Getting your face (and it has to be a high resolution 3D model of your face, not just a photograph) or your fingerprint is not enough. They also have to have physical access to one of your devices.