What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Criminals can misuse a face scan, but that is not the same as stealing Apple Face ID or an Android fingerprint template. In February 2024, Group-IB described GoldPickaxe malware that tricked people in Thailand and Vietnam into submitting facial scans, identity documents and SMS data. The material could then be combined with credentials and face-swapped video to attack remote bank identity checks. Group-IB said the technique could enable unauthorized banking access, while also noting it had not independently documented GoldPickaxe.iOS being used to access bank accounts in the wild.
What GoldPickaxe actually collected
Group-IB attributed GoldPickaxe.iOS and GoldPickaxe.Android to the Chinese-speaking GoldFactory crime group. Its February 2024 report described campaigns using fake government, pension and banking themes to persuade victims to install malicious software or a device-management profile. The malware targeted a package of identity and authentication data, not one universal “face password.”
- Facial photographs or prompted face-scan video.
- Photographs of identity documents.
- Phone numbers and associated account details.
- SMS messages, potentially including one-time codes.
- Banking credentials or session information, depending on the variant.
- Device access and permissions, particularly on Android.
Group-IB reported an earlier iOS distribution route involving TestFlight and later campaigns that persuaded victims to install an MDM profile. These are campaign-specific findings, not evidence that every TestFlight app or iPhone profile is malicious. See the original report at Group-IB’s GoldFactory analysis.
The campaign’s reported focus was Thailand and Vietnam. Group-IB also described a Vietnamese victim whose losses were reported as more than US$40,000; that figure is an attributed report, not independently audited loss data. Its accompanying release said police had confirmed criminals installing banking apps on their own Android devices and using captured face scans to pass facial checks, but Group-IB had not observed documented in-the-wild bank access by GoldPickaxe.iOS itself. Read that qualification in Group-IB’s release.
#1 Best Overall
- [Secure Your Home with Smart Door Lock] Our upgraded fingerprint door lock offers easy unlocking options using your unique fingerprint or APP to your home. This smart door Knob provides the option of using mechanical keys for entry, offering added peace of mind in case of emergencies.
- [3-In- 1 Keyless Entry Door Lock for Bedroom] The smart lock for bedroom offers various operating modes to suit your needs, now with upgraded convenience in mode selection. Switch the thumbprint door knob’s convenience of Passage Mode, the standard operation of Normal Mode(5s auto lock), the fingerprint door knob’s privacy of Privacy Mode, or the quietness of Silent Mode, you can easily customize the lock settings by rotating the thumb turn to match your smart home lifestyle. This smart door knob is not suitable for doors with weather strips installed.
- [Convenient App Control of finger print door knobs] Easily set fingerprints, check access records, and share or add access with family members in the APP. App Control should be within Bluetooth Range. If you want remote control of the smart door lock, you need to purchase a gateway separately.
- [No-Concerns Smart Door knob] The smart lock for bedroom doors adds an extra layer of security to your home. Whether you're looking for a door knob with lock for your apartment or a smart home device to keep your home secure, our upgraded fingerprint door lock has what you need. The bedroom door lock is built in a rechargeable battery with a 1-year battery life that can be charged by a USB Type-C power supply. Simply enable low battery notifications in the app. You will then receive alerts when unlocking your interior door knobs via the app while the battery is below 20%.
- [Easy to Install & Last to use] Featuring easy installation, this smart door lock is also a reliable choice not only for homes but also for Airbnb, or apartments. The fingerprint lock installs easily with a screwdriver, and the biometric door lock is ideal for anyone who desires privacy. Tips: When install interior knob, both Exterior and Interior Knobs have to be inserted according to the 'UP' sign on the top so that they can stay in place. And the spindle bar is in the vertical position. The thumb turn adjustment arrow points to the center dot and the 'UP' sign, then the arrow is inserted upward on the mounting, you can use a little force to get the rear lock completely in.
How the fraud chain works
- Impersonation: A caller, text or website poses as a bank, government service, pension program or support desk.
- Malicious installation: The victim is directed to an app, sideloaded package, TestFlight app or device-management profile.
- Permission escalation: The victim grants access to SMS, accessibility, notifications, screen activity or device management.
- Identity collection: The fake workflow requests an identity document, phone number and guided facial scan.
- Credential interception: Malware or a fake login may capture passwords, banking screens and incoming codes.
- Synthetic-media creation: The collected facial material can be used to make a face-swap video or another spoof.
- Remote verification: Criminals try to sign in, enroll a device or pass a bank’s facial KYC or transaction check from another device.
- Fraud execution: If layered controls fail, they may alter account settings, add beneficiaries or move money.
Group-IB also described fake alerts, fake call screens, accessibility-based keylogging and operator assistance. The defensive lesson is that social engineering is the entry point; the biometric material is one component of a broader account-takeover attempt.
