Biometrics is third-factor authentication (something you are). Its purpose is to supplement second-factor authentication (something you have), which is in turn meant to supplement first-factor authentication (something you know). You can also add a fourth factor (somewhere you are, or location) as an additional authentication factor as well. But it's this key point --that biometrics is meant to be one layer of multi-factor authentication -- which vendors seem to have ignored by conflating its function as supplement with its function as replacement, which it is decidedly not.