KYC used to be a document problem — a scan, a database check, a human comparing faces on a screen. It is now a video problem: institutions ask you to blink, turn your head, and prove you are physically present, because a photograph can be stolen but presence cannot. Or so the pitch goes. Liveness detection is a stack of software checks with known failure surfaces, and deepfake injection attacks target those surfaces directly — feeding the verifier what it wants to see instead of a camera feed. This is where the checks actually sit in 2026, and where pre-recorded and injected media still beat them.
ROUTE MAP (PLAIN ENGLISH)
Liveness verification comes in three generations. Passive liveness scores a single selfie against artifact detection — skin texture, moire patterns, edge consistency between face and background. Active liveness demands directed action — blink, turn, open mouth — to defeat photos and cutouts. Face biometric matching then compares the verified face against the photo ID on file and sometimes against a historical reference. Every generation answers a specific attack: photos, videos, masks — and every generation has moved the bar for what presentation media must fool.
The attack surfaces are equally layered. The strongest attacks do not fight the algorithms at all — they attack the input path. Injection attacks replace the camera feed at the software layer so the verifier receives synthetic or pre-recorded media as if it were live glass. Pre-recorded attack media beats passive checks when artifact detection misses it and beats active checks when it can answer the directed prompts — the action prompts that were designed to prove presence prove only that something responded in time. The whole method is a contest between artifact detection and media quality, run inside a verification window measured in seconds.
STEP 1 - HOW LIVENESS ACTUALLY VERIFIES
STEP 2 - PRESENTATION MEDIA
STEP 3 - INJECTION: ATTACKING THE FEED
STEP 4 - WHERE TO APPLY IT
STEP 5 - DETECTION ARMS RACE
WORKED EXAMPLE - ACCOUNT TIER SUBMISSION
Target: a fintech onboarding whose document check runs MRZ and barcode validation against the presented ID, whose liveness step is active (three randomized prompts), and whose face match runs against the ID portrait with a moderate threshold — provider-verified, device integrity checked but not hardware-attested. Recon establishes: the flows on this product tier are provider-default, not custom-tuned; the identity's ID portrait is consistent with the media asset prepared for it; and prior submissions for this identity number: none, so no cross-match floor exists. Submission: high-bitrate capture at the device's native front-camera resolution, prompt responses with human-latency variance (600–1400ms spread, never sub-300ms), lighting fixed and consistent through the sequence, feed arriving through a capture environment that passes integrity checks untouched. The document validates at barcode and MRZ level, liveness passes the action prompts inside the window, biometric match clears the moderate threshold against the portrait. Account opened at the tier's transfer limits — and the second-act discipline that matters more than the submission begins: no velocity, no immediate external transfers, account behavior indistinguishable from a real customer for the exact window during which post-KYC behavioral scoring is most alert.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
Liveness verification comes in three generations. Passive liveness scores a single selfie against artifact detection — skin texture, moire patterns, edge consistency between face and background. Active liveness demands directed action — blink, turn, open mouth — to defeat photos and cutouts. Face biometric matching then compares the verified face against the photo ID on file and sometimes against a historical reference. Every generation answers a specific attack: photos, videos, masks — and every generation has moved the bar for what presentation media must fool.
The attack surfaces are equally layered. The strongest attacks do not fight the algorithms at all — they attack the input path. Injection attacks replace the camera feed at the software layer so the verifier receives synthetic or pre-recorded media as if it were live glass. Pre-recorded attack media beats passive checks when artifact detection misses it and beats active checks when it can answer the directed prompts — the action prompts that were designed to prove presence prove only that something responded in time. The whole method is a contest between artifact detection and media quality, run inside a verification window measured in seconds.
STEP 1 - HOW LIVENESS ACTUALLY VERIFIES
- Passive checks: the verifier scores the submitted selfie for artifact tells — resampling patterns from upscaled video, unnatural eye reflection geometry, missing skin micro-texture, inconsistent lighting between face and environment, flat depth on what should be a three-dimensional face. One frame or a short burst, no user interaction, low friction — and a detection surface that improves with every published bypass it survives.
