Biometrics is the recognition of people from physical or behavioural traits, and the deployed reality in 2026 is that matching largely works while liveness, injection resilience and commercial capture do not.
Summary
Biometrics covers the recognition of individuals from physical and behavioural traits such as fingerprints, face, iris, voice and gait, and is increasingly the default replacement for passwords in device unlock, border control, national ID and financial account protection. A system has three layers that are usually confused with each other: a sensor and feature extractor that turns a body into a template or embedding; a comparison step that produces a match score; and a defence layer that decides whether the thing in front of the sensor is a live human at all, and whether the data reaching the comparison step actually came from that sensor.
The numbers that decide a biometric are operating-point numbers, not accuracy numbers. False accept rate (FAR) and false reject rate (FRR) trade against each other, and equal error rate (EER) is the point where they cross, which is almost never where a security product runs. The ear-acoustic literature is the clearest illustration: sub-1% EER coexists with roughly 22% FRR at a security-grade FAR of 0.1%, improved to about 14% by a dedicated methods paper, against a Face ID FAR of around one in a million 2022 Ear Acoustic Between Class Features. For the defence layer the equivalent metrics are BPCER (rejecting genuine users) and APCER (accepting attacks), plus a separate question of injection resilience, meaning whether an attacker can bypass the sensor entirely with a virtual camera, hooked system call or manipulated network traffic ref.
The live frontier is therefore not new sensing modalities but that defence layer. A US government evaluation run by the Maryland Test Facility for DHS Science and Technology tested six active and twelve passive liveness systems, and of the twelve passive systems exactly one met the APCER threshold; the report places presentation attack detection between document validation (poor) and face matching (substantially better) in the identity stack ref. Standards are following: ISO/IEC 30107-3:2023 covers presentation attacks only, CEN/TS 18099:2024 is the only published specification that proves injection resilience, ISO/IEC 25456 is in development, and ETSI EN 119 461 already mandates injection-attack testing with documented evidence ref.
Alongside this, exotic modalities keep being reintroduced as novel. Transient evoked otoacoustic emission identity, including the liveness-by-construction argument that you cannot replay a signal the cochlea must actively generate, was published as a University of Toronto thesis in 2014 with 99.44% identification and 0.02% EER on both-ear fusion 2014 Liu Earprint Teoae Biometrics Thesis, and again with proper verification metrics in 2021 2021 Earnet Teoae Biometric Embeddings. Anyone assessing a biometrics pitch should check the prior art, the operating point rather than the EER, and whether the claim covers injection as well as presentation attacks.
Evidence base
- In the only independent benchmark of deployed liveness systems, run by the Maryland Test Facility for DHS S&T, only two of six active systems met the BPCER threshold and exactly one of twelve passive systems met APCER; the best result was 0.5% BPCER, 1.7% APCER, 2.3 s (Mar 2026 reporting) ref.
- CEN/TS 18099:2024 is the only published specification proving injection resilience, ISO/IEC 25456 is in development, ETSI EN 119 461 already mandates injection-attack testing, and a report-mill forecast puts injection attacks above 4 billion by 2028 (Jul 2026) ref.
- World held a $2.5bn valuation, 18M+ Orb-verified humans, 475M+ proofs and 1,500+ Orbs in 23 countries, and restructured a ~500-person team on 8 June 2026 because revenue lagged Orb manufacturing and compliance costs ref.
- Humanity Protocol abandoned proof-of-personhood in February 2026 after 8M+ palm-based Human IDs, while Billions raised $30m positioning explicitly against invasive biometric scans using passport NFC plus zero-knowledge proofs ref.
- Ear-canal acoustic authentication’s baseline is ~22% FRR at FAR 0.1%, improved to ~14% by a dedicated methods paper (arXiv 2205.08778, May 2022), against a Face ID FAR of roughly one in 1,000,000 2022 Ear Acoustic Between Class Features.
- Otoacoustic-emission identity with the liveness and anti-replay argument, 99.44% identification and 0.02% EER on both-ear fusion, was published in a 2014 University of Toronto thesis titled ‘Earprint’ 2014 Liu Earprint Teoae Biometrics Thesis.
- Four houses put the 2026 identity verification market at $14-16bn but diverge from 11.2% to 18.2% CAGR, changing the 2033 answer by ~2.4x; cloud is ~56% of deployment and BFSI ~32.7% of verticals (accessed 28 Jul 2026).
Open questions
- Once ISO/IEC 25456 publishes, do any of the liveness vendors that passed RIVR Phase 3 on presentation attacks also pass injection-resilience testing, or is the passing set disjoint?
- Does World’s per-verification application fee model, introduced June 2026, produce disclosed revenue that justifies Orb manufacturing and per-jurisdiction compliance cost?
- Have any ear-based results been reproduced cross-session and open-set on a verified subject count, given that the EarNet subject count could not be confirmed and the MDPI and arXiv figures were taken from indexed abstracts?
- With Google’s ZKP libraries and the EU age-verification blueprint free and open source, what layer of the human identity stack retains pricing power: capture hardware, liveness and injection detection, or nothing?
Assessment drafted 2026-08-31 from up to 16 KB sources using the technology-scorecard framework; scores are a draft read pending review.