Liveness detection
Also called presentation attack detection, PAD, liveness check
Liveness detection is a check that confirms a live person is in front of the camera during remote identity verification. It stops fraudsters using photos, videos, masks or deepfakes to pass a selfie match. In standards it is called presentation attack detection, and EU guidelines expect it in unattended remote onboarding.
How it works
During onboarding the customer takes a selfie or short video after scanning an identity document. Active checks ask the person to turn their head, blink or follow a prompt. Passive checks analyse a single capture for depth, skin texture, reflections and screen artefacts. Newer systems also look for injection attacks, where a synthetic video feed replaces the camera. The result feeds a face match against the document photo.
Liveness detection matters because deepfake tools have made face spoofing cheap and scalable. A failed check exposes firms to synthetic identities, mule accounts and account takeover. Supervisors expect firms to show their remote onboarding is as reliable as face-to-face checks. Testing against recognised standards gives evidence of that reliability.
The rules
Expect firms using unattended biometric onboarding to apply liveness checks and verify that the customer is the person in the document.
Credit and financial institutions in the EUSets methods for testing and reporting the performance of presentation attack detection, used as the benchmark for liveness testing.
Biometric system developers, test laboratories and buyersSets identity proofing and authentication requirements, including presentation attack detection for biometrics and new controls against injection attacks and forged media.
US federal agencies, widely used as a benchmark by private firmsCommon questions
What is the difference between active and passive liveness?
Active liveness asks the user to perform an action, such as turning their head or reading numbers. Passive liveness analyses a single image or short capture without user effort. Passive checks reduce drop-off at onboarding, and many firms combine both for higher-risk cases.
Can liveness detection stop deepfakes?
It stops many deepfake presentation attacks, especially when combined with injection attack detection that checks the camera feed is genuine. Fraud methods change quickly, so firms test and update their checks regularly.
What is ISO 30107-3 testing?
ISO/IEC 30107-3 sets the method for testing presentation attack detection. Accredited laboratories run tests against it and report results by attack level. Firms ask for these results when they assess identity verification suppliers.
Our coverage
News and analysis on KYC and identity from RegTech Post.
Read the coverage →RegTech PostHow AI and Deepfakes Are Reshaping KYC in Financial ServicesRead the article →RegTech PostBiometric KYC Comes of Age: The Next Frontier in Digital IdentityRead the article →
