Interview frequency: …
Short answer
Make biometrics an optional convenience rather than a complete replacement for a password, and provide an intuitive, immediate fallback to enter a PIN or password if face or fingerprint recognition fails.
Explanation
Biometrics fail in many everyday situations: wearing a mask, low light, wet hands, or holding the phone at an angle on a desk. A smooth design should attempt recognition automatically with an immediate "Enter passcode" button. When enabling a sensitive feature (such as making the first money transfer after changing phones), require the primary password to strengthen security and verify the account owner.
Common mistakes
- Blocking users or locking an account after one failed biometric attempt without immediately allowing password entry.
- Enabling fingerprint or face authentication automatically without user consent or an explanation of how to disable it in settings.