iPhone Duo Has No Face ID: Touch ID, Passcodes and AI Agent Security Explained

The most discussed omission on Apple's foldable is also the simplest: the iPhone Duo does not have Face ID. Apple's product page says it uses Touch ID built into the side button, and that this works whether the phone is open or closed. The iPhone 18 Pro and 18 Pro Max, announced the same day, keep Face ID.

This guide covers what changes for everyday security, what Apple has and has not said, and why the bigger security question on a new phone in 2026 is not the biometric: it is the AI assistants and agents you let act for you. For launch specifics, see our September 9 event recap.

TL;DR

What Apple has said and what it has not

Apple has confirmed Touch ID, the side-button placement and Apple Watch unlock. It has not published a reason for dropping Face ID, and it has not said whether a later Duo will add it. Some coverage says the under-display front camera leaves no room for the infrared parts Face ID needs. Others say a single side sensor sidesteps which screen faces the user when the phone is folded. Both are plausible, and neither is an Apple statement. We flag them as inference, because security explanations are easy to state confidently and hard to verify from outside.

A fingerprint swirl forming a lock, representing Touch ID biometric unlock

Touch ID vs Face ID: what actually differs

Neither is "more secure" in the abstract. Each fails differently. A fingerprint can fail on wet hands; a face can fail with a mask or angle. Both fall back to a passcode, which is why the passcode is the real foundation.

Set the Duo up well

1. Use a long passcode. Six digits is a minimum; a longer alphanumeric code is stronger, especially because the passcode backs everything else.
2. Enroll more than one finger. Pick the ones you use on the side button in both open and closed positions.
3. Set a short auto-lock. The phone locks quickly when you set it down.
4. Turn on Find My and Lost Mode. If the phone is stolen, you can lock or wipe it.
5. Keep the OS updated. Security patches matter more than biometric type. Our guide to internet safety for everyday people covers the basics.
6. Add two-step login to your accounts. Passkeys and authenticator codes protect you if the phone is not in your hand.

The bigger risk: AI agents on your phone

Phones in 2026 run assistants that read your messages, summarize your email and book things. Apple's WWDC 2026 announcements pushed in this direction with Siri AI and Apple Intelligence on A20-class chips. Every capability you grant is a capability that can be abused, by prompt injection in an email or web page, by a malicious app, or by a mistake.

The practical rule is the same as for any agent: least privilege and approval for risky actions.

A door with a permission prompt, illustrating approval before an action

A permissions checklist for phone assistants

• Payments: require biometric or passcode confirmation for every purchase. Do not allow standing approval.
• Messages and email: allow reading and drafting, but require a confirmation before sending.
• Files and photos: share only what the task needs; avoid "all photos" access.
• Third-party connectors: review which apps and agents have access, and remove ones you no longer use.
• Unknown links: treat instructions inside emails or web pages as untrusted text, not commands.

If you build or run agents

If you run agents that act on your behalf through phones, browsers or APIs, add a layer that checks actions before they run. Open-source options such as AgentBeam (from the explainx.ai team) check actions before they run, and our AI agent security platforms roundup compares the field.

Privacy habits that do not depend on the lock

• Blur faces and plates before sharing. See our guide to blurring faces on iPhone Duo.
• Strip location metadata from photos you post.
• Limit what you tell assistants. Do not paste secrets, keys or private documents into a chat you do not control. Our write-up on AgentCloak covers a privacy layer for prompts.
• Verify before you trust a video call or voice message. Deepfake scams are real; see how video-call fraud works.

What to do if the phone is lost or stolen

Plan before it happens, because Touch ID will not help once the phone is out of your hands.

1. Mark it lost. Use Find My to lock the phone and show a message. This also helps keep it locked if someone tries to reset it.
2. Change key passwords. Start with your Apple account, email and banking, then anything with saved payment details.
3. Revoke sessions and tokens. Sign out of devices in your account settings and revoke API keys and agent tokens that were stored on the phone. Leaked keys are an active risk; see our AI account security guide.
4. Tell your bank if payments were saved. Ask them to watch for unusual activity.
5. Report it if you suspect theft.

Shoulder surfing and coerced unlock

Touch ID has one practical difference from a passcode: someone can press your finger to a sensor against your will, and cameras cannot see a fingerprint the way they can see a passcode. Both are threats at the margins. Know your device's quick lockdown shortcut, and consider restarting the phone in situations where you feel pressure, since a restart requires the passcode before biometrics work again. Check Apple's current support pages for the exact steps on your version.

Questions to ask before trusting any AI feature

Before you enable an assistant, ask four things:

• What data does it read? Messages, email, photos, location, files?
• What can it do? Draft only, or send, buy and delete?
• Where does it run? On the device, or in the cloud, and what is retained?
• Can I see and undo what it did? Is there a log and a way to stop it?

If you cannot answer, do not enable it for sensitive accounts. Prompt injection is the key threat: text in an email or web page can tell an agent to do something you did not intend. Treat any feature that reads untrusted content and also takes actions as higher risk, and keep a human approval step in the middle.

Touch ID and shared devices

A phone is personal, but not always private. Partners, kids and coworkers sometimes borrow it. Think through three cases.

• Enrolled fingers. Only enroll fingers of people you want to be able to unlock the phone. Anyone with an enrolled finger can approve purchases that Touch ID covers, so be deliberate.
• Children. Use Screen Time and purchase approval so a child cannot buy things or install apps without you. Do not enroll a child's fingerprint on a phone that holds payment methods unless you are comfortable with that access.
• Work data. If you have a work profile or email, check your employer's policy. Some organizations require a minimum passcode length or remote wipe.

Common mistakes to avoid

• Treating the biometric as the lock. The passcode is the root of trust. A weak passcode weakens everything.
• Leaving the phone unlocked on a desk. Set a short auto-lock and make it a habit to lock when you walk away.
• Granting blanket permissions to assistants. Approve per task, not forever.
• Reusing passwords. One breach then unlocks many accounts. Use a password manager or passkeys.
• Ignoring updates. Security fixes arrive in updates. Turn on automatic updates.
• Pasting secrets into chats. API keys and private documents in a prompt are hard to take back.

Summary

iPhone Duo trades Face ID for side-button Touch ID, with passcode fallback and Apple Watch unlock. Apple has not said why, so treat the explanations in circulation as informed guesses. The protection that matters most is a strong passcode, current updates, and tight control over what assistants and agents can do, with human approval for payments, sends and deletions.

For related reading, see iPhone Duo pricing.

Facts reflect Apple's product page and coverage from September 2026. Apple may add features or change terms; check Apple's current pages. This is general guidance, not security or legal advice.