Liveness Detection 101: Types, Spoofing Attacks, and Certification in KYC

In 2024, a Hong Kong finance employee wired $25 million after a video call with people he believed were his CFO and colleagues. Every person on that call was a deepfake.

Another case shows the same attack pattern hitting KYC directly: a 34-year-old suspect used stolen IDs and deepfakes to open 46 fraudulent accounts through a major bank's mobile onboarding flow

Fraud cases like these have become extremely common now that fraudsters can generate synthetic faces and have access to cheap real-time face-swap software. According to Entrust's 2026 Identity Fraud Report, based on more than one billion identity-verification events across 195 countries:

• deepfakes now drive one in five biometric fraud attempts globally;
• deepfaked selfie attempts rose 58% in a single year;
• injection attacks rose 40% year over year.

A face match or a single-shot selfie can no longer prove a real person sits behind the camera. Liveness detection is now used to close that gap. Regulators add guidelines and recommendations on using liveness checks to prevent AI-generated identity fraud.

We’re here to help you understand what a liveness test does, what types there are, and which type is best for your risk profile.

What Is a Liveness Check?

Liveness detection is a check that confirms the person completing identity verification is a real, physically present human, not a photo, a video, a mask, or a synthetic reconstruction of a face. It's the step that runs alongside face matching.

Within KYC, liveness detection sits at a specific point in the flow. Typically, after the user submits an ID document and a selfie or video. It’s important to understand that while liveness is meant to detect fakes, no system is perfect. Liveness tests are used along with other KYC checks to form a profile that paints a full picture of a person’s identity.

Why Use Face Liveness Detection in KYC?

The main goal of face liveness recognition is fraud detection. A document check confirms a real ID exists. A face match confirms the selfie resembles the document photo. Neither confirms the person submitting the selfie is physically present at that moment.

Aside from catching money laundering attempts and sanctions evasion, a liveness test is also a required check in some jurisdictions.

In the EU, the EBA's 2022 Guidelines on Remote Customer Onboarding require liveness detection specifically for unattended flows — where no employee interacts with the customer during verification.

Regulatory attention extends beyond the EU. FinCEN's alert directs financial institutions to watch for deepfake-related red flags and reference the alert in SAR filings using the code FIN-2024-DEEPFAKEFRAUD when suspected AI-generated fraud is involved.

The MAS's September 2025 Information Paper on deepfake-related cyber risks recommends implementing liveness detection specifically to counter deepfakes, alongside endpoint-level protection against injection attacks.

Hong Kong's HKMA has expected authorized institutions to use biometric solutions, including liveness detection, for identity matching in remote onboarding since 2020.

So, in the EU, face liveness checks are mandatory. Other jurisdictions don’t require biometrics for remote onboarding, but the control is seen as an expectation and a guideline.

Understanding the Different Types of Liveness Tests

There are different types of liveness checks you can use for remote onboarding. Each of them offers a different level of depth and effort from the end-user. So, it’s important to know and understand them so you can build the best verification flow for your case.

Active Liveness

With active liveness, the user performs a real-time action, like blinking, turning their head, smiling, or following a moving target on screen. The system checks whether that response matches natural human motion, something a static photo or a slow deepfake often struggles to replicate convincingly.

Passive Liveness

Passive liveness asks nothing of the user beyond looking at the camera for a moment. Behind the scenes, the system captures a short burst of frames and analyzes them for texture, lighting consistency, and the small natural movements a real face makes even when it's holding still. Because it adds no extra steps, it's become the default choice for most everyday onboarding.

Hybrid Liveness

Hybrid liveness, sometimes called semi-passive liveness, sits between the two. The user performs one simple action; usually, they have to smile to the camera, but the bulk of the analysis still happens passively. That one action adds a bit more confidence to the check without turning it into a full active flow.

3D Liveness

3D liveness looks at how light reflects off the face to reconstruct its real three-dimensional shape, sometimes using the device's own screen as a light source, cycling through colors as the user looks at the camera. That's what lets it catch things flat, texture-based analysis can miss, like a convincing mask or a screen replay held up in front of the camera.

How Liveness Detection Works Step by Step

Under the hood, face liveness detection algorithms use neural networks trained on large volumes of real and spoofed face samples. These models learn to recognize patterns associated with synthetic or manipulated inputs and to distinguish them from natural facial characteristics.

This is what the process looks like step by step:

Step 1: Capture

The flow starts with the user's camera — a selfie, a short video, or (for flash-based checks) a sequence of frames while the screen cycles through colored flashes. The system typically checks capture quality first: whether the face is fully in frame, whether there's enough light, and whether the image is sharp enough to analyze. A failed quality check triggers a retry.

Step 2: Signal extraction

The system pulls the specific features each method relies on. For passive and active checks, that's texture patterns, micro-movement between frames, and geometric landmarks (eyes, nose, mouth) tracked across the sequence. For flash-based checks, it's the specular and diffuse light reflection patterns captured during each flash.

Step 3. Analysis against expected human signatures

The captured video or photo gets compared against the patterns the model was trained on to tell a real face from a spoofing attempt. Anything that deviates from what a real face typically looks like gets flagged.

Step 4. Scoring and decision

The system calculates a confidence score internally for each check and compares it against a threshold to produce the result: pass, fail, or route to manual review. Where that threshold sits is a risk decision, usually set by the compliance team during setup.

Step 5. Response handling

Based on the result, the workflow branches automatically: approve, reject, or route to a second check without a person having to touch every single case.

