So the biometric information used to identify an individual can't be stolen? How is that possible? I can change a password, and I can replace a hardware token.