Liveness Detection

Many devices today unlock via face or fingerprint. In doing so, the device compares a captured image with a stored pattern. But a photo of a face looks almost exactly like the real face in such an image. Liveness Detection is the additional check that detects precisely this difference. It doesn’t answer the question “Who is this?”, but rather the question “Is this even a living person?”. Only both checks together make a login via a body feature secure.

Why a photo would otherwise become a master key

Without this check, facial recognition is surprisingly easy to trick. A printed photo, a video on a second phone, or a silicone mask are often enough. Such attacks are called spoofing, meaning the faking of someone else’s identity. The problem is especially tricky because faces are public. A password can be kept secret, but one’s own face is visible on every social network.

Added to this is a new risk: deepfakes, meaning AI-generated videos of real people that look deceptively authentic. Anyone opening a bank account via video identification today usually just holds their face and ID card up to the camera. An attacker could instead feed an artificially generated face into the video stream. Liveness Detection is the technology meant to catch such forgeries.

Legislators are also involved here. Banks and insurance companies must reliably verify the identity of their customers. German and European regulatory authorities therefore explicitly require proof for online procedures that a real person was present.

Active and passive verification methods

Two basic types are distinguished. In the active method, the user has to do something: blink, turn their head, smile, or read out a number. The system randomly assigns the task. A prepared video cannot react to this spontaneously. The downside is the effort required from the user, and many people abandon the process in frustration.

Passive methods run invisibly in the background. They evaluate details that a forgery rarely manages to replicate cleanly. Real skin reflects light differently than paper or a display. A face is three-dimensional, a photo is flat. Some systems even measure tiny color fluctuations in the skin caused by the pulse. For all of this, a neural network is usually trained—that is, a learning program that has learned the difference from many real and fake examples.

Special hardware also helps. Apple's Face ID projects around 30,000 invisible infrared dots onto the face and uses them to measure its shape. A flat photo fails this test immediately. However, such sensors are expensive, which is why pure software solutions for ordinary phone cameras are more widespread.

From unlocking phones to opening bank accounts

The technology is most commonly encountered when unlocking a smartphone. Almost every modern device checks in the background whether a real human is actually sitting in front of it. The same thing happens when paying via face recognition in the App Store. Users usually don’t notice any of this.

It becomes more visible with online identification. Anyone opening an account, activating a SIM card, or applying for a loan often has to slowly turn their head or position their face within a frame. Border controls with automated gates and corporate access systems also rely on this.

A common misconception is that Liveness Detection is a solved problem. In fact, it’s an arms race: attackers develop better masks and deepfakes, providers retrain their models in response. Security researchers regularly manage to outsmart commercial systems too. Experts therefore recommend combining biometric methods with a second factor, such as a code on another device.