A face scan is not the same as Face ID
These terms describe different things:
| Term | Meaning | What an attacker may obtain |
|---|---|---|
| Faceprint or template | A mathematical representation used by a biometric system. | Not necessarily exported from a phone or bank system. |
| Face photograph | A normal still image. | Potential material for identity fraud or a presentation attack. |
| Liveness video | A sequence such as blinking, smiling or turning the head. | Material that may be manipulated or replayed against a remote verifier. |
| Synthetic face or deepfake | Attacker-generated imagery intended to resemble the victim. | A presentation artifact, not the victim’s original biometric credential. |
On many consumer devices, biometric matching happens locally in protected hardware or an operating-system security environment. A malicious app that asks you to look at the camera is generally collecting an image or video; it is not automatically extracting the Face ID or fingerprint template that unlocks the phone. NIST discusses photographs and other biometric material as potential attack inputs in its digital identity guidance.
What is a biometric presentation attack?
A presentation attack presents an artifact or manipulated sample to fool a recognition system. Examples include a printed photograph, a screen replay, a mask, a face-swap video, a morphed identity document or injected camera data. Presentation-attack detection (PAD) is designed to identify such attempts; it is a control, not a guarantee. NIST explains PAD and related safeguards in its biometrics overview and digital-identity FAQ.
Rank #2
- Connect to 2.4GHz WiFi, No Hub Needed：Connect your Philips 4200 Series Wifi Door Lock Deadbolt directly to your home WiFi network—no extra hub or bridge required. Manage your door anytime, anywhere through your smartphone. 𝙉𝙊𝙏𝙀: Please keep the smart lock within 33 ft (10 m) of your Wi-Fi router. Minimize obstacles such as walls, metal objects, and interference sources for a stronger connection.
- App Control with Real-Time Access：Control smart lock remotely via the Philips Home Access App: lock/unlock, manage user codes/fingerprints, check your door lock status, and monitor access history in real time, etc, whether you’re at work or on vacation.
- Voice Assistant Compatible：Hands full? No problem. Use voice commands with Alexa or Google Assistant to lock or check the status of your front door lock set effortlessly.
- Versatile Passcode Options: This Keypad deadbolt supports permanent, one-time, periodic, and recurring PIN codes—perfect for family, guests, housekeepers, or Airbnb use. Easily manage and share access through the app for ultimate convenience and control.
- 0.3S Fingerprint Fast Access：With this fingerprint keyless entry door lock, unlock your door in 0.3 seconds with fast, secure biometric access. Store multiple fingerprints for family and trusted visitors.
Local phone unlock versus remote bank verification
Local phone unlock
The phone checks the biometric locally and releases a key or protected function. An ordinary selfie normally cannot unlock a properly protected iPhone or Android device. An attacker may still target the device passcode, account recovery, malware or a newly enrolled device.
Remote selfie or KYC check
A bank or identity service receives a face image, video or live camera session. It must defend against replay, synthetic media, camera injection, stolen IDs and account-takeover signals. GoldPickaxe primarily concerns this second category.
Passkeys
A biometric can simply unlock a passkey stored on a device or passkey provider. The service receives cryptographic proof rather than a face image. NIST describes correctly implemented passkeys as phishing-resistant, while noting that enrollment, recovery, endpoint compromise and fallback flows still matter. See NIST’s passkey explanation.
Rank #3
- [Unlock Your Door with 6-In-1 Versatility] Experience unparalleled convenience and security with our state-of-the-art keyless entry door lock. Offering an impressive array of unlocking options, including fingerprint recognition, Bluetooth-enabled mobile app control, personalized passcodes, key fobs, mechanical keys, and even Alexa voice unlock and remote control lock (Requires a separately sold WiFi gateway). Enjoy the freedom to choose the unlocking method that best suits your needs and preferences.
- [Quick and Effortless Installation] Say goodbye to complicated installations and time-consuming setups. Our smart lock is designed for hassle-free installation, taking just 10 minutes to fit most standard American wooden front doors. Simply replace the existing handle, knob, or deadbolt using a screwdriver, without the need for any additional drilling. What's more, the reversible handle ensures compatibility with both left and right-handed doors.
- [Convenient Access Management via the App] Take complete control of access management with our intuitive mobile app. Grant permanent or temporary unlock access to your family members, remotely generate one-time passcodes for visitors, and effortlessly keep track of unlock records—all from the convenience of your smartphone. Stay connected and informed, even when you're away from home.
- [Ideal for Landlords and Property Managers] Streamline your management tasks with ease and efficiency. Our smart lock solution is tailored for landlords with multiple properties, making it an ideal choice for Airbnb hosts, short-term rental managers, apartment supervisors, and self-housing residents. Manage and monitor a large number of smart locks seamlessly through a single app, providing a cost-effective and convenient solution.
Why biometrics help—and where they fail
Biometrics are quick and difficult to share accidentally through ordinary phishing. A face or fingerprint is also difficult for a person to replace after exposure. But biometrics are only one input in a decision that may include device binding, credentials, location, behavioral signals, identity documents, SMS or email, liveness checks, transaction limits and manual review. A stolen image may work in one weak remote workflow and fail in another; it does not automatically unlock every account.
