How Biometric Access Control Works: Fingerprint, Facial Recognition, Iris & Vein Technology Explained

A corporate headquarters in Gulshan used PIN-code access control for its server room. A junior IT staff member shared the PIN with a contractor "just for today." Three months later, during an internal audit, investigators discovered the contractor had accessed the server room on 14 separate occasions without authorisation — each time using the shared PIN. The access logs showed PIN entries, but PINs are not biometrics. There was no way to prove who actually used the PIN.

Biometric access control eliminates this category of vulnerability. A fingerprint, a face, an iris, or a palm vein pattern is uniquely tied to a specific individual. It cannot be shared, forgotten, loaned, or lost. When the log shows a biometric authentication, it shows exactly who opened the door.

This guide explains how each major biometric technology works technically, their accuracy characteristics, and which technology is most appropriate for Bangladesh's specific environmental conditions.

The Biometric Enrollment and Authentication Process

All biometric systems follow the same fundamental process: enrollment creates a reference template, and authentication compares a live reading against stored templates.

Step 1: Enrollment

The user presents their biometric credential (places their finger, looks at the camera, presents their eye, or places their palm) to the biometric capture device. The device captures a high-resolution image or scan of the biometric feature.

Software processes this capture to extract a mathematical representation of the biometric's unique features — called a template. The template is not the image itself but a set of mathematical feature vectors derived from the image. A fingerprint template, for example, represents the positions and orientations of specific ridge ending and bifurcation points, not the fingerprint image.

The template is encrypted and stored in the device's secure memory, a central access control server, or both. The original image is typically discarded — only the mathematical template is retained.

Step 2: Authentication

The user presents their biometric again. The device captures a new image, extracts features using the same algorithm, and compares the resulting template against stored templates.

The comparison produces a similarity score between 0 and 100%. If the score exceeds a configured threshold (typically 70–80%), the system considers it a match and grants access.

Accuracy Metrics: FAR and FRR

Two metrics define biometric system accuracy:

FAR (False Acceptance Rate): The probability that the system accepts an unauthorised person as a match. A FAR of 0.0001% means 1 in 1,000,000 authentication attempts is incorrectly accepted. Low FAR = higher security.

FRR (False Rejection Rate): The probability that the system rejects a legitimate authorised person. A FRR of 1% means 1 in 100 authorised attempts is incorrectly rejected. Low FRR = better user experience.

FAR and FRR are inversely related: lowering the matching threshold reduces FRR (more accepts) but increases FAR (more false accepts). Raising the threshold reduces FAR but increases FRR. System administrators balance these according to security requirements.

Fingerprint Recognition

How It Works

Fingerprint recognition captures and analyses the friction ridge patterns on the fingertip. Modern capacitive fingerprint sensors use an array of thousands of tiny capacitors that detect the electrical differences between ridge (higher capacitance) and valley (lower capacitance) contact points, creating a detailed digital map of the fingerprint.

The system extracts minutiae points — ridge endings, bifurcations, and ridge dots — and their spatial relationships. This mathematical representation is what is stored and compared, not the fingerprint image.

Accuracy

Bangladesh Humidity Challenge

This is a critical operational consideration for Bangladesh deployments. High ambient humidity — particularly during monsoon season (June–September) when humidity regularly exceeds 80% — causes two problems for capacitive fingerprint sensors:

Wet fingers: Workers in Bangladesh's heat frequently have sweaty or moist fingers. Moisture pools on the sensor surface, causing blurred fingerprint captures that fail to match stored templates. The result is high FRR — workers being rejected repeatedly, causing delays at shift change entry points.

Sensor degradation: Prolonged exposure to high humidity can cause capacitive sensor plates to degrade over time, particularly on lower-quality sensors.

Solutions:

• Specify optical fingerprint sensors rather than capacitive sensors for high-humidity environments. Optical sensors use light reflection rather than capacitance and are less sensitive to moisture.
• Alternatively, specify facial recognition devices for factory environments where worker hands may be wet from production processes
• ZKTeco's multispectral fingerprint sensors use multiple light wavelengths to read beneath the skin surface, significantly reducing wet-finger rejection rates
• Install fingerprint readers at heights where workers' palms face slightly downward, allowing moisture to drain before contact

Post-COVID Hygiene Considerations

Following COVID-19, contactless biometrics gained significant traction. Many organisations that previously used fingerprint readers have migrated to facial recognition or palm vein recognition to eliminate physical contact. For new installations, contactless biometric technologies are increasingly preferred by HR and health & safety teams.

Facial Recognition Access Control

How It Works

Facial recognition captures an image or 3D scan of a person's face and extracts distinctive geometric features — the distance between eyes, nose shape, jawline contour, and dozens of other reference points.

2D facial recognition: Uses a standard camera. Fast, cost-effective, and adequate for most access control applications. Vulnerable to spoofing with a printed photograph or a smartphone screen showing a face.

3D facial recognition (depth sensing): Uses infrared structured light or time-of-flight sensors to map the 3D geometry of the face. Significantly more spoof-resistant. Required for high-security applications.

