Two-dimensional image information and three-dimensional image information of a subject are acquired, facial recognition is performed using the two-dimensional image information to determine whether a recognized face is a registered user's face, an elliptical model of the user is matched to the three-dimensional image information to calculate an error if it is determined that the recognized face is the user's face, and it is determined whether the user's face is improperly used based on the error. The subject's face is determined using the two-dimensional image information and the three-dimensional image information of the subject and it is determined whether the recognized face is improperly used, thereby improving facial recognition reliability. Thus, information security is improved.