Passwords remain changeable but are frequently stolen through phishing, malware and reuse. Password managers help generate unique passwords. Passkeys can reduce phishing risk where a bank supports them, but neither technology eliminates account-recovery fraud, device theft or social engineering.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow serious is the threat for U.S. consumers?
GoldPickaxe is a credible, technically significant fraud technique, not proof of a mass U.S. banking epidemic. The cited 2024 evidence concerned campaigns concentrated in Thailand and Vietnam and financial services that used facial verification. Group-IB’s current threat profile continues to track GoldFactory, but claims about present U.S. prevalence or global victim counts require separate evidence. Geography, a bank’s capture method, transaction controls and device-enrollment rules determine whether this exact attack is practical.
Rank #4
- More Secure：The lock is made of aluminum as a material with high hardness and corrosion resistance, which can effectively prevent others from damaging the door lock from the outside and further ensure your home security.
- Easy to Use: This lock is compatible with most American standard doors and can be easily installed with just a screwdriver. It also comes with a simple app that allows you to enjoy a smart life by programming the lock effortlessly.
- Full App Control: Connect via Bluetooth, the lock can store 50 passwords and fingerprints and key fobs,and with a Wi-Fi gateway (sold separately),you can control the lock remotely anytime,anywhere.
- Unlock and Lock: 5-in-1 ways to unlock include APP, Password, Key Fob, Fingerprint, and Key. 3-in-1 ways to lock include Auto Lock, APP Lock, Long press the "√ "button to lock.
- Satisfactory Service: With a 30-day money-back guarantee, 1-year product coverage, and lifetime after-sales support, if you have any questions, please feel free to contact us, and we'll respond promptly.
What to do after a suspicious face scan
If you clicked a message but installed nothing
- Stop communicating through the message and do not use its phone number or link.
- Contact the bank through the number on your card, a statement or its known website.
- Change any password entered into the page, and change it anywhere else it was reused.
If you installed an app or profile
- From a clean device, tell the bank that a potentially malicious app or MDM profile was installed.
- Ask the bank to review logins, transfers, new-device enrollments, profile changes and beneficiaries; request restrictions or enhanced monitoring.
- On iPhone, inspect Settings → General → VPN & Device Management for an unfamiliar profile. On Android, review installed apps, accessibility, device-admin, notification access and permission to install unknown apps. Labels vary by version and manufacturer.
- Preserve evidence if the bank or law enforcement may need it. After consultation, back up essential data and consider a factory reset if compromise is suspected.
If you submitted an ID and face scan
- Tell the bank specifically that facial data, identity documents and possibly SMS messages were exposed.
- Change banking and email passwords, revoke unfamiliar sessions and devices, and replace exposed recovery details.
- Ask whether SMS authentication can be replaced with a passkey, security key or authenticator supported by the bank.
- Consider a U.S. credit freeze or fraud alert when identity documents or Social Security information were exposed, and use IdentityTheft.gov for current federal reporting guidance.
If money or account settings changed
- Call the bank’s fraud department immediately through a verified channel and request an urgent recall or hold where available.
- Document dates, messages, app names, profile changes and transaction references.
- Report the incident to the relevant platform and law-enforcement channel.
Deleting an app or changing a password does not reverse a fraudulent transfer, revoke a stolen identity document or undo a new beneficiary. Those actions require separate bank and identity-response steps.
How to reduce the risk
- Install apps through official stores, while remembering that official distribution is safer, not an absolute guarantee.
- Never install an app or device profile because an unsolicited caller, text or pop-up demands it.
- Treat an unexpected request for both an ID document and face scan as high risk; independently open the known bank app or call the bank.
- Review accessibility, SMS, notification, screen-recording and device-management permissions.
- Keep the operating system and banking app updated and enable login and transaction alerts.
- Use a unique banking password and never disclose a one-time code to a caller.
- Prefer passkeys or hardware-backed authenticators where the bank supports them.
- Keep financial recovery email separate and strongly protected.
What banks and identity providers should add
Selfie matching alone is not an adequate fraud strategy. Stronger programs combine PAD and deepfake detection with trusted capture, camera-injection defenses, device and session intelligence, behavioral anomaly detection, rate limits, transaction risk scoring, independent confirmation for high-value transfers, rapid device revocation, data minimization and manual escalation for unusual KYC events. Even effective liveness checks must sit inside those layered controls.
Bottom line
A stolen face scan is not an instant universal key and does not prove that Face ID or a fingerprint template was extracted. It becomes dangerous when combined with an identity document, SMS access, malware, account credentials and weak remote-verification or recovery controls. If you supplied that package to an unsolicited app or caller, treat it as an account-security and identity incident now—not as a harmless selfie.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
