12/10/2026
Your Biometric Device Recognises You. But What Happens When It Recognises a Photo of You?
When an organisation invests in biometric access control, the fundamental expectation is that the system will distinguish the authorised person from an attempt to impersonate that person. A photograph of an individual is not their biometric identity. It is an artefact that can be presented to a biometric sensor in an attempt to deceive the system.
If a biometric system accepts that photograph as though the person were physically present, that is spoofing. The system has not successfully established that the individual presenting the biometric is the genuine person; it has matched an image or representation sufficiently well to grant access.
This is where the difference between biometric recognition and biometric security becomes critical. A system may be highly accurate at matching faces and still be vulnerable to presentation attacks if it does not adequately determine whether the biometric being presented is genuine. Recognition answers the question, โDoes this biometric match the enrolled identity?โ Security must also address the question, โIs this a genuine biometric presentation, or is someone attempting to deceive the system?โ
This is why Presentation Attack Detection (PAD) is such an important consideration when evaluating biometric technology. PAD is designed to detect attempts to present an artefact or other attack instrument to the biometric sensor rather than a genuine biometric characteristic.
For the organisation purchasing the technology, this should form part of the due-diligence process. Do not simply ask how accurate the facial recognition is. Ask how the technology performs against presentation attacks, what testing has been conducted, under what conditions it was tested, and whether that performance has been independently evaluated using recognised testing methodologies.
Because the risk is not simply that a device fails to recognise someone.
The greater security question is whether the system can be spoofed into recognising someone who is not actually there.
When you choose biometric technology, you are choosing more than a reader at a gate or door. You are choosing the technology that stands between a person's identity and the decision to grant access.
That technology deserves to be scrutinised just as seriously as the security it is intended to provide.