Hadlee Simons / Android Authority
TL;DR Android’s Identity Check feature is being expanded in the upcoming Android 16 QPR2 update to better protect your sensitive apps.
The feature will now enforce biometric-only authentication for any app that uses the biometric prompt, removing the screen lock credential as a fallback.
This optional security measure will prevent thieves who know your PIN from accessing sensitive apps when you’re outside of a trusted location.
Late last year, Google announced a new feature called Identity Check. It helps protect your sensitive data by requiring biometric authentication for certain actions when your device is outside of a trusted location. For example, if someone snatches your phone and tries to access your saved passwords in Google Password Manager, Android will verify that person’s biometrics before allowing access. This prevents thieves from performing certain sensitive actions even if they know your lock screen PIN, pattern, or password. However, it doesn’t prevent those thieves from accessing certain sensitive apps that allow you to use your screen lock credentials as a fallback. That could change in Android’s big December update.
Don’t want to miss the best from Android Authority? Set us as a preferred source in Google Search to support us and make sure you never miss our latest exclusive reports, expert analysis, and much more.
Earlier today, Google rolled out the first beta of Android 16 QPR2, which is scheduled for a stable release in December. After installing the beta on my Pixel phone and navigating to Settings > Security & privacy, I found a notice at the top that said, “Identity Check is available on more apps. You can secure your identity protection on any app that offers Fingerprint or Face Unlock to identify you.”
Tapping “View details” opened a card that said, “When you use Identity Check for all apps that support Fingerprint and Face Unlock, you ensure stronger protection and a more consistent experience – without extra setup.”
Mishaal Rahman / Android Authority
This change might not make sense at first, so to understand it, I need to explain how biometric authentication currently works in Android. When an app wants to verify your identity, it can call Android’s biometric prompt API to show a system dialog that asks for your biometrics. Apps can choose what kinds of biometrics to allow when calling this API, how secure those biometrics have to be, and whether to allow your screen lock credentials (PIN, pattern, or password) as a fallback.
... continue reading