'Face unlock' feature can be tricked by photos on 60% of phones, tests show

Testing has revealed that smartphones from major brands including Samsung and Motorola can be unlocked using printed images of the owners face.

Consumer experts have warned that this security loophole could be exploited by criminals to unlock devices and access personal information.

Which?, the UK’s largest independent consumer organisation, has been carrying out lab tests on hundreds of phone models since 2022, assessing features from battery life to security features.

While most smartphones now offer facial recognition to unlock mobile devices, Which?’s testing found that as many as 64% of phones – 133 devices since 2022 – could be tricked by a printed image.

Phones that failed the organisation’s tests include top-of-the-range models such as the Oppo Find X9 Pro, which retails for upwards of £1,000.

According to Which?, Samsung’s former flagship range of Galaxy S25 phones could all be fooled by a 2D photograph, while the some lower-priced Android phones also struggled, often relying on a standard 2D facial recognition system.

Which? Found that the newest Google Pixel models and Samsung Galaxy S26 series passed their tests and Apple Face ID was considerably harder to trick.

The non-profit says that some device cameras take flat pictures, which means they cannot always distinguish between a real person and a high-resolution photo.

Most phones that failed Which?’s test did have an onscreen message warning that face recognition cannot be relied upon for security.

Lisa Barber, Which? Tech Editor said: “These security flaws are far from isolated incidents.

“The majority of Android phones we’ve tested in the last four years can be easily unlocked using a 2D image, and some manufacturers are still failing to adequately warn their users that this is the case.

“We’d urge affected users to set up alternative methods of security, like a fingerprint or a PIN, which are much more secure.”

Which? Approached the companies involved for comment.

A Fairphone spokesperson said: “At Fairphone, privacy and security are fundamental to our design.

“The Fairphone (Gen 6) utilises 2D facial recognition, which is categorised as a Class 1 biometric under Android’s security framework.

“This is a widely adopted industry standard utilised by many leading smartphone brands and inherently shares the same limitations.

“Because it is a Class 1 biometric, the Android system automatically enforces strict security restrictions; Face Unlock can only be used to access the lock screen and is strictly blocked from sensitive actions, such as NFC payments or banking apps.”

Honor told Which? that 2D systems have technical limits that can make them susceptible to being tricked.

Because of this, the feature should be used as a tool for convenience rather than for authorising sensitive transactions.

Users are informed during setup that the system is less secure than a password, and for those needed top-tier security for banking Honor suggests its pro models with 3D facial recognition.

Motorola said: “Security has always been at the core of what we do and the security of our consumers remains a top priority for Motorola.

“The Face Unlock technology is intended to support convenient unlocking of the phone, although Motorola reminds and recommends that consumers use a PIN, password or pattern for enhanced security.

“Also, if a consumer chooses to use Face Unlock for convenience after consenting to use this feature, they will also need to choose a pattern, PIN or password to secure their device.

“This added layer of protection secures the phone if the consumer is away from their phone for more than four hours or after restarting the device.”

OnePlus added that it is transparent about these risks, signalling to a mandatory “Statement on Using Face Recognition” that every user must read before they can turn the feature on.

This notice tells owners that the technology is less secure than a numeric password or fingerprint, and warns that, in rare cases, the camera could be tricked.

Which? said that Nothing and Oppo did not provide a comment. ITV News has approached Asus, HMD, Nokia, Realme, Samsung, Vivo, and Xiaomi for comment.