Choosing someone that looks like the owner would increase the odds greatly. You can't narrow down the search field like that with a PIN or a fingerprint.
Especially for groups of people who are less likely to be represented in the training data. Someone with the last name "Tillekeratne" for example is Sri Lankan, and Sri Lankans are probably underrepresented in Apple's training data. If you harvested images of Sri Lankans online you would probably need less than a million to get a false positive.
>If you harvested images of Sri Lankans online you would probably need less than a million to get a false positive.
Bearing in mind that FaceID uses a depth map of the face, you'll need more than photos harvested online. They also specifically said that they've tested against realistic masks to make sure they won't work, so I don't think it'll be quite as bad as you imagine!
