Liveness Detection 101: Types, Spoofing Attacks, and Certification in KYC

In 2024, a Hong Kong finance employee wired $25 million after a video call with people he believed were his CFO and colleagues. Every person on that call was a deepfake.

Another case shows the same attack pattern hitting KYC directly: a 34-year-old suspect used stolen IDs and deepfakes to open 46 fraudulent accounts through a major bank's mobile onboarding flow

Fraud cases like these have become extremely common now that fraudsters can generate synthetic faces and have access to cheap real-time face-swap software. According to Entrust's 2026 Identity Fraud Report, based on more than one billion identity-verification events across 195 countries:

• deepfakes now drive one in five biometric fraud attempts globally;
• deepfaked selfie attempts rose 58% in a single year;
• injection attacks rose 40% year over year.

A face match or a single-shot selfie can no longer prove a real person sits behind the camera. Liveness detection is now used to close that gap. Regulators add guidelines and recommendations on using liveness checks to prevent AI-generated identity fraud.

We’re here to help you understand what a liveness test does, what types there are, and which type is best for your risk profile.

What Is a Liveness Check?

Liveness detection is a check that confirms the person completing identity verification is a real, physically present human, not a photo, a video, a mask, or a synthetic reconstruction of a face. It's the step that runs alongside face matching.

Within KYC, liveness detection sits at a specific point in the flow. Typically, after the user submits an ID document and a selfie or video. It’s important to understand that while liveness is meant to detect fakes, no system is perfect. Liveness tests are used along with other KYC checks to form a profile that paints a full picture of a person’s identity.

Why Use Face Liveness Detection in KYC?

The main goal of face liveness recognition is fraud detection. A document check confirms a real ID exists. A face match confirms the selfie resembles the document photo. Neither confirms the person submitting the selfie is physically present at that moment.

Aside from catching money laundering attempts and sanctions evasion, a liveness test is also a required check in some jurisdictions.

In the EU, the EBA's 2022 Guidelines on Remote Customer Onboarding require liveness detection specifically for unattended flows — where no employee interacts with the customer during verification.

Regulatory attention extends beyond the EU. FinCEN's alert directs financial institutions to watch for deepfake-related red flags and reference the alert in SAR filings using the code FIN-2024-DEEPFAKEFRAUD when suspected AI-generated fraud is involved.

The MAS's September 2025 Information Paper on deepfake-related cyber risks recommends implementing liveness detection specifically to counter deepfakes, alongside endpoint-level protection against injection attacks.

Hong Kong's HKMA has expected authorized institutions to use biometric solutions, including liveness detection, for identity matching in remote onboarding since 2020.

So, in the EU, face liveness checks are mandatory. Other jurisdictions don’t require biometrics for remote onboarding, but the control is seen as an expectation and a guideline.

Understanding the Different Types of Liveness Tests

There are different types of liveness checks you can use for remote onboarding. Each of them offers a different level of depth and effort from the end-user. So, it’s important to know and understand them so you can build the best verification flow for your case.

Active Liveness

Active liveness (also called challenge-response) asks the user to perform a real-time action and checks whether the response matches natural human motion across multiple frames.

If someone tried using a static photo, they would fail this check. However, a pre-recorded video or a well-timed deepfake can breach the system if the motion analysis is weak.

Active liveness also requires effort, which can potentially increase drop-offs. This type of control can be used for re-verification and step-up checks — situations where a bit of user effort is an acceptable cost for higher assurance.

Passive Liveness

Passive liveness runs without asking the user to do anything beyond a normal selfie or short capture. It analyzes a single frame or short sequence for skin texture, lighting consistency, and micro-movement patterns that separate a real face from a photo, screen, or mask.

It's fast and keeps drop-off low, which makes it the default layer in most onboarding flows. The trade-off is that accuracy depends on capture quality and lighting.

For example, if the person is in a dark room or uses a low-end camera, that gives the model less to work with. It's a solid baseline for standard-risk onboarding, but not the layer to rely on alone for high-value accounts.

