FaceID does not scan a user's face. Upon enrollment, the phone illuminates your face with a grid of dots, and creates a three dimensional depth map of your fac

FaceID does not scan a user's face. Upon enrollment, the phone illuminates your face with a grid of dots, and creates a three dimensional depth map of your face from multiple angles. The results of that are stored in the secure enclave, and when an unlock is requested the device re-scans the face that is in front of it. If the two maps match "close enough" the phone is unlocked. You cannot recreate a face from the data, and the phone has no idea what you look like unless you actually look like this in real life: https://i.imgur.com/fNBiIUU.jpg https://i.imgur.com/fNBiIUU.jpg If you're worried about the very low resolution biometric map of your face being used to impersonate you, that can already be accomplished with just a couple of seconds of video, or a photograph and the only known defense against that is never venturing outside a secure perimeter into which camera lenses cannot see.