A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How difficult would it be to use one of them to access someone's bank account?
Have there been studies done on how often people leave high-quality fingerprints? Has such an attack been attempted (or succeeded) yet?
One counterargument I can see in favor of the security of this scheme is that, if you register the device in advance, this is actually two-factor authentication (because you have the device, and you're using your fingerprint - it's using something you have and something you are). But, cellphones are easy to steal too.
So, my original question still stands: have there been any studies, threat modeling, cases of successful attacks, etc. that indicate how serious this threat is?