How Biometric Scanners Work

01 The Fingerprint: Ridges, Valleys, and Charge

The most ubiquitous biometric scanner is the capacitive fingerprint sensor, found on billions of smartphones and laptops. Its operation is grounded in a simple physical fact: the ridges of a fingerprint are raised and the valleys between them are recessed. When a finger touches a capacitive sensor, the ridges make contact with the sensor surface while the valleys remain separated by tiny air gaps. The sensor itself is an array of thousands of microscopic capacitor plates — typically 50,000 or more on a modern phone sensor — each measuring the capacitance between the plate and whatever is touching it. Air has a much lower dielectric constant than skin, so the capacitors beneath ridges measure a significantly different value than those beneath valleys. By reading the capacitance at every point in the array, the sensor builds a high-resolution map of the fingerprint's ridge structure.

This approach has several advantages over the older optical fingerprint scanner, which used a light source and a camera to photograph the fingerprint. Optical scanners are bulkier, because they need space for the light path and lens, and they are more vulnerable to spoofing: a high-resolution photograph of a fingerprint pressed against the sensor can sometimes fool them. Capacitive sensors are thin enough to embed in a phone's home button or beneath the display glass, and they are inherently more resistant to photo-based spoofing because they require actual conductive material — skin or a specialized conductive mold — to produce the capacitance pattern. The trade-off is that capacitive sensors can struggle with very dry fingers (dry skin has lower conductivity and thus lower capacitance) and with wet or oily fingers, which can short-circuit the capacitance differences between ridges and valleys. Most modern implementations compensate with adaptive gain and temperature correction on a per-pixel basis.

02 Ultrasonic Imaging: Seeing Through Glass

The latest in-display fingerprint sensors, introduced by Qualcomm and used in flagship Samsung Galaxy and other Android phones, use a fundamentally different technology: ultrasonic imaging. Instead of measuring capacitance, an ultrasonic sensor emits high-frequency sound waves — typically around 8 to 15 MHz — from a piezoelectric transducer beneath the display glass. When these sound waves encounter the boundary between the glass and the finger, they reflect back at different intensities depending on whether they hit a ridge (in direct contact with the glass) or a valley (separated by an air gap). The sensor detects these reflections and builds a three-dimensional depth map of the fingerprint surface, not just a two-dimensional image.

Ultrasonic sensing has major advantages. Because sound waves penetrate moisture and contaminants on the skin, ultrasonic sensors work reliably with wet, oily, or dirty fingers that would defeat a capacitive sensor. They can also capture pore-level detail — the tiny sweat pores along the ridges — which adds another layer of biometric data that is extremely difficult to spoof. The depth map means a flat photograph or even a conductive silicone mold that reproduces ridge geometry but not the exact depth profile will be rejected. The technology's main drawback is cost and speed: the ultrasonic transducer array and its associated signal processing are more expensive than a capacitive sensor, and the scanning cycle takes slightly longer. As teardowns have shown, the ultrasonic sensor module is a thin, transparent piezoelectric layer bonded directly to the back of the OLED display panel, invisible from the front but clearly visible when the phone is disassembled.

03 Iris Scanning: The Pattern in Your Eye

The iris — the colored ring around the pupil — is one of the richest sources of biometric data in the human body. Its intricate texture, formed by crypts, furrows, rings, and freckles, is determined by a partially random developmental process and is effectively unique even between identical twins. Iris recognition systems capture a high-resolution near-infrared image of the eye, typically using a camera with a 700–900 nm illumination source that makes the iris texture more visible while keeping pupil dilation minimal. The near-infrared light also works behind eyeglasses and contact lenses, which would be a problem for visible-light imaging.

Once the image is captured, the system isolates the iris region using edge detection to find the boundaries between the pupil, iris, and sclera (the white of the eye). The iris texture within this annular region is then processed using a mathematical technique called Gabor filtering, which extracts the frequency and orientation content of the texture at multiple scales. The result is a 2,048-bit code called an iris template — a compact mathematical representation of the iris pattern that can be compared against a stored template in milliseconds. The false acceptance rate for iris recognition is among the lowest of any biometric: approximately 1 in 10 billion for a well-implemented system, meaning the chance of a random person's iris matching yours is lower than the world's population. This extraordinary accuracy, combined with the fact that the iris is internal and protected (unlike fingerprints, which can be left on surfaces), makes iris scanning attractive for high-security applications. Samsung implemented iris scanning on the Galaxy Note 7 and Note 8, though it was later discontinued in favor of cheaper facial recognition systems.

04 Face Recognition: From Pixels to Depth

Facial recognition has undergone two distinct technological generations. The first, still used in many consumer laptops and low-end systems, is 2D facial recognition: a standard camera captures a visible-light photograph of the face, and software extracts geometric landmarks — the distance between the eyes, the position of the nose tip, the shape of the jawline — to create a template. This approach is cheap and fast, but it is vulnerable to spoofing with a photograph or a video of the authorized user. Its false acceptance rate is relatively high, typically around 1 in 10,000, which is why most 2D facial recognition systems require an additional authentication factor for sensitive applications.

