Liveness Under Attack: Defending Selfie Checks From Deepfakes

Selfie-based liveness was designed to stop a fraudster holding a printed photo or replaying a video to a phone camera. That threat model is now incomplete. Generative tools can produce a convincing face from a single stolen image, and virtual camera drivers can feed that face straight into your verification flow. If your onboarding still assumes the camera it reads is the physical camera on the device, you have a gap worth closing.

Two Attack Classes, Different Fixes

Liveness fraud splits into two categories that require separate controls. Conflating them leads to spending on one while the other stays open.

• Presentation attacks put a fake artifact in front of a real camera: a printed photo, a screen replay, a silicone mask, or a paper cutout with eye holes. Passive and active liveness models are trained to detect these through texture, depth, moire patterns, and micro-movement.
• Injection attacks bypass the camera entirely. A fraudster uses a virtual camera, an emulator, or a tampered app to inject a pre-rendered deepfake video into the capture pipeline. No amount of frame-level liveness analysis helps if the frames were never captured by a real sensor.

ISO/IEC 30107-3 gives a testing standard for presentation attack detection, and independent labs publish conformance results. Ask vendors for their tested attack instrument set and the false-accept rate at each level, not a marketing claim of 99 percent.

Detecting Injection Without Over-Collecting

Because injection attacks defeat the camera, the strongest signals come from the environment around the capture, not the pixels inside it. Useful checks include:

• Camera provenance: confirm the stream originates from a hardware sensor rather than a virtual device, and flag emulators, rooted or jailbroken devices, and known virtual-camera drivers.
• Integrity attestation: use platform APIs such as Play Integrity and App Attest to verify the app and OS have not been tampered with.
• Session binding: issue a server-generated challenge per session so a pre-rendered clip cannot satisfy an unpredictable prompt.
• Metadata consistency: compare declared device, resolution, frame timing, and codec against what a genuine sensor on that hardware would produce.

None of these require storing raw biometric templates indefinitely. The provenance and integrity signals are transient risk indicators. You can score them, log the decision, and discard the underlying capture on a short clock. That keeps your defense strong while limiting how much sensitive data sits in retention waiting to be breached.

Layering for a Defensible Decision

No single control is sufficient, and a fraudster only needs one open door. A layered posture combines presentation attack detection, injection detection, document authentication, and behavioral signals into a composite score. When any layer flags, route the case to a step-up path rather than a hard rejection, because passive checks carry false positives that punish legitimate users on older or unusual devices.

A chat-based flow gives you room to run these steps in sequence without a single monolithic upload screen. You can request a live capture only after device integrity clears, bind the challenge to the conversation, and escalate to a video or human review inside the same channel. Each step produces an auditable event, which matters when a regulator asks how you concluded a customer was genuine.

What to Measure and Retain

Track the metrics that reveal drift before fraud losses do: attack presentation rate, step-up conversion, false-reject rate by device class, and time-to-decision. Rising false rejects on specific hardware usually signals a tuning problem, not more fraud. For retention, separate the decision record, which you keep to satisfy audit and AML obligations, from the raw biometric capture, which you can delete on a configurable short window once the check resolves. Document the split in your data retention policy so deletion is provable, not assumed. Deepfakes will keep improving; a layered, minimally retentive design ages far better than any single model. This is general information, not legal advice.