One-shot Liveness

One-shot liveness is a passive variant that decides from a single captured frame instead of a sequence. There's no second frame to compare against, so no motion or light-variation signal to catch a convincing static fake.

It’s fast and suits low-risk, high-volume flows where speed matters more than the extra assurance a sequence provides. So, use one-shot liveness with caution.

3D Liveness

3D liveness works by using the device's own screen as a light source: the system projects a sequence of dynamic colored flashes and analyzes how the light reflects off the face. A real, three-dimensional face reflects light differently than a flat photo, a screen replay, or a mask.

It runs on a standard phone camera and screen, which keeps it accessible across devices. Its strength is catching exactly what passive and active liveness can miss: high-quality masks and screen replays. The cost is more backend processing than plain texture analysis, and it's newer to market than passive or active, so track records vary more by vendor.

There’s also 3D liveness with challenge-response. It stacks the flash-based light analysis on top of a prompted action, combining two independent defenses. It's the highest-assurance option and correspondingly the highest-friction one. So, it’s typically reserved for high-risk check moments like payment approval or account recovery.

How Liveness Detection Works Step by Step

Step 1: Capture

The flow starts with the user's camera — a selfie, a short video, or (for flash-based checks) a sequence of frames while the screen cycles through colored flashes. The system typically checks capture quality first: is the face fully in frame, is there enough light, is the image sharp enough to analyze. A failed quality check triggers a retry before any liveness analysis runs.

Step 2: Signal extraction

The system pulls the specific features each method relies on. For passive and active checks, that's texture patterns, micro-movement between frames, and geometric landmarks (eyes, nose, mouth) tracked across the sequence. For flash-based checks, it's the specular and diffuse light reflection patterns captured during each flash.

Step 3. Analysis against expected human signatures

The extracted signals get compared against what a real, live face is expected to produce — natural texture variation, consistent depth cues, motion that starts and decays the way human movement does, or a reflection pattern that matches an actual 3D surface rather than a flat one.

This is where the models trained to spot presentation attacks do their work: a printed photo's flat texture, a screen's pixel pattern and glare, or a mask's material inconsistency all show up as deviations from the expected signature.

Step 4. Scoring and decision

The system outputs a confidence score. That score gets compared against a threshold to produce the final decision: pass, fail, or route to manual review. Where that threshold sits is a risk decision. Compliance teams typically tune this based on the risk profile of the flow it protects.

Step 5. Response handling

The result usually returns through an API or webhook, and the workflow can branch on it automatically: approve, hard-reject, or route to a second check (an active challenge if passive returned low confidence, or manual review for edge cases) without a person touching every case.

Common Ways Fraudsters Try to Bypass Liveness Detection

Print/Photo Attacks

You might think nobody will print a photo and hold it up to pass the check, but it’s the simplest scheme and costs only ink and paper. A flat surface has no depth and no natural micro-movement, so any modern liveness check catches it easily. Print attacks are still common because they cost very little to try.

Screen Replay Attacks

With a screen replay attack, fraudsters take a photo or recorded video of the target on a phone or tablet, then present that screen to the camera. Screens give themselves away through reflections, pixel patterns, and playback artifacts that passive and flash-based liveness are built to catch.

3D Masks

This type of attack is rare but hardest to catch with software alone. That’s because fraudsters use silicone or resin masks molded to resemble a real face.

Independent testing bodies consistently flag 3D masks as the category standard liveness systems struggle with most, since a well-made mask's geometry can be close enough that only depth/light-reflection analysis reliably catches it.

While the cost of making a highly realistic custom mask now runs under $1,000, it's still the most effort-intensive attack on this list, which keeps volume relatively low compared to digital attacks.

Deepfakes

AI-generated video that maps a target's face onto a live performer in real time (a.k.a face swap), or generates a synthetic face from scratch. Deepfakes are extremely common and dangerous specifically because they can respond to active-liveness prompts.

Across major European markets in 2025, deepfake fraud attempts rose sharply but unevenly. The steepest increases were seen in France and the UK, with Spain and Germany also up significantly.