The second generation, pioneered by Apple's Face ID in 2017 and now used across high-end smartphones, is 3D structured-light facial recognition. The system projects a grid of roughly 30,000 invisible infrared dots onto the face and reads the distortion of the dot pattern with an infrared camera. Where the dots land on a raised surface like the nose, they appear closer together; where they land on a recessed area like the eye socket, they appear farther apart. This creates a precise three-dimensional depth map of the face, accurate to the millimeter. Because the system uses infrared light, it works in total darkness. And because it measures depth rather than just a flat image, it cannot be fooled by a photograph — a photo has no depth, and the dot pattern will reveal a flat surface rather than a three-dimensional face. The depth map is converted into a mathematical template and compared against the stored enrollment data. Apple claims a false acceptance rate of approximately 1 in 1,000,000 for Face ID — far better than 2D face recognition, though still below iris scanning's extraordinary accuracy.

05 The Template: How Biometrics Become Numbers

Every biometric scanner, regardless of modality, follows the same fundamental pipeline: capture, extract, template, compare. The scanner captures raw biometric data — a capacitance map, an ultrasonic depth profile, a near-infrared iris image, or a structured-light depth mesh. Feature extraction algorithms then distill this raw data into a compact mathematical representation called a template. This template is not an image of your fingerprint or face — it is a set of numbers, typically 200 to 2,000 bytes, that uniquely characterize the biometric features. The template is what gets stored, not the original image, which has important security implications: a stolen template cannot be reverse-engineered to produce the original fingerprint or face, and it cannot be used with a different vendor's matching algorithm.

The comparison stage is where the system decides whether the live scan matches the enrolled template. This is not a binary yes-or-no; it produces a match score, a number representing how similar the two templates are. The system applies a threshold: if the score exceeds the threshold, the scan is accepted; if it falls below, it is rejected. Setting this threshold is a fundamental trade-off. A low threshold means more false accepts (an imposter is mistakenly authorized), while a high threshold means more false rejects (the legitimate user is mistakenly denied). Every biometric system must choose where on this curve to operate, and the choice depends on the application. A phone unlock can tolerate an occasional false reject — you just try again. A border control system or a payment authorization system has far less tolerance for false accepts, so it sets a higher threshold and accepts more user inconvenience as a trade-off.

06 Spoofing and Liveness Detection

The single greatest challenge facing biometric authentication is spoofing: presenting a fake biometric sample to defeat the scanner. The history of fingerprint spoofing dates to the early 2000s, when researchers demonstrated that a fingerprint lifted from a glass surface and etched into a circuit board, then cast in gelatin or silicone, could fool optical and early capacitive sensors. The MythBusters television show famously demonstrated this in 2006, using a ballistics gel copy of a fingerprint to defeat a commercial door lock. The defense against such attacks is liveness detection — mechanisms designed to confirm that the biometric sample comes from a living person, not a synthetic replica.

Liveness detection methods vary by modality. Capacitive sensors can detect the subtle electrical properties of living skin — its conductivity, dielectric constant, and even the micro-pulsations from blood flow. Ultrasonic sensors detect pore structure and skin elasticity that are absent in synthetic materials. Iris scanners check for pupil dilation in response to light changes, a reflex that cannot be replicated with a photograph. 3D facial systems look for micro-movements, blink detection, and infrared signatures of blood flow in the skin. Some high-security systems combine multiple biometrics — fingerprint plus iris, or face plus voice — to make spoofing exponentially more difficult. The arms race continues, however; researchers have demonstrated deepfake video that can fool some 2D facial recognition systems in real time, and 3D-printed faces that defeat certain structured-light systems. The best modern implementations combine hardware-level liveness checks with software-based anomaly detection, creating multiple layers that an attacker must simultaneously defeat.

07 Privacy and the Unchangeable Key

Biometrics differ from every other form of authentication in one fundamental way: they cannot be changed. A compromised password can be reset. A stolen token can be revoked. But a fingerprint, once captured by an attacker, is compromised permanently — you cannot grow a new fingerprint. This asymmetry has profound privacy implications and has driven the architecture of biometric systems toward on-device processing and hardware isolation. Apple's Secure Enclave, Google's Titan M chip, and the trusted execution environments built into modern smartphone processors all share a common design principle: biometric templates are generated and stored within a hardware-isolated security domain, and the raw biometric data never leaves the device. Authentication is a yes-or-no signal communicated to the operating system, not the biometric data itself.

This local-first architecture stands in contrast to large-scale biometric databases, such as those maintained by national identity systems, border control agencies, and law enforcement. When biometric templates are stored in centralized databases — India's Aadhaar system enrolled over 1.4 billion residents' fingerprints and iris scans — the risk profile changes fundamentally. A breach of such a database does not just expose personal data; it exposes biometric data that cannot be reissued. The Aadhaar system has faced legal challenges and reported data breaches, highlighting the tension between the convenience of centralized biometric identity and the irreversibility of biometric compromise. As biometric scanners become more capable, cheaper, and more pervasive — embedded in door locks, payment terminals, cars, and airports — the engineering of how biometric data is captured, stored, and protected matters more than the accuracy of the scan itself. The technology works. The question is whether society can trust the systems built around it.