Biometric Verification

What Is Biometric Verification?

Biometric verification confirms that a person is who they claim to be by comparing a physical or behavioral characteristic against a trusted reference. In customer onboarding, the most common form is facial comparison: the customer takes a selfie, and the system checks it against the photo on their identity document or the facial image stored on an electronic passport chip. Fingerprints, voice and iris patterns are also used, mostly in device unlock, government programs and call centers.

It helps to separate two terms that are often mixed up:

• Verification (1:1) answers the question "is this person the same as the person on this document?" by comparing one sample with one reference.
• Identification (1:N) answers "who is this person?" by searching one sample against a database of many people.

KYC onboarding almost always relies on 1:1 verification. Identification against large databases raises much heavier legal and ethical questions and is rarely needed for customer due diligence.

Why Biometric Verification Matters

Remote onboarding removed the face-to-face check that bank staff once performed when they looked at a passport and the person holding it. Without a replacement, a criminal holding a stolen or purchased document can open an account in someone else's name. Biometric verification restores that link between the document and the living person in front of the camera.

For firms, a reliable biometric step supports several goals at once:

• reducing impersonation and identity spoofing during onboarding
• making accounts harder to open for money mules recruited to lend their identities
• giving a stronger basis for re-authenticating customers later, for example before a high-risk change to account details
• lowering friction compared with branch visits or posted documents

How It Works in Practice

A typical remote onboarding flow combines several checks. Each one covers a different attack.

1. Document capture and checks. The customer photographs their ID. The system reads the data, checks security features and looks for signs of document forgery.
2. Chip reading where available. Electronic passports and many national ID cards follow ICAO Doc 9303, which defines how the data and facial image are stored on the chip and how their authenticity can be checked cryptographically. A chip image that passes these checks is a stronger reference than a printed photo.
3. Selfie capture with liveness detection. Liveness detection checks that the camera is seeing a real, present person rather than a printed photo, a screen replay, a mask or a synthetic video.
4. Face comparison. A face matching model produces a similarity score between the selfie and the reference image. The firm sets a threshold that balances false accepts against false rejects.
5. Decision and fallback. Clear passes proceed, clear fails are declined or escalated, and borderline cases go to manual review or an alternative verification route.

Common Attack Types

• Presentation attacks: holding up a photo, screen or mask to the camera. The ISO/IEC 30107 series of standards covers the testing of presentation attack detection.
• Injection attacks: feeding a pre-recorded or synthetic video stream into the app or browser so that it bypasses the camera entirely.
• Deepfakes and face swaps: generated media that imitates a real person's face in real time.
• Morphing: blending two people's faces into one document photo so that both can pass a comparison against it.
• Genuine document, wrong holder: a lookalike using someone else's real document, which is why the threshold and liveness checks matter.

Regulatory Expectations

AML laws generally do not prescribe biometrics, but they require firms to verify identity using reliable, independent sources and to manage the extra risk of non-face-to-face relationships. FATF's Guidance on Digital Identity explains how digital ID systems can support customer due diligence and encourages a risk-based view of their assurance levels. In the EU, electronic identification under the eIDAS framework is recognized as a means of verification, and the AML rules treat remote onboarding as acceptable when appropriate safeguards are in place.

Biometric data is also tightly regulated as personal data. Under the EU and UK GDPR, biometric data processed to uniquely identify a person is a special category of personal data, so firms need a valid legal basis and condition for processing, a data protection impact assessment in most cases, clear retention limits and transparent customer notices. Several US states also have biometric privacy laws with consent and retention requirements.

Best Practices

• Use biometrics as one layer alongside document checks, data checks and device or IP signals, not as a single gate.
• Prefer chip-based reference images when the document supports it.
• Test liveness and matching performance across age groups, skin tones and lighting conditions, and monitor for demographic differences in error rates.
• Keep a clear fallback route for customers who cannot complete a selfie check, so that accessibility needs do not become exclusion.
• Minimize retention of raw images and templates, and document why each item is kept.
• Record the scores, thresholds and model version behind each decision so that outcomes can be explained later.

How on8.ai Helps

Passporter, currently in development, reads and verifies identity documents and verifies e-passport chips to ICAO 9303, with face recognition as part of the flow. Images are processed by on8's own models and are not sent to the cloud, which helps firms keep sensitive biometric data within their own dedicated deployment.

Related Terms

• Liveness Detection
• Identity Spoofing
• Document Forgery
• EV (Electronic Verification)
• KYC (Know Your Customer)
• Synthetic Identity Fraud