No Thumbs Up in Pictures! Experimental Fingerprint Forgery for Inexperienced Impostors

Fingerprint verification is a popular smartphone authentication method used even for sensitive services such as banking. However, fingerprint verification also has some issues, such as spoofing even by inexperienced impostors utilizing a thumbs up Instagram picture without the victim’s knowledge. This can be a considerable risk with partial scanning of fingertips used on smartphones. To better understand the fingerprint forgery process technical and organizational feasibility as well as user perception, we performed a hands-on forgery simulation to assess the robustness of smartphone fingerprinting technologies including a survey. Overall, 370 inexperienced participants created glue or silicone counterfeits from a photo of their fingers in a contactless way. Then they tested this physical counterfeit against smartphone contact-based fingerprint readers. Five participants logged in to smartphones with their counterfeits, and 74 registered them into smartphones as a “finger”. With improvements in the forgery process in the second run, we achieved an increase in true matches from 41 to 113 when processing scans on computer with NIST Biometric Image Software (NBIS) tool set. Our study shows that quality (measured by NFIQ) and scan enhancement is important during the forgery process – enhancement improves the match score (measured by BOZORTH3). Our analysis also provides insights into user perceptions regarding the forgery experience. Participants intend to use fingerprint authentication less often, but we found mixed results regarding the perception of fingerprint security.