The letter they sent me claimed that there is currently no way to create fake fingerprints, so there's nothing to be worried about, 2 years of identity theft monitoring is good enough.

In what world are they living, where there is "no way to create fake fingerprints"? Of course that is possible. Here is one example: http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren.en

It is easily possible to create fake fingerprints that can fool any known finger print scanner. If you know one, that supposedly can't be tricked, please let me know.

I wasn't sure if they were lying or merely incompetent when they said that. Mythbusters has an episode of them defeating fingerprint locks using a print lifted from a glass, and the technique they used was anything but sophisticated.

I'm sure you're very comforted by that addition of the qualifier "currently."

Correlated letter from 2011: "Dear streptomycin, your fingerprint data is currently not stolen!"

They lied to you. But what else is new.

That was a blatant lie tho.

In keeping with industry best practice, I require staff to sandpaper off their fingerprints and regrow them every 90 days.

For "security".

A bit extreme isn't that? I just have my staff paint their fingerprints with women's ruby red fingernail paint. It dries to a smooth glass-like finish.

For "security"

Thats why fingerprint is username, not password

Password is thumbprint.

I'd like to see YYYY-04-01 RFC on biometrics authenticator expiration protocols.

"As an alternative, users may keep all their fingers in a fingerprint safe and secure them all with a single retina scan, which they can use to open the safe each time they need to use a finger."