Tech

How Does Face Unlock Work and Can a Photo Fool It

Rive News Research Desk

Published October 17, 2026 · 9 min read

Key takeaways

Face unlock compares a live scan of your face with a stored mathematical template, not with a saved photo.
Basic 2D systems can be fooled by a printed photo, while 3D depth systems resist that trick.
A UK consumer group found 133 of 208 tested phones could be unlocked with a simple 2D printed photo.

A woman using a smartphone while walking — A woman uses a smartphone while walkingPhotograph: Biswarup Ganguly / Wikimedia CommonsImage: Wikimedia Commons

A glance that opens your phone

You lift your phone, look at it, and it unlocks in under a second. The speed feels like magic, but the steps behind it are mechanical. The phone captures your face, turns it into numbers, and compares those numbers with a template it stored when you set the feature up.

If the match is close enough, the lock opens. If not, it stays shut.

That single sentence hides an important split. Not every phone performs the same check. Some use an ordinary front camera and a flat image.

Others build a three-dimensional depth map of your face. The difference decides whether a printed photo can fool the system. So how does face unlock work, and can a photo fool it?

The answer depends on which kind of system your phone uses.

Step one: capture

Everything starts with the front-facing hardware. On a basic phone, that is just the selfie camera. It takes a flat picture of your face, the same kind of image you would send to a friend.

On a phone with depth sensing, the hardware is richer. An infrared flood illuminator lights your face with invisible light, so the system works in the dark. A dot projector throws thousands of tiny infrared dots onto your face.

An infrared camera reads how that dot pattern bends across your nose, cheeks, and jaw. That bending reveals depth, point by point. Apple says its Face ID combines depth maps, infrared imaging, and anti-spoofing neural networks inside a secure hardware enclave, according to Pune Mirror.

Step two: map the face

Next, software finds the landmarks: eyes, nose, mouth, cheekbones, jawline, and the distances between them. A 2D system maps these features on a flat plane. It measures spacing and shape, but it has no sense of how far forward your nose sits relative to your cheeks.

A 3D system adds that missing dimension. Structured light, or time-of-flight sensing, measures the distance of each point on your face and builds a depth map. That map captures contours a flat image cannot carry.

SamMobile explains that premium systems create detailed 3D maps using multiple sensors, including infrared projectors and cameras, and that depth makes them resistant to photos, videos, or even detailed masks.

Step three: turn the face into numbers

The phone does not store a photo gallery of your face. It converts the map into a compact mathematical representation, often called a feature vector or template. Each number in that vector describes some aspect of the face: the distance between the eyes, the width of the nose, the curve of the jawline, the depth at the cheek.

That template lives in a secure part of the phone, encrypted, not in your photo roll. During setup, the phone may ask you to turn your head so it can capture the face from several angles. That extra data helps the system recognize you later with glasses, a beard, or a new haircut.

Step four: compare and decide

Every unlock is a comparison. The phone scans your face, builds a fresh vector, and scores it against the stored template. If the score passes a threshold, the phone unlocks.

If it falls short, you get a prompt to try again or to enter your PIN.

The threshold is a trade-off. Set it too loose, and lookalikes or photos get in. Set it too tight, and you get locked out after a haircut.

Makers tune it for a balance, and they keep tuning it with software updates as new spoofing methods appear.

Step five: liveness checks

The best systems add a liveness check: proof that the face in front of the camera belongs to a living person. Methods include micro-movement detection, pulse pattern analysis, temperature verification, and 3D depth mapping, according to SamMobile. Some systems look for a blink or a slight head turn.

Others check that skin reflects infrared light the way living tissue does, not the way paper or a screen does.

Cheap systems skip most of this. That omission is exactly where photo attacks succeed.

Can a photo fool face unlock

For many phones, yes. A UK consumer group tested 208 smartphones released since October 2022 and found that 133 of them, around 64 percent, could be fooled by a simple 2D printed photo, Pune Mirror reports. The vulnerable list included high-end Android flagships such as the Samsung Galaxy S25 range, the Oppo Find X9 Pro, and the Motorola Razr 50 Ultra, plus devices from Asus, Fairphone, Honor, HMD, Nokia, Nothing, OnePlus, Realme, Vivo, and Xiaomi.

The mechanism is straightforward. A basic 2D system compares an image from the front camera with the photo stored during setup and unlocks if they look similar enough. A printed picture, or an image shown on another screen, can clear that bar.

The industry calls this a presentation attack.

By contrast, phones with depth sensing held up. Apple iPhone models using Face ID with 3D mapping were not unlocked by photos in the latest testing, and neither were the Samsung Galaxy S26 series or the latest Google Pixel phones with comparable depth-sensing approaches. A flat image cannot supply the depth data those systems demand.