Common Ways Fraudsters Try to Bypass Liveness Detection

Print/Photo Attacks

You might think nobody will print a photo and hold it up to pass the check, but it’s the simplest scheme and costs only ink and paper. A flat surface has no depth and no natural micro-movement, so any modern liveness check catches it easily. Print attacks are still common because they cost very little to try.

Screen Replay Attacks

With a screen replay attack, fraudsters take a photo or recorded video of the target on a phone or tablet, then present that screen to the camera. Screens give themselves away through reflections, pixel patterns, and playback artifacts that passive and flash-based liveness are built to catch.

3D Masks

This type of attack is rare but hardest to catch with software alone. That’s because fraudsters use silicone or resin masks molded to resemble a real face.

Independent testing bodies consistently flag 3D masks as the category standard liveness systems struggle with most, since a well-made mask's geometry can be close enough that only depth/light-reflection analysis reliably catches it.

While the cost of making a highly realistic custom mask now runs under $1,000, it's still the most effort-intensive attack on this list, which keeps volume relatively low compared to digital attacks.

Deepfakes

AI-generated video that maps a target's face onto a live performer in real time (a.k.a face swap), or generates a synthetic face from scratch. Deepfakes are extremely common and dangerous specifically because they can respond to active-liveness prompts.

Across major European markets in 2025, deepfake fraud attempts rose sharply but unevenly. The steepest increases were seen in France and the UK, with Spain and Germany also up significantly.

North America saw an even sharper spike in early 2025, concentrated in e-commerce, edtech, and healthtech specifically. By sector, online media and dating platforms, financial services, and crypto consistently show the highest exposure to identity fraud broadly, with crypto remaining a persistent target for deepfake-driven onboarding fraud.

There is one case that shows the financial scale deepfake fraud can reach. In May 2025, Vietnamese police dismantled a 14-person ring that laundered roughly $39 million by using AI-generated face scans, created from a 30-second video, to take control of bank accounts opened in other people's names.

Injection Attacks

Finally, the newest and most advanced type of attack. During an injection attack, a fabricated video stream gets fed directly into the verification pipeline, bypassing the camera entirely.

Injection can be done using a laptop or a phone. For example, on a laptop, software like OBS Virtual Camera registers itself as a normal webcam. When the KYC app asks for camera access, the OS hands it this fake device instead, and the app receives deepfake footage believing it's a live feed.

Fraudsters also actively use mobile phones to do injections. Until recently, such attacks were considered as mostly an Android problem, since jailbreaking iPhones at scale was considered harder.

However, injection attacks on iOS devices surged 1,151% in the second half of 2025 alone, part of a 741% annual increase across all injection attacks. For your KYC, this means you can no longer treat iOS users as lower-risk for this specific attack the way you once could.

Unfortunately, even advanced liveness models can’t counter injections. To stand a chance, your verification software needs more sophisticated features, like device attestation, root and jailbreak detection, and session-level signals.

Liveness Detection Standards

Because liveness models can be trained, there are two ways to measure how well they work against fakes.

The standard is ISO/IEC 30107-3. This is the international standard for Presentation Attack Detection (PAD) — the formal name for what liveness detection does. It defines how testers should evaluate a biometric system's ability to resist spoofing, and how results should be measured and reported, so different vendors' results can actually be compared on the same basis.

iBeta is the most recognized independent lab that tests against it. iBeta is accredited by NIST/NVLAP (the National Voluntary Laboratory Accreditation Program) to conduct this testing.

Testing runs in tiers, roughly matched to attack sophistication:

• Level 1 tests resistance to common, readily available 2D presentation attacks — printed photos, cutouts, screen replays — under cooperative testing conditions.
• Level 2 tests resistance to more sophisticated attacks, including 3D masks (silicone, latex, wrapped 3D paper, cloth), under less predictable capture conditions.

When evaluating a KYC software provider, checking whether they hold an iBeta confirmation letter and at which level is a great way to understand how much you can trust their liveness checks.

Choosing the Right Liveness Detection Approach

To wrap up, here are three pieces of advice that can help you make the most out of liveness control:

1. Know which attacks actually target your sector and region

Deepfake attacks concentrate heavily on crypto platforms specifically. Industry data puts the share of deepfake attacks aimed at crypto as high as 60%, with a 654% rise in deepfake incidents on crypto platforms between 2023 and 2024.

Injection attacks grew 9x in 2024 alone, driven by a 28x spike in virtual camera exploits specifically. Fraud clusters can also concentrate in specific countries.

So, build your verification flow around the countries your customers actually come from, and around the attack types most common in your specific industry. That will help you perform liveness checks that actually fend off breach attempts.

2. Liveness check in KYC is a supplement, not a substitute

Liveness detection isn't a complete KYC solution on its own. It needs to sit alongside standard checks (document verification, sanctions and PEP screening) plus checks specific to your customers' country of origin and your industry's regulatory requirements.

3. Check for independent certification, and specifically which level

Don't rely on a vendor's own accuracy claims. Ask for their iBeta confirmation letter and check whether it covers Level 1 or Level 2. That tells you how mature and rigorously tested their system actually is.

Match Liveness Checks to the Risk in Front of You

Pick one-shot or 3D liveness for each risk level, and customize the action sequence inside 3D checks. iBeta Level 1 and 2 certified, built into your KYC flow from the start. See all liveness features or test them in your account right now.