AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Fingerprint and face login is generally safe because the phone keeps your biometric data and only releases a stored key to the app when the scan matches. The risks are anyone else enrolled on the phone, who can open the app too, and the passcode fallback, which a thief who has watched you type can use.
What actually happens when you touch the sensor
A common worry is that a bank app with fingerprint login is sending your fingerprint to the bank. In the standard design used by Android and iPhone, it is not. Your fingerprint or face data is kept by the phone, and the phone only tells the app a yes or a no: "the enrolled person is here". When you first switch on biometric login, the app stores a secret key on the phone, locked inside the phone’s security hardware. A successful scan releases that key so the app can prove to the bank that this is the device you registered.
That design has two consequences worth understanding:
- The bank never sees your fingerprint, so a breach at the bank cannot leak it.
- The phone, not the bank, decides who counts as "you". Anyone whose finger or face the phone accepts can open the app.
So the safety of biometric login is really the safety of the phone it lives on.
Who else is enrolled on your phone?
This is the question most people never ask. Phones allow several fingerprints, and some allow an alternative face. Over the years many people add a spouse’s finger, a child’s thumb so they can play games, or a colleague’s finger "just for that one day".
Every one of those enrolled prints can open any app that uses the phone’s biometric login, including your bank. Some apps notice a new fingerprint and ask for the password again, but you should not rely on that.
- Open your phone’s settings and find the fingerprint or Face ID section (on iPhone, Settings > Face ID & Passcode or Touch ID & Passcode).
- Count the fingerprints or faces stored. Delete any that are not yours.
- If you are not sure which print is which, delete them all and re-enrol only your own.
- If you share the phone with a child, see keeping children off your banking apps for a better approach than adding their finger.
The fallback is the weak point
Biometric login always has a fallback. If the scan fails, the phone or the app offers another way in: the phone’s passcode, or the app’s own passcode. That fallback is where most real-world attacks happen. The classic pattern is a thief who watches you type your phone passcode in a bus or a bar, then snatches the phone. With the passcode they can often add their own fingerprint, change settings, see saved passwords and get into apps.
Apple added a defence against exactly this. Its Stolen Device Protection, when switched on, requires Face ID or Touch ID with no passcode alternative for actions such as using saved passwords and passkeys, erasing the phone, turning off Lost Mode and opening a locked app, when the iPhone is away from familiar locations. Changing your Apple Account password, your passcode or your Face ID enrolment also requires a one-hour security delay. Apple says it needs iOS 17.3 or later, and it must be on before the phone is stolen. Details are in our iPhone settings guide; Android settings are covered in Android settings for banking apps.
Reducing fallback risk
- Use a longer phone passcode, not a four-digit one or a simple pattern.
- Make your bank app passcode different from your phone passcode.
- Never type your phone passcode in a crowded place where someone can see it; use the scan instead.
- Keep your transaction PIN separate from both, and never store it in notes on the phone.
Is biometric login safer than a PIN?
For day-to-day use, on a phone that only has your own biometrics enrolled, it usually is. A PIN can be watched over your shoulder; a fingerprint cannot. Where biometrics are weaker is coercion: someone can force your finger onto the sensor or hold the phone up to your face. That is why many Nigerian bank apps still ask for a separate transaction PIN or token to move money even after biometric login.
| Situation | Biometric login | Passcode only |
|---|---|---|
| Someone watches you log in | Nothing useful to see | They learn your passcode |
| Other people enrolled on the phone | They can open your bank app | Not affected |
| Phone stolen with passcode known | Fallback may let the thief in unless protections are on | Thief is in |
| You are forced to open the phone | Easy to force | Harder to force, though not impossible |
Some apps now also offer passkeys, which use the same biometric check to sign in without a password at all. Kuda’s help centre, for example, lists biometrics and passkeys among its security options. For the idea behind passkeys see what a passkey is.
What to check first
- Delete every fingerprint or face on the phone that is not yours.
- Set a strong phone passcode and a different app passcode.
- On iPhone, turn on Stolen Device Protection.
- Keep a separate transaction PIN or token for transfers.
- If your phone is lost, remember biometrics do not stop someone who knows your passcode: act quickly using how to log out remotely.
Where Pryme fits
Pryme separates getting into the app from moving money: transfers need your transaction PIN, and sign-in approval uses an authenticator app rather than SMS. See the security page for the current set-up.
Questions people ask
Does my bank store my fingerprint?
In the standard Android and iPhone design, no. The phone keeps your biometric data and only tells the app whether the scan matched.
Can my wife or husband open my bank app with their fingerprint?
Yes, if their fingerprint or face is enrolled on your phone. Remove any biometrics that are not yours.
Is face login safe for banking apps?
It protects against people watching you type, but it is only as safe as the phone’s passcode fallback and the list of enrolled faces. Keep a separate transaction PIN.
Can a thief use my bank app if they know my phone password?
Often, yes, because the phone passcode is the fallback. On iPhone, Stolen Device Protection removes the passcode fallback for some sensitive actions away from familiar places.
Sources
- Apple Support: About Stolen Device Protection for iPhone · accessed Oct 2026
- Kuda Help: Safety Mode · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.