Facial Recognition on Many Smartphones Bypassed by Photos
Consumentenbond testing found that facial recognition on 69 percent of smartphones released since mid-2023 can be bypassed using a photograph, a significant increase from 43 percent three years earlier. Expensive devices from Samsung, Oppo, and OnePlus were vulnerable, while Apple and Google smartphones proved secure, exposing users to potential unauthorized access to banking, payment, and personal data.
What happened
The Consumentenbond tested 133 smartphones released since June 2023 and found that 92 could be unlocked using a photograph of the owner. According to Consumentenbond director Sandra Molenaar, 'It is concerning that consumers cannot assume that the facial recognition of their smartphone is in order.'
69 percent of the tested devices failed the facial recognition security test, a significant increase from 43 percent three years prior. Affected models included the Samsung S25 Ultra (€1,250), Oppo Find X Pro (€1,300), and OnePlus 15 (€750), while Apple and Google devices passed the test in all cases.
Reported impact
Smartphones with weak facial recognition can expose users to unauthorized access to banking apps, password managers, email accounts, DigiD messages, payment applications, document photos, and private conversations. If someone unlocks the phone, they can reset passwords, access payment apps with additional protections, and compromise a user's entire digital life.
Index analysis
Samsung stated that facial recognition is primarily an option for 'extra ease of use' and claimed it cannot access functions requiring higher security like Samsung Wallet. Motorola advised that facial recognition should not be used and recommended a PIN, password, or pattern for optimal security. OnePlus noted that users receive advance warnings about the feature.
Governance controls
The Consumentenbond published a list of devices with insecure facial recognition to help consumers check their own phones and advised users to disable facial recognition on vulnerable devices and use a strong PIN or fingerprint instead. The organization stated that 'Smartphones must either have good facial recognition or no facial recognition at all.'
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.