How biometric border control works

What biometric border control means

A biometric is a measurable body feature, such as a face, a fingerprint or an iris. Border agencies use biometrics to link a traveller to a document or to a record held in a database. The aim is to stop people from travelling on a passport that belongs to someone else ².

There are two kinds of check. A one-to-one check (1:1) compares a live image with one stored image, such as the photo on a passport chip. NIST describes this as verification, the same task as unlocking a phone. A one-to-many check (1:N) searches a live image against a whole gallery of stored images to find a possible match ⁸. Border systems use both. A 1:1 check confirms identity at a gate. A 1:N search can show whether a person is already enrolled under another name.

The ePassport and ICAO Doc 9303

The global rules for machine readable passports sit in ICAO Doc 9303, a document in 13 parts. Part 9 covers biometrics and electronic data storage. Part 10 sets out how data is stored on the chip. Part 11 covers security mechanisms and Part 12 covers the public key infrastructure ¹.

Under Part 9, the facial image is the mandatory biometric that every reading country can use. Fingerprints and iris are optional, and each issuing state decides whether to add them ². The data sits on a contactless chip that follows the ISO/IEC 14443 standard. The issuing state signs the data so that a receiving state can check it has not been altered ².

To check those signatures, border agencies need the issuing state's public keys. The ICAO Public Key Directory acts as a central exchange for this material. States upload their own data and download data from other states, in place of swapping it one country at a time ³. The directory covers ePassports, electronic ID cards and visible digital seals ³.

eGates and automated border control

An eGate is a self-service lane. The traveller places the passport on a reader, the gate reads the chip, and a camera takes a live photo. Software runs a 1:1 match against the chip image. If the match passes and other checks clear, the gate opens. If not, an officer takes over ^4,5.

Eligibility rules vary by country. In the UK, Border Force says eGate users need a passport with the biometric symbol on the cover. British and Irish citizens can use the gates, along with nationals of the EU, Australia, Canada, Iceland, Japan, Liechtenstein, New Zealand, Norway, Singapore, South Korea, Switzerland and the USA who hold valid immigration status. Users must be 8 or older and at least 120cm tall, and children aged 8 to 17 need an adult with them ⁴.

Some systems now skip the passport reader. From 6 October 2026, British citizens entering on a British passport can pass through eGates at participating UK airports without presenting the passport. Border Force expects other eligible nationalities from early 2027 ⁴. In the United States, CBP says its cloud matching service, the Traveler Verification Service, compares a live camera image with photo templates from travel documents. CBP says it uses facial biometrics on entry at all international airports and on exit at 55 airport locations ⁵.

Faces, fingerprints and iris

Face matching is the most common method at airports. It needs no contact and works with the photo already on the passport chip ². Fingerprints take longer to capture but give strong results for 1:N searches across large databases. The EU Entry/Exit System stores both fingerprints and facial images ¹⁰.

Iris recognition uses the pattern of the coloured ring of the eye. ICAO lists it as an optional passport biometric ². NIST runs an ongoing test programme for iris algorithms, called IREX, which covers 1:1 and 1:N matching, image quality and the long-term stability of the iris ⁹.

Accuracy and error rates

Matching systems make two kinds of error. A false non-match rejects the right person, who is then sent to an officer. A false match accepts the wrong person, which is the more serious error for security. Operators tune a threshold that trades one error against the other. NIST reports false non-match rates at fixed false match rates for this reason ⁶.

The US National Institute of Standards and Technology (NIST) tests face algorithms in its Face Recognition Technology Evaluation (FRTE), formerly the Face Recognition Vendor Test. The 1:1 track ranks algorithms on a visa and border photo set by the false non-match rate when the false match rate is set at one in a million. As of its 6 October 2026 update, NIST had received 1,483 algorithms from 455 developers between 2017 and 2026 ⁶.

Accuracy has improved fast. In a 2018 report, NIST found that the share of 1:N searches that failed to find the right person in a gallery of 26.6 million photos fell from 4 percent in 2014 to 0.2 percent in 2018. That test covered 127 algorithms from 39 developers ⁷.

Field results can differ from lab results. The US Government Accountability Office (GAO) found in 2020 that CBP's air exit system identified more than 90 percent of travellers correctly. It missed its goal of photographing 97 percent of travellers. Airlines did not photograph every passenger ¹¹.

The EU Entry/Exit System

The Entry/Exit System (EES) is an EU database that registers non-EU nationals on short stays each time they cross the external border of the 29 European countries that use it. It records name, travel document data, fingerprints, facial images and the date and place of entry and exit. It records refusals of entry as well ¹⁰.

The EES started in stages. A regulation allowing a progressive start entered into force on 26 July 2025. The Commission set 12 October 2025 as the launch date, and the system became fully operational on 10 April 2026. From that date, the EES replaces passport stamping and flags travellers who overstay ¹⁰. The EU agency eu-LISA runs the central system ¹³.

Privacy and oversight debates

Critics and regulators focus on three issues: bias, transparency and access to data. On bias, a 2019 NIST study of 189 algorithms found that many 1:1 algorithms gave false matches 10 to 100 times more often for Asian and African American faces than for Caucasian faces. The size of the gap depended on the algorithm. Some algorithms developed in Asia showed no such gap for Asian faces. NIST found that the most equitable algorithms were among the most accurate ⁸.

On transparency, GAO found in 2020 that CBP privacy notices were not always current or available, and that signs gave limited information on how to opt out. GAO later closed those recommendations as implemented after CBP updated its website and signs ¹¹.

On access, the European Data Protection Supervisor (EDPS) reviewed Europol's plan to query the EES for law enforcement. The EDPS said querying the EES is a new form of processing with high risk. It asked Europol to keep better records of proportionality tests and to explain how any matching score from eu-LISA would feed into human review ¹².