Android 16 Identity Check: How to Require Biometrics for High-Risk App Settings

Android’s Identity Check adds biometric protection to sensitive settings, account changes and compatible app authentication. When the phone is outside a saved trusted place, protected actions require a supported strong biometric instead of the device PIN, pattern or password.

Identity Check is optional and availability depends on the phone, manufacturer and software version. It first appeared on supported Pixel phones running Android 15 and eligible Samsung Galaxy devices with One UI 7. Google is extending it to supported devices upgraded to Android 16, but installing Android 16 does not guarantee that the feature will appear.

What Identity Check Protects

Identity Check is intended to stop someone who knows or has observed the device PIN from changing important security or account settings. Protected actions can include:

Changing the screen lock or enrolled biometrics
Running a factory reset
Turning off Identity Check or other theft-protection features
Viewing or changing trusted places
Adding or removing a Google Account
Opening Developer options
Accessing saved passwords and passkeys
Using Google Password Manager autofill in apps
Setting up a new device with the current device
Changing a Google Account password or recovery factors on the device
Using Google or third-party apps that rely on Android’s system Biometric Prompt

Some areas can still use a PIN, pattern or password, including Private Space, multi-user mode, payment autofill in apps, and password or payment autofill in Chrome.

How App Protection Works in Android 16

Identity Check does not automatically lock every app. Android’s expanded app protection applies to apps that request authentication through the system Biometric Prompt. Compatible banking, password-manager and other sensitive apps can therefore lose PIN or password fallback when the phone is outside a trusted place.

Apps that use only their own password, PIN or authentication system may not receive this platform-level enforcement. For those apps, enable the security controls provided inside the app.

Android’s biometric framework identifies a BIOMETRIC_STRONG authenticator as a Class 3 biometric. It also distinguishes weaker biometrics from DEVICE_CREDENTIAL, which means the device PIN, pattern or password. When Identity Check is enabled, a strong biometric is enrolled and the phone is in a high-risk environment, Android removes device-credential fallback for supported prompts.

What You Need Before Setup

A supported phone: If Identity Check is missing from the Theft protection page, Google says the device does not support it.
A screen lock: Set a PIN, pattern or password before enrolling biometrics.
A strong biometric: The enrolled fingerprint, face or other biometric must meet Android’s Class 3 security requirements.
Trusted places: Add locations where you normally want the usual biometric-or-device-credential flow to remain available.
Account recovery details: Keep your Google Account password, phone number and two-step-verification recovery methods current.

For users in Bangladesh, check the exact phone model, regional firmware and manufacturer software version. The supplied Google guidance does not confirm a universal Bangladesh rollout or a complete list of eligible devices.

How to Turn On Identity Check

1. Open the Identity Check settings

Open Settings → Google → All services → Theft protection → Identity Check. Menu names can vary by manufacturer and software version.

On some Pixel builds, the path may be Settings → Security & privacy → Device unlock → Theft protection → Identity Check. You can also search Settings for Identity Check.

2. Complete the account, lock and biometric requirements

Sign in to a Google Account if prompted. Confirm that a screen lock is enabled, then enrol a supported strong biometric, such as a qualifying fingerprint or face-unlock method.

3. Add trusted places

Add one or more trusted locations, such as Home or Work. You can enter an address or select a point on a map. Trusted places can also be managed through Settings → Location → Location Services → Trusted places.

Wi-Fi and Location Accuracy may be needed for trusted places to work reliably. Add only locations where the phone is normally secure. A public workplace, café or other broad location may reduce the time Identity Check requires biometric-only authentication.

4. Finish setup

Review the trusted-place list and tap Done. Outside those locations, Identity Check can require a strong biometric for protected settings and supported apps using the system Biometric Prompt.

Trusted Places: Important Limits

Trusted-place boundaries are approximate—about 100 metres—and may extend beyond the walls of a home or workplace. Location signals can be unavailable, copied or manipulated, and the location may not refresh instantly.

