Get the newsletter
Qualcomm · Security · Filed Dec 18, 2024 · USPTO published Jun 18, 2026 · Jun 18 release

Qualcomm Patents a Double-Check System to Stop Hackers From Faking Face and Fingerprint Scans

Your fingerprint scan might be genuine — but is the data that reaches your phone's security chip actually from this moment, or could malware have slipped in a recording? Qualcomm's new patent is designed to make sure the answer is always the former.

By · Updated · 3 min read

Qualcomm Patent: Biometric Input Freshness Verification, figure from US 2026/0172256 A1
Figure from the official USPTO publication.
Publication number
US 2026/0172256 A1(US20260172256A1)
Applicant
QUALCOMM Incorporated
Filed · Published
Dec 18, 2024 · Jun 18, 2026
Inventors
Jerome PERRINE, Pierre-Francois APPIETTO
Status when we published
Examiner raised objections; the company can respond
Document
20 claims
US classification
713/186
Examiner
BINCZAK, BRANDON MICHAEL (Art Unit 2437)

What Qualcomm's biometric freshness check actually does

Imagine a security guard who checks your ID — but someone sneaks a photocopy of yesterday's ID into the stack before he gets to it. He never knows the difference. That's roughly the attack Qualcomm is trying to block with this patent.

When you press your finger on a sensor or look at a camera, your device doesn't just need to know who you are — it needs to know that the scan it's reading is fresh and unmodified, captured right now, not a stored replay. Malware can, in theory, intercept biometric data mid-flight and substitute an older approved sample.

Qualcomm's approach is to have two separate secure environments on the chip each independently generate a fingerprint of the scan data (called a hash), then compare notes. If the two fingerprints match, the data is confirmed untampered and live. If they don't, something went wrong — or someone tried to cheat the system.

How the two secure environments cross-verify the scan

The patent describes a verification scheme that runs inside the chip itself, across two isolated secure zones.

Here's the flow:

  • A sensor — fingerprint reader, camera, or similar — captures biometric data and sends it to the processor.
  • A first process running inside a Trusted Execution Environment (TEE — think of it as a walled-off area of the chip that normal apps can't touch) receives that data and generates a hash (a short mathematical fingerprint of the data; change even one byte and the hash changes completely).
  • That hash is sent to a second process in a separate Secure Execution Environment (a second, independently isolated zone), which has also independently obtained a hash of the same sensor data directly from the sensor.
  • The two zones compare hashes. A match means the data is genuine and unaltered. A mismatch flags potential tampering.

The key idea is that an attacker would need to simultaneously compromise both isolated environments to fool the system — a significantly harder task than attacking just one.

What this means for fingerprint and face unlock security

Biometric authentication is only as trustworthy as the path the data travels. As phones and laptops lean harder on fingerprints and face scans to replace passwords, the attack surface around that data becomes more valuable to hackers. A replay attack — where a stored biometric sample is injected into the authentication pipeline — is a real class of threat, and existing systems don't always guard against it at the hardware level.

Qualcomm makes the chips inside a large share of Android phones, as well as Windows laptops and IoT devices. If this verification layer lands in production silicon, it would make the biometric login you use every day meaningfully harder to spoof — without any change you'd notice on your end.

Source: US 2026/0172256 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.

Get our take in your Top Stories

Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Qualcomm patent news breaks.

Add Patentlyze on Google One click.
There are more where this came from

We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.

More from Qualcomm

All 624 Qualcomm patents →

More in Security

All 341 Security patents →