Quick answer: Yes, biometric access control is still secure in the age of AI, if the device has proper liveness detection and you use it the right way. AI makes three kinds of attack easier: fake faces or fingers held up to the reader, deepfake video injected into a camera feed, and theft of stored biometric data. A wall-mounted terminal with its own camera and anti-spoofing, such as the ZKTeco SpeedFace M4, blocks printed photos, video replays and 3D masks. Add a card or PIN for sensitive rooms, encrypt and protect stored templates, and in Saudi Arabia treat biometric data as sensitive personal data under the PDPL.
The three ways AI attacks biometric systems
| Attack | How it works | Most at risk | Main defence |
|---|---|---|---|
| Presentation attack | A fake held up to the reader: printed photo, video on a phone, 3D mask, silicone fingerprint. AI makes these fakes more realistic. | Basic readers without liveness detection | Liveness detection (anti-spoofing) on the device |
| Injection attack | A deepfake video fed straight into the camera stream, bypassing the lens | Phone and web selfie checks, remote onboarding | Hardware with a built-in camera; tamper alarms |
| Data theft | Stolen biometric templates from a server or device | Poorly secured databases | Encrypted templates, access control on the software, minimal retention |
Why a wall terminal is harder to deepfake than a phone
Most deepfake headlines are about remote identity checks: a selfie video sent from a phone or laptop, where an attacker can feed fake video into the software. A wall-mounted access terminal is different. Its camera is built into the device, so an attacker cannot simply swap the video feed; they have to stand in front of it with a physical fake, which is exactly what liveness detection is designed to catch. To inject video, they would need to open and tamper with the terminal itself, which triggers tamper alarms and is visible on CCTV.
Liveness detection: what to ask for
Liveness detection, also called presentation attack detection (PAD), checks that a real, live person is at the reader rather than a photo, screen, mask or fake finger. Good terminals combine several checks, such as dual cameras, depth or infrared imaging, and algorithms trained on spoof attempts.
When comparing devices, ask:
- Which attacks does it block? Look for printed photos, video replay and 3D masks for face; fake fingers for fingerprint. ZKTeco states the SpeedFace M4’s anti-spoofing algorithm covers print (laser, colour and black-and-white photos), video and 3D mask attacks.
- Has it been tested to ISO/IEC 30107-3? This is the international standard for testing presentation attack detection. Ask the supplier for any independent test results.
- Can I combine factors? Face plus card, face plus PIN or face plus fingerprint for higher-risk doors.
Match the security level to the door
| Area | Recommended setup | Finloyd device |
|---|---|---|
| Office entrance, time attendance | Face recognition with liveness | SpeedFace M4 or MA100 |
| Server room, cash room, records room | Two factors: face plus card or PIN, or face plus fingerprint | SenseFace 4 (face and in-glass fingerprint) |
| Outdoor gate or site entrance | Weatherproof terminal with liveness and video intercom | ZKTeco F35 (IP65) or SpeedFace M4 (IP66) |
| Vault room or bank strong room | Two factors at the door plus CCTV and a time-delay lock on the vault | SenseFace 4 with smart cards; see our vault room guide |
For card factors, use secure smart cards such as MIFARE DESFire rather than older proximity cards that are easy to clone.
Protecting the data: Saudi PDPL
A password can be changed after a breach; a face or fingerprint cannot. That is why Saudi Arabia’s Personal Data Protection Law (PDPL) treats biometric data as sensitive personal data. The law came into force on 14 September 2023, with full enforcement from 14 September 2024, and is overseen by the Saudi Data & AI Authority (SDAIA). In practice, for an access control or attendance system that means:
- Explicit consent: tell staff what biometric data you collect and why, and get their explicit consent.
- Purpose limits: use it for access and attendance only; sensitive data may not be used for marketing.
- Storage: store templates rather than photos where possible, encrypt them, and limit who can see them in the software.
- Retention: delete a person’s biometric data when they leave.
- Registration: check whether your organisation must register with SDAIA as a controller of sensitive data.
This is general information, not legal advice; confirm your obligations with a legal adviser.
Six habits that keep biometric access secure
- Turn on liveness detection and never disable it to “speed things up”.
- Use two factors on high-risk doors.
- Update firmware on terminals and the management software.
- Restrict software access to the people who need it, with their own logins.
- Review access logs in BioTime or your access software for unusual patterns, such as late-night attempts on restricted doors.
- Put CCTV on key doors so any attempt at a terminal is recorded.
Supply and installation in Saudi Arabia
Finloyd has supplied access control and time attendance systems in Saudi Arabia since 2008. Our teams in Riyadh, Jeddah and Al Khobar survey your site, recommend the right security level for each door, install ZKTeco terminals and software, and train your administrators. See all access control and time attendance devices.
Frequently asked questions
Can a deepfake fool face recognition access control?
A wall terminal with a built-in camera and liveness detection is very hard to fool with a deepfake: the attacker must present a physical fake, which liveness detection is designed to catch. Deepfakes are a bigger risk for phone and web selfie checks.
Can a photo or video unlock a face recognition terminal?
Not one with proper liveness detection. The ZKTeco SpeedFace M4, for example, is designed to block printed photos, video replays and 3D masks.
What is liveness detection?
A check that a real, live person is at the reader, not a photo, screen, mask or fake finger. It is also called presentation attack detection (PAD) and is tested under ISO/IEC 30107-3.
Is face recognition more secure than fingerprint?
Both are secure with good liveness detection. Face is touchless and faster; fingerprint works well indoors. For high-risk doors, combining two factors is more secure than choosing one.
Is biometric data protected by law in Saudi Arabia?
Yes. Under the PDPL, biometric data is sensitive personal data. Organisations generally need explicit consent, must protect it, and may not use it for marketing. SDAIA enforces the law.
What happens if biometric data is stolen?
You cannot change a face or fingerprint, so prevention matters: store encrypted templates rather than images, restrict access, delete data when staff leave, and use two factors so a stolen template alone cannot open a door.
Is biometric access control better than cards?
Cards can be lent or cloned; biometrics are tied to the person. The strongest option for sensitive areas is both together.
Where can I buy biometric access control in Saudi Arabia?
Finloyd supplies and installs ZKTeco face, palm and fingerprint terminals from Riyadh, Jeddah and Al Khobar. Call Jeddah +966 50 844 0075, Riyadh +966 50 003 2928 or Al Khobar +966 55 721 2191.
Reviewing your access control? Tell us how many doors you have and which are sensitive, and we will recommend the right setup for each.