All settings that use trusted places share the same saved list. You cannot create a separate trusted-place list for each individual security feature. Trusted places are saved on the device, and Google says the precise location is not shared with the settings that use them.

Protect Individual Apps Too

Identity Check is not a universal app lock. Enable each important app’s own biometric lock, two-step verification and other available security controls, especially if the app does not use Android’s system Biometric Prompt.

This is particularly relevant for apps containing banking, mobile-financial-service, password-manager, work-account or other sensitive information. Identity Check adds a platform-level safeguard, but it does not replace the app’s own authentication system.

Common Problems and Fixes

Identity Check is missing

Android 16 does not automatically provide Identity Check on every phone. Check the Android version, security update, manufacturer software version and model-specific support information. If the Theft protection page does not list the feature, Google’s guidance is that the device does not support it.

The phone rejects the PIN outside home

This is expected for a protected Identity Check action. Outside a trusted place, Android removes PIN, pattern and password fallback for supported biometric prompts. Use the enrolled strong biometric instead.

If you need to turn off Identity Check, a supported Google Account recovery route may be available. Account-based disabling requires an internet connection and may require an additional two-step-verification factor.

A banking app still accepts its password

The app may be using its own password or PIN system rather than Android’s system Biometric Prompt. Turn on the app’s own biometric lock and other available account protections.

A trusted place is not recognised

Check that Location is enabled, Location Accuracy is active and Wi-Fi is turned on. Because trusted-place boundaries are approximate, recognition may not match the exact walls of a building.

You want to remove a trusted location

Open Settings → Location → Location Services → Trusted places, authenticate, select the saved location and delete it. The change applies to settings that share the trusted-place list.

You want to disable Identity Check

Return to Settings → Google → All services → Theft protection → Identity Check and choose Turn off Identity Check. Away from a trusted place, verify with your biometric or use the supported Google Account option.

Identity Check Compared with Ordinary App Locks

Feature	Ordinary app biometric lock	Identity Check
Controlled by	Individual app	Android system plus supported apps
Scope	Usually one app	Sensitive settings, accounts, passwords and compatible biometric-prompt apps
PIN fallback	Often allowed by the app	Removed outside trusted places for supported prompts
Location awareness	Usually none	Uses trusted places and high-risk conditions
Availability	Depends on the app	Depends on the device, Android version, manufacturer implementation and biometric class

Frequently Asked Questions

Does Android 16 enable Identity Check automatically?

No. It is an optional setting that must be configured on a supported device.

Does Identity Check require a fingerprint?

Not necessarily. It requires an enrolled Class 3 or strong biometric. Depending on the device, that may be a fingerprint, face or another biometric method that meets Android’s security requirements.

Can I use my PIN instead of biometrics?

For protected Identity Check prompts outside trusted places, no. Android removes device-credential fallback in that situation. At a trusted place, the normal biometric-or-device-credential flow can generally remain available.

Will Identity Check lock every banking app?

No. The Android 16 expansion applies to apps using the system Biometric Prompt. Apps using separate password or PIN systems may not be covered.

What happens at home?

If the phone is recognised as being inside a saved trusted place, protected actions can generally use the normal authentication flow. The boundary is approximate.

Does Identity Check protect against forced biometric use?

The feature is designed primarily to stop someone who knows or observes the device PIN. The supplied Google documentation does not claim that it prevents forced fingerprint or face authentication.

Conclusion

Identity Check is useful when a phone contains banking apps, passkeys, password-manager data, work accounts or mobile-financial-service information. Its main benefit is that knowing the PIN is not enough to complete selected high-risk actions or use supported biometric-prompt apps outside a trusted place.

The feature is device-dependent, does not cover every app and uses approximate location boundaries. Enrol a reliable strong biometric, add only genuinely secure trusted places, keep account-recovery methods current and enable each important app’s own security controls. Other Android theft-protection features can complement Identity Check.

Search This Blog

TechBD Daily