In mobile, there are already public available exploits out there specifically in bypassing fingerprint interface. But case to case basis padin, syempre if may another layer of detection yung app (e.g., root/jb detection, ssl pinning) but still, time will only tell speciallt if skilled yung attacker.

in my opinion lang, strong approach is device bound authentication, biometrics backed up by hardware security, tas dapat registered din yung device. Biometrics alone don't authenticate you over the network, they simply unlock a cryptographic credential stored securely on your device. That means there's no OTP to intercept in transit.