Liveness detection

Liveness detection is an identity-verification check designed to determine whether a biometric sample, such as a face scan, comes from a live person present at the time of capture rather than a spoof or replay. It helps prevent presentation attacks using photos, videos, masks or synthetic media.

In facial verification, liveness detection is commonly used during selfie capture to assess whether the camera is seeing a real, physically present person. It is one layer of defense against presentation attacks, in which someone tries to fool a biometric system with an artifact or recording.

A successful liveness result does not by itself establish who the person is. It is typically combined with face matching, document checks and risk signals to support an identity-verification decision.

How it works

Passive liveness detection analyzes a single image or short video without asking the user to perform an action. It may examine texture, depth cues, reflections, motion patterns and signs that an image has been recaptured from a screen. Active liveness detection asks the user to respond to a prompt, such as turning their head, blinking or following an on-screen indicator.

• Passive methods can reduce user friction but must be tested against evolving spoofing techniques.
• Active methods can add evidence of real-time participation, but prompts may make the process less accessible or easier for attackers to anticipate.
• Some systems use specialized hardware, such as infrared or depth sensors, while others operate with a standard phone camera.

Limits and evaluation

No liveness method is perfect. Performance can vary with camera quality, lighting, skin tone representation in testing data, disability-related access needs and the type of attack. Generative AI has also increased the importance of testing against injection attacks, where manipulated images or video are supplied directly to an application rather than shown to a camera.

Organizations should assess liveness systems using attack scenarios relevant to their service, including printed photos, screen replays, masks, edited video and digital injection. Relevant standards include ISO/IEC 30107, which addresses biometric presentation attack detection.