Biometrics are not secret and should not be used in place of passwords. They are identity like a user name. It's the same problem with orgs trying to use ssn as a security challenge, with all the beaches pretty much everyone's is already public knowledge.