- Active checks: the flow instructs a specific action — turn your head, blink, read digits — and scores whether the submitted frames show compliance. Designed to defeat printed photos and static masks, active checks verify that something in front of the lens performed on demand; a video that answers the prompts, or a synthetic pipeline that renders them, satisfies the check's actual conditions.
- Biometric matching: the liveness-approved face is matched against the photo ID's portrait — and against any prior submission on the same identity, because repeat submissions under one identity with different faces is a fraud signal of its own. Thresholds are tuned per institution: high-security flows demand tight similarity; thin-verification flows accept looser matches.
- Challenge randomization: prompts issued server-side and timed — a compliant response before the prompt appears is impossible for a human and trivially arranged for an injected feed, which is why randomized timing exists and why a feed that reacts instantly can itself be the tell.
STEP 2 - PRESENTATION MEDIA
- Pre-recorded video: the original attack — play a recording of the required actions at the camera. Dies against artifact detection that recognizes compressed and re-encoded frames, dies against prompt randomization that demands real-time response, and survives against static or naive implementations that only check whether motion occurred.
- Deepfake synthesis: real-time face synthesis — swapping or rendering the target face onto a performing actor with lip-sync and expression transfer. Quality on published benchmarks keeps rising, but the tells that catch it are geometry-level: blinking irregularities, teeth and tongue rendering, hair-to-face boundary consistency, lighting that does not respond to head movement, and reflections that lag the face.
- The hybrid that works: pre-recorded footage of the real person where possible — a genuine face performing genuine actions — is stronger than any synthesis, because artifact detection has nothing synthetic to find. Where the genuine face cannot be recorded, high-bitrate synthesis with real-time prompt response and environment-consistent lighting narrows detection to the artifact forensics that remain.
- Media discipline: resolution matched to what a real front camera produces (not higher — oversharpened synthetic media reads as processed), compression consistent with the transport, and no re-encode layering that leaves resampling signatures. The media must look boringly native.
STEP 3 - INJECTION: ATTACKING THE FEED
- The input path: mobile KYC SDKs capture through the device camera API and stream frames to analysis — server-side or local. Anything between the glass and the analyzer is replaceable: the capture pipeline on a rooted or virtualized device, the runtime hooking the camera callbacks, the session proxying frames from a machine that never had a camera at all.
- Virtual camera and emulator routes: a virtual camera device registers as the hardware, feeding synthesized or pre-recorded frames through the normal API path — the SDK believes it is reading glass. Emulator environments with redirected camera feeds reach the same endpoint: the verifier receives frames from a source it was told is physical.
- SDK integrity defenses: attestation and integrity checks look for rooted devices, hooking frameworks, emulator signatures, and tampered app environments — the feed attack succeeds only where the client environment passes inspection. Server-side behavioral checks (frame cadence, sensor telemetry like gyroscope correlation with visual motion, unexpected feed consistency) catch feeds that hardware signals should contradict.
- Session layer realities: flows proxied through remote desktops where a real operator physically sits in front of a real camera with synthetic overlay on the face — the camera is genuine, the environment is genuine, only the presented face is substituted. The verifier's hardware trust assumptions all hold; only the person violates them.
STEP 4 - WHERE TO APPLY IT
- Verification depth is target selection: institutions are not equal — some run full biometric match with liveness and device attestation; others accept a document scan with a selfie that only checks presence loosely, or outsource verification to providers whose thresholds differ from the brand's own. The provider behind the flow is part of the recon.
- The application matters as much as the check: an onboarding flow for a low-risk product gets lighter verification than an account type that enables transfers, cards, or trading — map which account tier demands which depth before choosing where to spend a high-quality submission.
- Repeat-submission memory: identity verification records persist — a face verified under one identity cannot appear under another later without cross-matching. One media asset per identity, forever, and never reuse across personas even where the first submission passed.
- The document half still matters: deepfake liveness is worthless if the ID document itself fails authenticity checks — fonts, MRZ parsing, holographic features, barcode encoding, and database cross-checks against the document number. The video path and the document path must both clear.
STEP 5 - DETECTION ARMS RACE
- Forensic artifact detection: resampling and compression forensics, frequency-domain analysis separating synthesized texture from camera-native capture, physiological signal checks (remote photoplethysmography reading blood-flow pulse from skin, micro-expression analysis) — each raises the bar for media quality, and each has published failure conditions.
