Short answer: It depends entirely on what the biometric unlocks. Using Face ID to open your banking app is not a second factor — it is device security, and the bank’s server never sees it. But unlocking a passkey with your fingerprint is genuine two-factor authentication, because it combines the device you hold with the biometric only you have. Same fingerprint, completely different security value.
Where biometrics sit in the model
Authentication factors come in three categories: something you know (password), something you have (phone, security key), something you are (fingerprint, face, iris). Real multi-factor authentication combines at least two different categories — see MFA vs 2FA.
So biometrics obviously qualify as a factor. The complication is who is checking. Almost always, your biometric is verified locally by your device, and the remote service never learns anything about it. That local check may be protecting a second factor, or it may be protecting nothing the server cares about.
Case 1: Face ID on your banking app — not 2FA
You open the app, look at it, and you are in. It feels like strong security. Mechanically, here is what happens: your phone verifies your face against the enrolled template, and — if it matches — releases a stored session token or password to the app.
The bank’s server sees a valid token, exactly as it would if you had typed a password. It has no idea a face was involved.
What that means:
- Your face is protecting the device, not authenticating you to the bank.
- Anyone who can unlock the phone — for instance with the passcode, which is the fallback — reaches the same app.
- An attacker who steals your password and logs in from their own device is unaffected by your Face ID entirely.
This is why phone theft with an observed passcode is such an effective attack. The biometric is bypassed by the very fallback that exists to make it convenient. Apple’s Stolen Device Protection exists specifically to address this — covered in our Apple Account guide.
Case 2: A passkey unlocked by biometrics — genuine 2FA
Here the picture changes completely. A passkey is a private key held in your device’s secure hardware. Signing in means your device signs a challenge from the site with that key — and it will only do so after your biometric or PIN unlocks it.
Two factors, both genuinely involved:
- Something you have — the device holding the private key, which cannot be extracted.
- Something you are — the biometric releasing it.
The server receives cryptographic proof that both conditions were met. That is real multi-factor authentication, delivered in one tap. And because the credential is bound to the site’s domain, it cannot be phished — see what WebAuthn and FIDO2 are and passkeys vs 2FA.
Case 3: Fingerprint on a security key — also genuine
Biometric security keys work the same way: the key holds the credential, your fingerprint authorises its use. Possession plus inherence, verified on the key itself. See what a hardware security key is.
Case 4: Biometric lock on your authenticator app — helpful, not a factor
Apps like Aegis, 2FAS and Authy can require a fingerprint before showing your codes. This is worth switching on: it stops someone who picks up your unlocked phone from reading your codes.
But it is device-side protection, not an additional factor for the website. The service still sees only a valid six-digit TOTP code — see how TOTP codes work. Useful, just not what the word “factor” means here.
Why biometrics alone are a poor primary credential
Three properties make them unsuitable as your only proof of identity:
- You cannot change them. A leaked password is replaced in seconds. A compromised fingerprint template is compromised for life — you have ten, and they are not secret. You leave them on every glass you touch.
- They are not secrets. Your face appears in thousands of photographs. Systems relying on a face being unknown are relying on something false.
- They can be coerced. Someone can hold a phone to your face. They cannot extract a password from your head the same way — a distinction that matters in some jurisdictions and situations.
This is why serious systems use biometrics to unlock a cryptographic key rather than to be the credential. Your face is the key to the safe, not the contents.
What to do with all this
- Use passkeys where offered — that is where a biometric genuinely becomes part of your authentication rather than just device convenience.
- Turn on the biometric lock in your authenticator app. It costs nothing and closes a real gap.
- Protect the passcode fallback. Use a long alphanumeric device passcode, never type it in view of strangers, and turn on Stolen Device Protection on iPhone or its Android equivalents.
- Do not treat app biometrics as 2FA. If your bank app opens with Face ID but the account has no second factor for web logins, the account is protected by a password alone.
- Keep an authenticator app for the many services that offer no passkey option — see Aegis vs 2FAS.
Frequently asked questions
Is Face ID more secure than a password?
For unlocking a device, yes in practice — it resists shoulder-surfing and encourages a strong underlying passcode. As a remote authentication method on its own, no: it is not secret, cannot be changed, and is not transmitted to the service anyway.
Can my fingerprint be stolen from a website?
No. With WebAuthn and platform biometrics, the biometric data never leaves your device. Sites receive a cryptographic signature, never an image or template.
Is “biometric 2FA” advertised by apps a lie?
Usually it is loose marketing rather than a lie. Requiring a biometric to open an app is real security — it is just protecting the device, not adding a factor the server verifies. Read it as “app lock”, not “two-factor authentication”.
If a passkey is already two factors, do I still need a code?
No. That is the point of passkeys: one action, two factors, phishing-resistant. Keep a second method registered for recovery, but you do not need a TOTP code as well.
What if someone forces me to unlock with my face?
Both major platforms have a quick disable — pressing the side and volume buttons on an iPhone, or lockdown mode on Android — that reverts to passcode-only. Worth learning before you need it.
Are fingerprints better than face recognition?
Both are strong on modern hardware with proper liveness detection. Face unlock on cheaper Android devices using only a camera is considerably weaker. Check whether your device uses secure hardware-backed biometrics.
The bottom line
The question is never “is biometrics 2FA?” but “what is the biometric releasing?” If it releases a stored password or session, it is device convenience. If it releases a cryptographic key the server verifies, it is real two-factor authentication in a single tap. Chase the second kind — and until it is available everywhere, keep an authenticator app for the rest.
Need codes in the meantime? Our free browser-based 2FA code generator runs entirely on your device.