BSI warns AI can reproduce 3D fingerprints from online photo of hands

A warning from the German Federal Office for Information Security (BSI) highlights an emerging AI-assisted fraud risk  – this one focused on your hands. A post on the cyber agency’s Bluesky account, translated from German, says “attackers can use AI and a 3D printer to create fingerprint copies from photos of your hands.”

“Unlike passwords, fingerprints cannot be easily replaced. Therefore, anyone protecting sensitive access with biometrics should not rely on it as their sole security measure.”

The warning reflects a broader trend in which AI is reducing the cost and expertise required needed to reproduce biometric characteristics once considered difficult to spoof.

Nonetheless, according to the BSI, even throwing a peace sign is enough to expose fingerprint biometrics that sophisticated AI tools can reproduce using 3D printing.

A report from ISMG quotes a BSI spokesperson, who says that, “among other things, criminals can use a representation of a fingerprint to create a synthetic fingerprint that is sufficiently similar to the real one and can thus potentially unlock smartphones if those devices lack additional security measures capable of detecting such synthetic fingerprints.”

The warning does not suggest fingerprint biometrics are obsolete. Instead, it reinforces a broader industry trend toward layered authentication, combining biometrics with liveness detection, device security and additional authentication factors as AI-powered spoofing techniques become more accessible. A 2020 Cisco Talos study, for example, showed 3D-printed fingerprints could bypass biometric authentication on selected devices under test conditions.

As AI lowers the barriers to reproducing biometric traits, the challenge is shifting from preventing spoofing altogether to detecting and mitigating increasingly sophisticated attacks.

Article Topics

AI fraud  |  biometric liveness detection  |  fingerprint biometrics  |  German Federal Office for Information Security (BSI)  |  spoofing