How biometric authentication works
At enrolment a sensor captures the characteristic and software turns it into a template, a mathematical summary. Each later attempt is captured the same way and scored against the template, and because the match is a probability, a threshold decides.
On a phone the template stays on the device, in protected hardware, and the app never sees it. The app asks the operating system to verify the user, and a positive result unlocks a cryptographic key that signs the request to the server. What the server receives is a signature from a registered device, not a fingerprint.
What the rules say about biometrics
The EU's technical standards on strong customer authentication require that devices and software reading an inherence element have a very low probability of authenticating an unauthorised party (Delegated Regulation (EU) 2018/389, Article 8).
Under the GDPR, biometric data processed to uniquely identify a person is a special category of personal data, and its processing is prohibited unless a condition in Article 9, such as explicit consent, applies. A product that keeps face or voice templates on its own servers processes such data itself, which is one reason most apps rely on the phone's own check.
The card schemes accept the same check at the till: the Visa Core Rules recognise verification of the cardholder on the cardholder's own device, for example by fingerprint.
Biometric authentication or identity verification?
- Identity verification
- A selfie compared with the photo on an identity document, once, at onboarding. It answers who a person is, where authentication answers whether the same person has returned.
- Behavioural biometrics
- Patterns such as typing rhythm or the way a phone is held, scored in the background as a fraud signal.
Where biometric authentication shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Delegated Regulation (EU) 2018/389, the technical standards on strong customer authentication, Article 8 (EUR-Lex)
- Regulation (EU) 2016/679, GDPR, Articles 4(14) and 9 (EUR-Lex)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Consumer Device Cardholder Verification Method (Visa)
General information, not legal advice: what applies to you depends on your services and your market.