> convincing them to participate in your nefarious scheme seems non-trivial Actually this would be the easiest part. E.g. A courier knocks a random persons doo

> convincing them to participate in your nefarious scheme seems non-trivial Actually this would be the easiest part. E.g. A courier knocks a random persons door and says please sign here and shoves a clipboard in their face (that happens to have a faceid-sized hole in the metal frame) then hands them a random package. Done. No convincing needed, worst case they're confused for a day about why they signed for whatever you put in the box and who sent it and then they forget about it altogether. You're right about the 7000, except it's likely that a large fraction of that 7000 lives geographically close to you as most family does. I agree that this will take more sophistication than what a common criminal could pull off, but this opens up a wide range between that and state intelligence agency that could try compared to TouchId. I would like to see a security review with more details about how common false positives are given that you only try lookalikes.