EVERY time Malaysians flash a peace sign for a selfie, pose for a group photo or upload a picture to Instagram, they are putting more of themselves online than they might realise.
The question is whether that digital trail is enough for criminals to reconstruct something as personal as your face or your fingerprints.
Can criminals really use AI to steal your face and fingerprints from photos you post online?
Verdict:
TRUE, BUT...
Let's start with the good news: nobody is sitting in a dark room harvesting the fingerprints of random Malaysians from their selfies.
The concern gained traction after researchers at Japan's National Institute of Informatics demonstrated that usable fingerprints could be extracted from ordinary photos of exposed fingers taken from up to 3m away using standard smartphone cameras.
The finding alarmed people who habitually flash the two-finger peace sign in selfies, a wildly popular pose across Asia that inadvertently exposes fingertip ridge patterns to anyone with the right tools and enough patience.
So what could a criminal actually do with a stolen fingerprint?
Fingerprints are increasingly used as authentication for smartphones, banking apps and secure facilities. A successfully cloned print could theoretically be used to unlock a victim's phone, authorise financial transactions or bypass fingerprint-based security systems. Unlike a password, a fingerprint cannot be changed once compromised, meaning the risk to a victim is permanent.
The process of exploiting a stolen fingerprint is more involved than it sounds, however.
A criminal would first need a high-resolution image where the fingertips are clearly visible and facing the camera directly.
The image would then need to go through significant digital enhancement to isolate and sharpen the ridge patterns.
The extracted print would then need to be physically replicated, typically using materials such as gelatin or silicone, to produce a usable fake finger capable of fooling a sensor.
Justin Cappos, a cybersecurity professor at New York University whose research has been adopted by companies including Google, put the actual risk in plain terms.
The average person has a better chance of being hit by a car than having their fingerprints lifted from a social media photo in their lifetime, he said.
Vyas Sekar, an electrical and computer engineering professor at Carnegie Mellon University, described the scenario as the stuff of spy novels, noting that in theory it is possible, especially if people are posting high-resolution images.
It has already happened in high-profile cases.
In 2014, a hacker reportedly cloned the fingerprint of a senior European official using close-up photos taken at a press conference.
That same year, security researchers at cryptocurrency exchange Kraken successfully constructed a fingerprint from a photograph of one marked on a surface.
However, these were targeted attacks on specific, high-value individuals, not mass harvesting operations aimed at ordinary people.
A 2025 peer-reviewed paper published in Uganda's Mbarara University journal examined the technical feasibility of extracting fingerprint information from publicly shared social media photos and concluded that while the risk exists, the barriers to successfully exploiting it remain significant for most users.
The paper recommended raising public awareness and proposed measures including encouraging people to avoid exposing their fingertips directly to the camera in photos posted online.
For most Malaysians, cybersecurity experts agree that more common and immediate threats such as phishing, account takeovers and AI voice cloning scams pose a far greater day-to-day risk than fingerprint theft from selfies.
That said, a few simple habits can reduce exposure. Avoiding close-up shots where fingertips face the camera directly lowers the quality of any image a bad actor might attempt to work with.
Restricting who can see your photos on social media also reduces the pool of images available to anyone with malicious intent.
And if your phone or banking app offers alternative authentication methods alongside fingerprint access, using more than one layer of security means a cloned print alone is not enough to get in.
Source: quickcheck-can-criminals-use-ai-to-steal-your-fingerprints-from-your-online-photos
Disclaimer
The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official stance of Kritik.com.my. As an open platform, we welcome diverse perspectives, but the accuracy and integrity of contributed content remain the responsibility of the individual writer. Readers are encouraged to critically evaluate the information presented.