---
title: "Never make a fingerprint or a face the · Agent Wranglers"
url: https://agentwranglers.se/playbook/accessibility/native-apps/biometric-alternatives
id: AXS-67
level: Required
applies: accounts
risk: law
updated: 2026-10-22
build: a2a6bdfed830
tokens: 933
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Never make a fingerprint or a face the only way in

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Native apps](https://agentwranglers.se/playbook/accessibility/native-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AXS-67
- Level: Required
- Chapter: [Native apps](https://agentwranglers.se/playbook/accessibility/native-apps.md)
- Rule: When sign-in or approval uses a fingerprint, a face or a voice, offer another way too. It needs no body feature, such as the device passcode or a security key.
- Check: On a test device with no fingerprint or face enrolled, every sign-in and payment approval completes with the passcode or another factor. A code search finds no biometrics-only policy without a fallback path.
- Risk: A law broken
- Applies when: The project has user accounts.
- How: EN 301 549 clause 5.3 says ICT shall not rely on one biological characteristic as the only means of identification or control. Some people have no readable fingerprint, cannot hold their face in view or cannot speak. On iOS use the `deviceOwnerAuthentication` policy, which falls back to the passcode. The biometrics-only policy fails when Face ID is not set up. On Android pass `BIOMETRIC_STRONG or DEVICE_CREDENTIAL` to the prompt, which allows the PIN, pattern or password. Voice-only checks on a phone line fail deaf customers, so offer a written route too. Passkeys keep the device PIN as a choice, as [Offer passkeys first](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkeys-first.md) describes.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```swift
let context = LAContext()
// Face ID or Touch ID first, then the device passcode
let ok = try await context.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: String(localized: "Approve the payment"))
```

### Kotlin example

```kotlin
val promptInfo = BiometricPrompt.PromptInfo.Builder()
  .setTitle(getString(R.string.approve_payment))
  // Fingerprint or face, or the screen lock PIN, pattern or password
  .setAllowedAuthenticators(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)
  .build()
```

## Sources

- [ETSI EN 301 549 V3.2.1 – clause 5.3 Biometrics](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf)
- [Apple – LAPolicy.deviceOwnerAuthentication](https://developer.apple.com/documentation/localauthentication/lapolicy/deviceownerauthentication)
- [Android – Show a biometric authentication dialog](https://developer.android.com/identity/sign-in/biometric-auth)

## Related rules

- ACC-8 [Offer passkeys first](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkeys-first.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accessibility/native-apps/biometric-alternatives">Agent Wranglers accessibility playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Follow the system display settings](https://agentwranglers.se/playbook/accessibility/native-apps/native-display-settings.md)
- Next: [Claim only the store accessibility labels you tested](https://agentwranglers.se/playbook/accessibility/native-apps/store-accessibility-labels.md)
- [Native apps](https://agentwranglers.se/playbook/accessibility/native-apps.md)