Apple cautiously shifts to Face ID for payments, security in iPhone X

Enjoy complimentary access to top ideas and insights — selected by our editors.

Apple's upcoming iPhone X will ditch its fingerprint sensor in favor of a multi-camera system, but it still expects some users to opt for a PIN code.

In eliminating the fingerprint sensor to accommodate an edge-to-edge display, Apple had to redesign a lot of the ways its smartphone handles common interactions, especially payments. And while the company touted the strength of its new Face ID system, it came with a few words of caution.

"If you happen to have an evil twin, you really need to protect your sensitive data with a passcode," warned Phil Schiller, Apple's senior vice president of worldwide marketing, in a Tuesday presentation announcing the company's newest smartphones.

David Paul Morris/Bloomberg

When picked up by a stranger, that stranger has a one in a million chance of being able to trick the camera — a huge improvement from the one in 50,000 chance with Touch ID, which Schiller described as the "gold standard" of biometric authentication. The odds get lower when people such as family members share traits with the phone's owner, but it has protections against being unlocked by a sleeping user's face or a photo of the user.

"Face ID also works with Apple Pay," Schiller said. "You look at iphone X to authenticate and hold it near the payment terminal to pay."

Third-party financial and security apps like Mint, 1Password and E-Trade also support Face ID authentication, Schiller said. The iPhone 8, announced alongside the iPhone X, still uses Touch ID instead of Face ID.

Despite Apple's advances, the company has never felt confident enough to totally remove PIN authentication. When Touch ID launched, Apple even saw fit to strengthen its PIN security, requiring a six-digit PIN instead of the four-digit PIN it supported on previous iPhones. That change made it far less likely for a stranger to guess the user's PIN — one in a million compared to one in 10,000, Apple said at the time.

Schiller's warning is likely in response to publicity surrounding attempts to defeat biometric authentication. In May, a BBC reporter and his non-identical twin brother were able to fool HSBC's voice biometrics phone banking system. Such efforts are worrying for companies that want to advance biometric authentication, even if they are unlikely to apply to most consumers.

Apple isn't the first to support facial biometrics for smartphone authentication and payments. Samsung introduced a similar feature in its ill-fated Note 7 smartphone last year, which had an iris scanner built in. The feature survived into its Note 8 device, launched this year ahead of Apple's iPhone announcement.