Why am I able to log in with my face/finger sometimes, while I have to log in using a password other times?

It is up to each individual user site to decide which security level they wish to use, and they can choose between two different security levels for the BankID app. If they use the "high" security level, you will be asked to enter your BankID password. This often happens if you are going to log in to public services, check sensitive personal data, with e-signatures or if you are going to carry out larger transactions. If the user site uses the "significant" security level, you will be able to log in with facial recognition/fingerprint or a PIN code. This will eventually apply to most logins, but it will be natural to distinguish between the level of security in smaller transactions and, for example, when signing loan documents.