能否通过应用程序化添加指纹？银行类APP专属指纹登录需求

Hey there! Since you're building a banking app, security is non-negotiable, so let's dive into your questions clearly:

Can you add fingerprints directly from your app and restrict login to only specified users? #

Short answer: No, you can’t directly add fingerprints to the system’s biometric database via a third-party app, and you can’t restrict system-level fingerprint authentication to specific users/fingerprints either.

Here’s why: Both Android (via BiometricPrompt) and iOS (via LocalAuthentication) design their biometric APIs to keep sensitive fingerprint data isolated in the system’s secure hardware/keystore. Third-party apps don’t get access to raw fingerprint data, nor can they modify the system’s registered fingerprint list. When your app uses these APIs, all it gets is a "success" or "failure" signal—you can’t tell which specific fingerprint was used to authenticate. That’s why right now, any fingerprint registered on the device can log into your app.

What are alternative approaches to achieve your goal? #

If you want to restrict login to only your app’s registered users (not all device fingerprint owners), here are two feasible paths:

1. Bind system biometric authentication to a specific app account #

This leverages the system’s secure biometric stack while tying it to your user’s account:

• First, require the user to log in with a strong authentication method (password, OTP, hardware token) to verify their identity.
• Once logged in, let them enable "fingerprint login" for their account. At this step, trigger a system biometric prompt (BiometricPrompt/LocalAuthentication). If authentication succeeds, store an encrypted token (tied to their account ID) in your app’s secure storage (Android Keystore, iOS Keychain).
• On subsequent login attempts: Trigger the system biometric prompt first. If it succeeds, retrieve and decrypt the stored token to auto-log the user into their bound account.

Note: This approach still allows any device-registered fingerprint to log into the bound account. To mitigate this, you can add extra layers like device binding (only allow login from registered devices) or require periodic re-authentication with a password/OTP.

2. Build a custom fingerprint storage system (not recommended for banking apps) #

You could technically capture fingerprint data via specialized hardware SDKs (if your target devices allow it), encrypt the fingerprint template, and store it in your app’s secure storage tied to the user’s account. Then, during login, you scan the fingerprint and compare it against the stored template.

But: This is extremely risky for banking apps. Handling raw fingerprint data exposes you to massive compliance and security risks—you’d need to meet strict regulatory requirements (like GDPR, PCI DSS) for storing biometric data, and any breach could lead to catastrophic user harm. Additionally, your custom implementation is unlikely to match the security level of system-provided biometric stacks, which are hardened against attacks.

Is this approach secure for a banking app? #

It depends on the path you choose:

• System biometric + account binding: This is the most secure and compliant option. System biometric APIs are built with hardware-level security (e.g., Android’s StrongBox, iOS’s Secure Enclave) that prevents fingerprint data from being exposed to apps or malware. The only caveat is the inability to distinguish between device fingerprints, but you can mitigate this with additional security layers (device binding, periodic re-authentication).
• Custom fingerprint storage: This is not recommended. The risks of handling and storing biometric data far outweigh the benefits, especially for a regulated industry like banking. You’d be taking on the responsibility of securing highly sensitive data, which is best left to the operating system’s dedicated security systems.

As a final note, always consult your app’s compliance team and follow industry standards (like FFIEC guidelines for financial apps) to ensure your implementation meets all security and regulatory requirements.

内容的提问来源于stack exchange，提问作者Sushant Gosavi