If there's a IR sensor on the phone, the facial recognition system won't be fooled by a photo. You need to create a near perfect 3D model of that person's face to have a chance of fooling it.
If there's an IR sensor that can see the facial map, perhaps, but the heat of a face changes so significantly that an IR match requirement might lead to too many false negatives to be useful. Penetration testers have already worked out a way to create fingerprint keys years ago so we can assume law enforcement has those now, as well as industrial spies and professional fraudsters.
But to be fair, law enforcement's been using a shotgun approach to phones with very few that they have not been able to search when they wanted to, so if they're that easy for police to crack, they're easy for industrial spies and professional racketeers.
Can device facial recognition be defeated by wearing a paper mask over my face with the device owner's face, like a TF2 Spy?
If there's a IR sensor on the phone, the facial recognition system won't be fooled by a photo. You need to create a near perfect 3D model of that person's face to have a chance of fooling it.
If there's an IR sensor that can see the facial map, perhaps, but the heat of a face changes so significantly that an IR match requirement might lead to too many false negatives to be useful. Penetration testers have already worked out a way to create fingerprint keys years ago so we can assume law enforcement has those now, as well as industrial spies and professional fraudsters.
But to be fair, law enforcement's been using a shotgun approach to phones with very few that they have not been able to search when they wanted to, so if they're that easy for police to crack, they're easy for industrial spies and professional racketeers.