--- title: "Biometric Authentication" description: "Helix ties a real person to an account with two seconds of speech. The check runs on the device, so no audio, template or PII reaches your servers." source: "/biometric-authentication" updated: "2026-11-02" --- Biometric Authentication # Bind accounts to real people. Helix uses the human voice to tie a real person to an account in about four seconds. Zero biometric data leaves the device which means zero compliance overhead. The problem ## Authentication is broken for the AI era. Login factors prove strings, numbers, or devices, not people. Passwords ### The password is not a weak factor. It is the attack surface. Catches synthetic and deepfake voices instantly, so you know a real person is on the other end. SMS one-time codes ### A code proves a number, and numbers change hands The FBI logged more than $68 million in SIM-swap losses in 2021, the year one-time codes were delivered to the attacker's phone instead of your user's. The code still arrived. It just wasn't your user reading it. MFA itself ### MFA security can be bypassed for the right price Barracuda found MFA bypass in 48% of the phishing attacks it tracked through 2025. The bypass is off the shelf: the number of known phishing kits doubled over the year, and 90% of high-volume campaigns ran on a kit somebody else built and sold. The problem ## Attackers rent devices. They cannot rent people. Every factor in a normal login stack proves something other than a person. A password proves a string. An SMS code proves a number. A passkey proves a device. ### Attacker Cost Today - **$0.08** a phone-verified Meta, Grindr or Shopify account - **$0.10** an X or Instagram account - **$0.10** an SMS verification in the UK. Twenty-six cents in the US. Cambridge researchers spent a year pricing this market. Devices go by the hour, residential proxies by the gigabyte, eSIMs and numbers by the unit. All rented, all disposable, all running at the same time. ### With - **One live human** speaking, at the moment of the action - **Recruited and paid** and awake when the challenge fires - **Spent once** the same voice collides on the next signup There is no bulk rate on people. A thousand accounts stops being a budget line and becomes a thousand recruited humans, each one a payment trail, a working hour, and a hard ceiling on throughput. ### The point **The goal is not an impossible attack. It is a slow, expensive one.** Fraud at scale works because the next fake account costs a few cents and takes no time. Put a human in the loop and both numbers move. Most abuse economics do not survive that. How it works ## Two seconds of speech. The user reads a short phrase. The SDK builds the voice template on the phone, matches it in the secure enclave, and hands your server one signed verdict without audio or PII. Why on-device matters ### Server-side biometrics are a liability. Server-side biometrics are a liability. Facebook paid $650 million to settle one biometric privacy class action. Helix keeps the data on the user's device, so you never hold it. ### How it works #### Capture a short phrase, about two seconds, on any device with a microphone #### Verify Template computed and matched in the device's secure hardware, never uploaded. #### Prove your server gets one signed verdict and a stable identity handle - Passive liveness rejects replays and synthetic voices - No audio uploaded, no template uploaded, no voice data retained — not by us either - No selfies, ID uploads, or cameras required. - Open proof format — audit any verification Cross-account enforcement ## One person. One account. ### Strict mode One human, one account Best for signup: a server-side voiceprint hash stops the same human enrolling twice. ### Soft signal Collision detection Best for transactions and trust scoring: flags a match against an existing identity and lets you block, review, or just log it. ### Device only. Pure on-device mode Default everywhere else: binding, liveness, and signed proofs, nothing stored — no new disclosure, but it can't flag a repeat human. ### Full Disclosure **Strict and soft modes store a hashed voiceprint vector server-side.** That triggers disclosure obligations under BIPA, GDPR special-category rules, and similar regimes — your privacy notice and consent flow need to cover it. We give you the controls; you decide where the tradeoff is worth it. Integration ## Three lines. Bound. Bind a user in under 5 minutes. [Get the SDK](https://docs.helix.id/browser-sdk) Your server signs each start with @helix-id/node. `biometric-sdk.js` Drop the tag on any page ```js ``` Enroll once at signup ```js Helix.open({ startUrl: "/helix/enroll", onSuccess: saveUser }); ``` Verify on any high-risk surface ```js Helix.open({ startUrl: "/helix/verify", onSuccess: grant }); ``` ## Bind your users. End takeover. We'll integrate Biometric Authentication into your highest-risk flow in under a week. No PII touches your servers. No passwords to lose. The Helix stack ## Also available within a single integration. Three products, one SDK. Add Synthetic Detection and Age Assurance on the same tag you dropped for MFA. Synthetic Detection ### [Stop bots](https://helix.id/synthetic-detection) A voice check that tells real people from AI. Catches 99.6% of AI-generated voices from the newest voice engines. Age Assurance ### [Confirm age](https://helix.id/age-assurance) Comply with global age-gating laws without storing IDs or handing users to a third-party check.