Liveness Detection

What Is Liveness Detection?

Liveness detection is a set of techniques that checks whether a biometric sample, typically a face captured during a selfie step, comes from a live person who is physically present at the time of capture. Its purpose is to stop an attacker from passing a face check with a printed photo, a picture shown on another screen, a replayed video, a mask or a digitally generated face.

In remote onboarding, the customer usually photographs an identity document and then takes a selfie. Face matching answers the question "is this the same person as the one on the document?". Liveness detection answers a different question: "is a real person actually in front of the camera right now?". Both are needed. A perfect face match against a stolen photo of the genuine document holder proves nothing if the selfie itself is a photo.

In standards terminology, attacks on the capture device are called presentation attacks, and liveness detection is a form of presentation attack detection (PAD). The ISO/IEC 30107 series of standards defines the terminology and testing methods for PAD.

Why Liveness Detection Matters

Remote identity verification lets institutions onboard customers without a branch visit, but it also lets fraudsters attempt onboarding at scale from anywhere. Without liveness checks, anyone holding a stolen document image and a photo of its owner could open accounts in that person's name.

Weak liveness controls contribute to:

• Accounts opened with stolen identities and later used as money mule accounts.
• Synthetic identity fraud, where a fabricated identity is paired with a face that does not belong to a real applicant.
• Account recovery fraud, where an attacker passes a selfie check to take over an existing account.
• Regulatory findings that remote onboarding does not provide assurance equivalent to an in-person check.

How Liveness Detection Works

Active liveness

Active methods ask the user to do something: turn the head, blink, smile, follow a dot on the screen or read out digits. The system checks that the response is natural and arrives in time. Active checks are easy to understand but add friction, and some prompted actions can be imitated with prepared videos.

Passive liveness

Passive methods analyze one image or a short capture without asking the user to perform actions. Models look for signs of a spoof such as paper texture, screen moiré patterns, reflections, unnatural edges, missing depth cues or inconsistent lighting. Passive approaches reduce friction and abandonment, and are often combined with a light active element.

Hardware-assisted methods

Some devices provide depth sensors, infrared cameras or structured light that make flat images and many masks easier to detect. Not every customer has such a device, so most onboarding flows cannot rely on hardware alone.

Attack Types to Consider

• Print attacks: a photo of the victim printed on paper, sometimes with the eyes cut out.
• Replay attacks: a photo or video of the victim displayed on a second screen.
• Mask attacks: paper, silicone or 3D-printed masks of increasing realism.
• Deepfakes and face swaps: synthetic video generated to resemble the victim.
• Injection attacks: the attacker bypasses the camera entirely and feeds pre-recorded or synthetic video into the app or browser using virtual cameras, emulators or modified apps.

Injection attacks are an important gap. A liveness model that only inspects the image can be defeated if the image never came from a real camera. Effective programs therefore add checks on the integrity of the device, the app and the capture session.

Regulatory Expectations

Regulators generally do not mandate a specific liveness technology, but they expect remote onboarding to be reliable and proportionate to risk. The FATF's guidance on digital identity encourages a risk-based approach to digital ID systems and describes assurance levels for identity proofing and authentication. In the EU, the European Banking Authority has issued guidelines on the use of remote customer onboarding solutions, which cover the reliability of biometric checks and the need to guard against impersonation. US identity proofing guidance from NIST, in its Digital Identity Guidelines, addresses biometric performance and presentation attack detection.

Biometric data is also personal data subject to strict rules. Under the EU GDPR, biometric data used to uniquely identify a person is a special category of personal data, so firms need a lawful basis, clear retention limits and strong security.

Best Practices

• Combine liveness, face matching and document verification rather than relying on any one check.
• Ask for independent PAD testing results against recognized standards and understand which attack types were covered.
• Add injection attack defenses: device integrity signals, detection of virtual cameras and emulators, and session binding.
• Monitor pass and fail rates by device type and demographic group to detect bias and performance drift.
• Provide a fallback route, such as a video call or in-person check, for customers who cannot complete the automated flow.
• Keep biometric data only as long as necessary and limit who can access it.

How on8.ai Helps

Passporter, currently in development, addresses the document side of remote identity checks: it reads and verifies ID documents and verifies e-passport chips to ICAO 9303. Images are processed by on8.ai's own models and are not sent to the cloud, which simplifies data protection questions around sensitive identity images.

Related Terms

• Biometric Verification
• Identity Spoofing
• Document Forgery
• Synthetic Identity Fraud
• KYC (Know Your Customer)
• EV (Electronic Verification)