That does not make 3D systems impossible to fool. Researchers have shown that sophisticated masks and other crafted attacks can challenge them. The gap is about effort and cost.

A photo costs almost nothing and takes minutes. A convincing 3D mask takes skill, materials, and time. For everyday theft, that difference matters.

A face recognition field test at Berlin Südkreuz stationPhotograph: C.Suthorn / Wikimedia CommonsImage: Wikimedia Commons

Why makers still ship weak face unlock

If 2D face unlock is that weak, why does it exist? Because it is cheap, fast, and convenient. It needs no extra hardware beyond the selfie camera.

It works in good light with a quick glance. For many buyers, that convenience is the selling point, and makers know it.

The problem is how it is presented. Investigators criticised several Android makers for not clearly warning users that 2D face unlock is a lower-tier convenience biometric that can be fooled by someone who looks like them or by a photo. In some cases, the caveats appeared only in buried settings or terms and conditions rather than during setup, Pune Mirror reports.

A buyer who never sees that warning may trust the feature far more than it deserves.

How to check what your phone uses

You can find out in a minute. Open your phone settings and look at the face unlock entry. Some makers label the system, or warn that it is less secure than a fingerprint or PIN.

Search your model name plus "face unlock 2D or 3D" to confirm. If the phone has no dot projector or depth sensor in its spec sheet, and the setup never asked you to move your head in a circle, it is almost certainly a 2D system.

Treat that answer as a security fact, not a brand judgment. Two phones from the same maker can use different systems, and a flagship from one year can be weaker than a mid-range phone from the next.

Locking down a phone with weak face unlock

If your phone uses 2D face unlock, you have good options.

Turn off face unlock and use a fingerprint instead. Fingerprint sensors on modern phones reach false acceptance rates below 1 in 50,000 attempts, SamMobile reports, and ultrasonic sensors add 3D reading plus blood flow detection.

Use a strong PIN. Security specialists quoted in the Pune Mirror coverage advise at least a six-digit PIN rather than a four-digit one. Add a SIM PIN, so a stolen phone cannot simply move your number to another device.

Add extra locks for sensitive apps. Banking, payments, and email deserve their own biometric or PIN lock, separate from the lock screen. If someone gets past the lock screen, the app lock is a second door.

Keep software updated. Makers update liveness detection and matching algorithms over time. An update may not turn a 2D system into a 3D one, but it can close specific spoofing tricks.

If your phone offers both face and fingerprint unlock, use the fingerprint for payments and sensitive apps. Reserve face unlock for low-risk convenience, or switch it off entirely. The same layered thinking applies to other logins, so review our guide on whether a password manager keeps logins safe while you harden the phone.

A man using a smartphone with a laptop nearby — A man uses a smartphone with a laptop nearbyPhotograph: Alejandro Escamilla / Wikimedia CommonsImage: Wikimedia Commons

What about twins, family, and lookalikes

Photos are not the only test. Basic 2D systems can also struggle with people who resemble you: identical twins, siblings, or children. Depth systems handle this better, because faces that look alike in photos still differ in three-dimensional shape.

Even so, no consumer biometric is perfect. If someone who looks like you has physical access to your phone, a strong PIN and app locks remain your real protection.

FAQ

Can a video fool face unlock?

On a basic 2D system, yes, sometimes. A video adds movement, which can pass a weak blink or motion check. On a 3D depth system, a video still fails the depth test, because the screen showing it is flat.

Does face unlock work in the dark?

Depth-sensing systems use infrared light and work in darkness. Basic camera-only systems struggle in poor light, because the front camera needs visible light to see your face.

Does face unlock store my photo?

No. The phone stores an encrypted mathematical template, not a photo. That template cannot easily be turned back into a picture of your face.

Should I stop using face unlock completely?

Not necessarily. On a phone with 3D depth sensing, face unlock is a strong lock. On a phone with basic 2D face unlock, treat it as convenience and pair it with a fingerprint, a strong PIN, and app locks.

The bottom line

Face unlock is not one technology. It is a spectrum, from a flat camera comparison that a printed photo can beat, to a depth-mapped infrared scan that resists photos. Find out which one your phone uses, and set your security to match.

If your phone uses the basic kind, switch the important locks to a fingerprint and a strong PIN, and let face unlock stay a convenience rather than your only line of defense.

Tags: face unlock, biometrics, phone security, facial recognition

Latest in Tech

Subscribe for one practical tech explainer in your inbox each week.

Taggedface unlockbiometricsphone securityfacial recognition