Biometric authentication is becoming ubiquitous on mobile devices, where users routinely unlock their smartphone using a fingerprint or the face.

This is usually perceived as very secure, indeed biometric authentication complies with the principle of using multiple independent factors for user authentication, in this case something that the user is or does, as opposed to passwords (something that the user knows) or security tokens (something that the user has).

Nevertheless, even biometric authentication has vulnerabilities.

Differently from passwords and security tokens, a biometric feature cannot be replaced. If passwords are usually sent to a remote server to perform user authentication, sending fingerprint or face data to a remote server would expose the user to much higher risks, since the disclosure of biometric data would be irreversible. …

SIM-swap scams are one of the most common attacks to mobile phone users and leave them vulnerable to identity theft. In this article, we explain the threat they pose for multifactor authentication systems where codes are sent via SMS to a person’s mobile.

In short, a SIM-swap scam exploits the ability of your service provider to port your phone number from one SIM card to another. …