Liveness Detection

Liveness detection prevents spoofing by detecting that the presented face is from a live person, not a photograph or video replay. Methods include:

• Infrared liveness detection: Infrared light reveals blood vessel patterns under the skin that are absent in photographs
• 3D depth sensing: A 2D photograph has no depth — 3D sensors detect this absence immediately
• Blink detection: Requests random eye blinks that cannot be triggered by static images
• Challenge-response: Randomly requests head turns or facial expressions

For access control applications, always specify Level 1 or Level 2 liveness detection (PAD — Presentation Attack Detection) per ISO 30107-3 standard.

Mask Detection

Post-COVID, facial recognition systems must handle masked individuals. Modern systems either:

• Identify from visible features above the mask (eyes, nose bridge, forehead) — accuracy is reduced but still viable
• Require mask removal for authentication at high-security doors
• Use an alternative modality (card tap) when masks are detected

ZKTeco SpeedFace-V5L, Hikvision DS-K1T671 series, and Dahua DHI-ASI7213X-T1 all support mask detection with configurable responses.

Throughput

Facial recognition access control is faster than fingerprint for high-throughput applications:

• ZKTeco SpeedFace-V5L: 30 faces per minute continuous throughput
• Hikvision DS-K1T671: 30 faces per minute
• Enterprise server-based systems: 60+ faces per minute

For factory shift changes where 500+ workers may arrive within 30 minutes, throughput is critical. A single facial recognition terminal at 30 faces/minute processes 900 workers per hour — adequate for most factory gate configurations.

Accuracy

Iris Recognition

How It Works

Iris recognition captures a high-resolution infrared image of the iris — the coloured ring around the pupil. The iris contains a complex, unique texture of crypts, furrows, and collarette features that remain stable throughout a person's life.

An infrared camera illuminates the eye and captures the iris pattern. The system extracts an "IrisCode" — a mathematical representation of the iris pattern — that is compared against enrolled templates.

Accuracy

Iris recognition is the most accurate biometric modality available for identification purposes:

Advantages and Limitations

Advantages:

• Highest accuracy of all biometric modalities
• Not affected by humidity, sweat, or dirty hands
• Works with glasses on (depending on system configuration)
• Template stability — iris patterns do not change with age, unlike fingerprints

Limitations:

• More expensive hardware than fingerprint or face recognition
• Requires user cooperation — must look directly at the scanner from a fixed distance
• Lower throughput than facial recognition (user must position precisely)
• Some users find iris scanning slightly uncomfortable (looking into an IR light source)

Bangladesh application: Iris recognition is appropriate for very high-security areas requiring the maximum accuracy — bank vaults, data centre secure zones, pharmaceutical manufacturing areas, and government secure facilities. Cost is the primary barrier to wider deployment.

Palm Vein Recognition

How It Works

Palm vein recognition uses near-infrared light to image the vascular pattern beneath the skin of the palm. Haemoglobin in blood absorbs near-infrared light, causing veins to appear dark against the lighter surrounding tissue.

The vascular pattern is unique to each individual, highly complex, and located beneath the skin — making it extremely difficult to counterfeit. Unlike fingerprints, the vein pattern is not exposed on the surface of the skin and cannot be lifted or copied without the living person.

Advantages for Bangladesh Banking

Palm vein recognition is particularly suited to banking and financial services in Bangladesh:

• Hygienic and contactless: The hand hovers near (not touching) the reader
• Anti-spoofing inherent: The system only reads live vascular patterns — a severed hand would not authenticate (haemoglobin must be oxygenated and flowing)
• Highly accurate: FAR comparable to iris recognition, FRR very low
• Works with all skin types and conditions: Not degraded by dry, wet, or dirty hands

Fujitsu's PalmSecure technology is deployed in banking applications globally, including in ATM authentication and teller counter employee verification. For Bangladesh banks seeking the most secure and hygienic biometric for teller counter authentication, palm vein is the premium recommendation.

PDPO 2025: Biometric Data Legal Framework

Choosing the Right Biometric for Your Application

Key Takeaways

• All biometric systems create a mathematical template from enrollment; they compare live captures against this template — the image itself is not retained
• Fingerprint: most common, most economical, but degraded by Bangladesh's high humidity and post-COVID hygiene concerns — specify optical or multispectral sensors
• Facial recognition: fastest for high-throughput deployments, contactless, requires liveness detection to prevent spoofing — dominant choice for factories and offices
• Iris recognition: most accurate biometric modality, ideal for highest-security zones — limited by cost and lower throughput
• Palm vein: hygienic, extremely secure, ideal for banking applications — growing adoption in Bangladesh financial sector
• PDPO 2025 treats biometric templates as special category personal data — encryption, consent, and deletion policies are mandatory compliance requirements

Ready to Deploy Biometric Access Control?

SSAL supplies and installs ZKTeco, Honeywell, Hikvision, and Bosch biometric access control systems across Bangladesh. Our team assesses your workforce characteristics, environmental conditions (including humidity), security requirements, and PDPO 2025 obligations to recommend the right biometric technology for each access point.

Contact SSAL for a free biometric access control consultation:

• Phone: +880 1799-986890
• Email: info@smartsafety.com.bd
• Web: www.smartsafety.com.bd
• Office: Youth Tower Level 2, 822/2 Rokeya Sarani, Dhaka-1216

Interested in comparing biometric performance in your actual environment? Request a biometric device demonstration — our team brings reference equipment to your site for hands-on evaluation of fingerprint, facial recognition, and palm vein performance under your specific conditions.