I worked on the Android team that was responsible for face unlock so I can say roughly how that works. It does, in fact, use a statistical model. It is trained as a binary classifier by giving it pairs of pictures where either each image in the pair comes from the same person or one image is from the true person and the other is an impostor. This classifier outputs a matching score. Then a cutoff threshold is chosen. To unlock the phone all someone has to do is present a face that matches the stored profile better than the threshold. Separately, there are various technologies that try and determine if the camera is detecting an actual face or if it is an image or a video of a face. That used to be hard to do but I imagine now that the sensors have improved and it is more reliable.
Fingerprint matching is a bit different. If you look closely at your fingerprint you will see lots of places where a ridge ends or bifurcates. These are called minutiae. The first step is for an algorithm to locate the position of each visible minutiae. Then fingerprint matching occurs by trying to put the locations of the minutiae in correspondence with the locations from the stored template.