Test shows that Android phones like LG G7 ThinQ, OnePlus 6, and Samsung Galaxy S9 and Note 8 can be unlocked via facial recognition using 3D-printed head models
Context & Ripple Effects
This test extends a documented lineage of smartphone biometric bypasses. Fingerprint sensors fell first: Michigan State researchers unlocked a Galaxy S6 and Huawei Honor 7 with inkjet-printed fingerprints, and police later used fingerprints reconstructed from 2D photos to open a Galaxy S6. On the face side, Samsung's Galaxy S8 was already shown to be foolable with a flat photo, prompting Samsung itself to recommend fingerprint or iris scanning instead.
What changes here is scale and fidelity: Forbes' Thomas Brewster defeated face unlock on four current Android flagships — LG G7 ThinQ, OnePlus 6, Galaxy S9, Note 8 — using 3D-printed head models, not photos. That matters because Samsung had been building toward facial-recognition authorization for Samsung Pay, which would put payments behind a mechanism this test defeats.
First-order effects
- Owners of the LG G7 ThinQ, OnePlus 6, Galaxy S9, and Note 8 who rely on face unlock now have a demonstrated low-cost bypass against their devices, making fingerprint or PIN the practical fallback.
- Samsung's roadmap of extending face recognition from unlocking into Samsung Pay authorization is directly undercut — a payment flow spoofable with a printed head model is a liability, not a feature.
Second-order effects
- Android vendors are pushed toward hardware depth-sensing and liveness detection for face unlock, since camera-only matching has now failed twice publicly — first on the Galaxy S8 with a photo, now on four flagships with printed models.
- Google's later move to pay people $5 for face scans to improve unlock accuracy ($5 face-scanning field research) reads as the data-collection side of the same arms race: closing the gap these spoofs expose requires more training data, which carries its own privacy cost.
Third-order effects
- The recurring pattern — inkjet fingerprints, photo-reconstructed prints, photo-fooled face unlock, now 3D-printed heads — points to consumer biometrics settling into a role as a convenience layer rather than a security boundary, with secure hardware and PINs remaining the actual trust anchor.
- If vendors keep shipping weak face unlock anyway because it demos well, pressure will grow for independent testing and disclosure norms around biometric claims, similar to how fingerprint bypasses moved from academic papers to police-use tooling.
The trend: Smartphone biometric authentication is locked in an escalating spoof-and-patch cycle, pushing the industry from camera-only face matching toward hardware-backed liveness detection.