North America saw an even sharper spike in early 2025, concentrated in e-commerce, edtech, and healthtech specifically. By sector, online media and dating platforms, financial services, and crypto consistently show the highest exposure to identity fraud broadly, with crypto remaining a persistent target for deepfake-driven onboarding fraud.

There is one case that shows the financial scale deepfake fraud can reach. In May 2025, Vietnamese police dismantled a 14-person ring that laundered roughly $39 million by using AI-generated face scans, created from a 30-second video, to take control of bank accounts opened in other people's names.

Injection Attacks

Finally, the newest and most advanced type of attack. During an injection attack a fabricated video stream gets fed directly into the verification pipeline, bypassing the camera entirely.

Injection can be done using a laptop or a phone. For example, on a laptop, software like OBS Virtual Camera registers itself as a normal webcam. When the KYC app asks for camera access, the OS hands it this fake device instead, and the app receives deepfake footage believing it's a live feed.

Fraudsters also actively use mobile phones to do injections. Until recently, such attacks were considered as mostly an Android problem, since jailbreaking iPhones at scale was considered harder.

However, injection attacks on iOS devices surged 1,151% in the second half of 2025 alone, part of a 741% annual increase across all injection attacks. For your KYC, this means you can no longer treat iOS users as lower-risk for this specific attack the way you once could.

Unfortunately, even advanced liveness models can’t counter injections. To stand a chance, your verification software needs more sophisticated features, like device attestation, root and jailbreak detection, and session-level signals.

Liveness Detection Standards

Because liveness models can be trained, there are two ways to measure how well they work against fakes.

The standard is ISO/IEC 30107-3. This is the international standard for Presentation Attack Detection (PAD) — the formal name for what liveness detection does. It defines how testers should evaluate a biometric system's ability to resist spoofing, and how results should be measured and reported, so different vendors' results can actually be compared on the same basis.

iBeta is the most recognized independent lab that tests against it. iBeta is accredited by NIST/NVLAP (the National Voluntary Laboratory Accreditation Program) to conduct this testing.

Testing runs in tiers, roughly matched to attack sophistication:

• Level 1 tests resistance to common, readily available 2D presentation attacks — printed photos, cutouts, screen replays — under cooperative testing conditions.
• Level 2 tests resistance to more sophisticated attacks, including 3D masks (silicone, latex, wrapped 3D paper, cloth), under less predictable capture conditions.

When evaluating a KYC software provider, checking whether they hold an iBeta confirmation letter and at which level is a great way to understand how much you can trust their liveness checks.

Choosing the Right Liveness Detection Approach

To wrap up, here are three pieces of advice that can help you make the most out of liveness control:

1. Know which attacks actually target your sector and region

Deepfake attacks concentrate heavily on crypto platforms specifically. Industry data puts the share of deepfake attacks aimed at crypto as high as 60%, with a 654% rise in deepfake incidents on crypto platforms between 2023 and 2024.

Injection attacks grew 9x in 2024 alone, driven by a 28x spike in virtual camera exploits specifically. Fraud clusters can also concentrate in specific countries.

So, build your verification flow around the countries your customers actually come from, and around the attack types most common in your specific industry. That will help to perform liveness checks that actually fend off breach attempts.

2. Liveness check in KYC is a supplement, not a substitute

Liveness detection isn't a complete KYC solution on its own. It needs to sit alongside standard checks (document verification, sanctions and PEP screening) plus checks specific to your customers' country of origin and your industry's regulatory requirements.

3. Check for independent certification, and specifically which level

Don't rely on a vendor's own accuracy claims. Ask for their iBeta confirmation letter and check whether it covers Level 1 or Level 2. That tells you how mature and rigorously tested their system actually is.

Match Liveness Checks to the Risk in Front of You

Pick one-shot or 3D liveness for each risk level, and customize the action sequence inside 3D checks. iBeta Level 1 and 2 certified, built into your KYC flow from the start. See all liveness features or test them in your account right now.