- Behavioral and sensor correlation: prompt-to-reaction latency (too fast is inhuman, too slow is clumsy), gaze that tracks the prompt, head motion that matches gyroscope telemetry on the device — a feed with no corresponding device motion is a static environment pretending to move.
- Downstream signals: verification passed but the account's first transactions pattern like cash-out behavior, the submission's network fingerprint matches known farms, or the same IP range carries many verifications — post-KYC behavioral scoring catches what liveness let through, because the account does not perform like the person it claimed to be.
- The institutional math: providers price false-accept against false-reject — a flow too strict loses real customers, too loose invites fraud. Where an institution sits on that curve is knowable from its product: high-value onboarding leans strict, low-friction consumer signups lean loose, and the method's venue choice follows the curve.
WORKED EXAMPLE - ACCOUNT TIER SUBMISSION
Target: a fintech onboarding whose document check runs MRZ and barcode validation against the presented ID, whose liveness step is active (three randomized prompts), and whose face match runs against the ID portrait with a moderate threshold — provider-verified, device integrity checked but not hardware-attested. Recon establishes: the flows on this product tier are provider-default, not custom-tuned; the identity's ID portrait is consistent with the media asset prepared for it; and prior submissions for this identity number: none, so no cross-match floor exists. Submission: high-bitrate capture at the device's native front-camera resolution, prompt responses with human-latency variance (600–1400ms spread, never sub-300ms), lighting fixed and consistent through the sequence, feed arriving through a capture environment that passes integrity checks untouched. The document validates at barcode and MRZ level, liveness passes the action prompts inside the window, biometric match clears the moderate threshold against the portrait. Account opened at the tier's transfer limits — and the second-act discipline that matters more than the submission begins: no velocity, no immediate external transfers, account behavior indistinguishable from a real customer for the exact window during which post-KYC behavioral scoring is most alert.
WORKING SEQUENCE
Code:
recon: verification provider + liveness type (passive/active) + attestation depth + account tier thresholds + prior submissions on identity -> media: native resolution + native compression + human prompt latency + consistent lighting + identity-exclusive asset -> inject or present: feed replaced where integrity passes, real environment where feed is watched, document path validated separately -> open: tier-appropriate first use only, nothing during the scoring window -> discipline: one media asset per identity forever, account behavior below behavioral flags, no cross-identity reuseQUICK ANSWERS
- Does active liveness (blink/turn) beat deepfakes? It beat photos and printed masks — its actual threat model. A synthetic or recorded feed that answers the prompts satisfies what the check measures: whether compliant motion appeared during the window. Prompt randomization and reaction-latency scoring tighten this, but presence was never what the prompts proved — response was.
- Why not just send a high-quality fake video? Artifact forensics read the video itself — resampling, compression layering, frequency signatures — and prompt timing demands real-time response a fixed recording cannot give. Pre-recorded media beats naive implementations; against a modern stack, the feed path or real-time synthesis with human latency is where runs live.
- What does device attestation actually stop? It stops the easy feed replacements — rooted devices, hooking frameworks, emulators, tampered runtimes. Where attestation is enforced, camera-path injection must clear integrity checks first, which pushes the attack either to pristine devices with clean software paths or to proxy routes where the hardware is genuine and only the person is substituted.
- Can the same face verify two different identities? Not safely — verification services maintain cross-submission matching precisely to catch one face under multiple identity numbers. Media assets are identity-exclusive for life; a reused face links two cases the moment either one is reviewed.
- Is the document check separate from the face check? Entirely — the document proves the ID is authentic (fonts, MRZ, barcode, database cross-check), the face step proves presence and match to the portrait. Both paths must clear independently, and in most fraud the weak path is not the video, it is a document that fails authenticity scrutiny after the liveness already passed.
- What catches a passed-KYC account later? Post-onboarding behavioral scoring — transaction velocity, destination diversity, network fingerprint, and device correlation across accounts. The submission opens the door; the first weeks of account behavior decide whether anyone looks closely at who walked through it.
RELATED