Android Facial Recognition Flaw Allows Unauthorized Access via Photos
Which? labs found that 64% of 208 Android phones tested could be unlocked using only a printed photograph of the owner's face. The vulnerability affects major brands including Motorola, OnePlus and Samsung, and could potentially allow unauthorized access to personal data.
What happened
Which? labs tested 208 smartphones since October 2022 and found that 64% (133 devices) could be unlocked using only a 2D printed photo of the owner.
Testing revealed that 72% of phones failed spoofing checks in 2024, a 35% increase from 2023. Affected brands included Asus, Fairphone, Honor, HMD, Motorola, Nokia, Nothing, OnePlus, Oppo, Realme, Samsung, Vivo and Xiaomi.
Reported impact
The facial recognition flaw could allow criminals to access personal messages, emails, and sensitive apps on affected phones.
Index analysis
Most Android phones rely on standard 2D facial recognition systems that use a flat camera image and lack depth perception, making them unable to distinguish between a living person and a photograph.
In 2025, the failure rate improved slightly to 63%, while newer models such as the Samsung Galaxy S26 series passed spoofing tests. Many budget and mid-range phones arriving in shops still lack adequate security.
Governance controls
Some manufacturers have provided clearer warnings during face unlock setup, though the underlying security vulnerability persists.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.