Facial recognition technology used by some android smartphones can be tricked into unlocking by holding a printed 2D photograph in front of device cameras, Which? has warned.

The consumer champion said that some mobile phones developed by Honor, Motorola, Nokia, Oppo, Samsung, Vivo, and Xiaomi are at risk of being exploited by criminals who can “easily” unlock their systems.

The organisation sent 48 new smartphones to a lab for testing, with 19 new phones – 40 per cent – opening their locked screens after being shown a photograph.

It said that the photos used were not particularly high resolution and were printed on a standard office printer and paper.

Which? revealed that the majority of phones that were duped by the 2D image were at the cheaper to mid-range end of the market, including the £89.99 Motorola Moto E13,

However, much more expensive handsets like the £949.99 Motorola Razr 2022 were also tricked.

The investigation found that Xiaomi had seven phones that could be exploited and Motorola had four.

Nokia, Oppo and Samsung all had two phones that could be opened by a photograph, while Honor and Vivo had one affected model respectively.

Which? contacted Honor, Motorola, Oppo, and Xiaomi for comment but received no response.

Samsung told the organisation that its fingerprint reader is its highest level of authentication, while Vivo agreed that on an industry level that 2D facial recognition is an "elementary security measure".

Nokia said that it tells customers that its affected phones can be unlocked by someone who looks a lot like them. It claimed that in its own testing with printed pictures, it did not register any issues.

“It’s unacceptable that brands are selling phones that can easily be duped using a 2D photo, particularly if they are not making their customers aware of this vulnerability,” said Lisa Barber, Which? tech editor. “Our findings have really worrying implications for people’s security and susceptibility to scams.”

Barber added: “We would strongly advise anyone using these phones to turn off face recognition and use the fingerprint sensor, a strong password or long PIN instead.”

Share Story: