Face recognition on Android found to be vulnerable: 64% of smartphones can be unlocked with a photograph

The British consumer organization Which? conducted large-scale testing and identified serious problems with biometric security on smartphones running Android. According to the study’s findings, nearly two-thirds of the tested devices could be unlocked using a standard printed photograph of the owner.

Results of Large-Scale Testing

Since October 2022, specialists from Which? tested 208 models of Android smartphones. In 64% of cases (133 devices), the facial recognition system was successfully bypassed using a 2D photograph.

The peak level of vulnerability occurred in 2024, when the share of vulnerable devices reached 72%. In 2025, the figure decreased slightly to 63%, indicating slow but noticeable progress by some manufacturers.

The problem primarily affects entry-level and mid-range devices that use simple 2D facial recognition systems. Such solutions analyze only a flat image from the front-facing camera and cannot reliably distinguish a real face from a photograph.

The testing included smartphones from leading brands such as Samsung, Xiaomi, Motorola, OnePlus, Nothing, and others. At the same time, results within a single brand varied significantly depending on the model and year of release.

Positive Examples

Some manufacturers have demonstrated measurable progress. For example, the Samsung Galaxy S26 lineup successfully passed the tests, whereas the previous Galaxy S25 generation was found to be vulnerable.

Higher levels of protection are provided by systems that use three-dimensional facial scanning (similar to Face ID from Apple), as well as enhanced 2D solutions that incorporate machine learning, such as those used in Google Pixel smartphones. The latter meet strict security requirements necessary for working with financial applications.

Manufacturers’ Response

Many companies openly acknowledge the limitations of the technology. Honor and Motorola, for example, state that facial recognition should be viewed primarily as a convenient unlocking method rather than a reliable security mechanism. They recommend using a PIN code, pattern lock, or fingerprint scanner to protect sensitive data.

In Brief

According to a study by the British organization Which?, 64% of tested Android smartphones can be unlocked using a standard printed photograph. The vulnerability is particularly common in entry-level and mid-range devices equipped with basic 2D facial recognition systems. In 2025, the share of such models decreased to 63%, but the issue remains relevant. More reliable protection is provided by systems with 3D scanning (similar to Face ID) and advanced 2D solutions with machine learning (such as those used in Google Pixel devices). Manufacturers recommend using biometric unlocking mainly for convenience, while relying on traditional security methods—such as PIN codes or fingerprint authentication—for protecting important data.