Liveness Detection Now Has Two Tests

Liveness detection is a biometric check that confirms a real, physically present person is in front of the camera rather than a photograph, a screen replay, a mask, or a synthetic video. Face liveness detection runs alongside face matching during identity verification and returns a confidence score.

Authenticate runs that check on every identity verification it processes. Active and passive liveness score together, matched against the document photo inside the same 30-second flow, across 203 countries and 7,500+ government ID types. What the check is for changes with the industry. A fintech clears KYC. A telehealth platform confirms a patient at intake. A marketplace vets a worker before the first job. A host screens a guest before check-in. Authenticate has processed more than 2 million users across industries, countries, and use cases.

For most of its history there was one published test for liveness. On 30 November 2024, CEN published a second, and it covers a class of attack the first was never written to reach. Most vendor certification pages still cite only the first.

So when a vendor answers a question about deepfakes with a certificate number, the number matters less than which of the two tests produced it, and on what date.

In 2024, a trojan collected the exact movements a liveness check asks for

GoldPickaxe, an iOS trojan Group-IB documented on 15 February 2024, harvested the exact face movements a liveness check asks for. Group-IB confirmed its distribution in Thailand and attributes it to GoldFactory, an actor whose malware family also reached Vietnam. It arrived disguised as more than 20 legitimate apps, including a government "Digital Pension" app.

The instruction list is the part that matters. Describing the Android build, and noting that it behaves "similarly to the iOS version," Group-IB records that victims recording a video of their faces were given "a few instructions such as to blink, smile, face left, face right, nod down, up and to open mouth."

Read that list against any liveness prompt you have ever completed. It is the same list.

Group-IB's report relays what Thai police confirmed next. Criminals installed banking apps on their own Android handsets and used the captured face scans to clear the facial recognition step on victims' accounts. Those accounts had a facial recognition step because in March 2023 the Bank of Thailand told banks to replace one-time passcodes with facial biometric verification: on transactions of 50,000 baht or more, on daily transfers above 200,000 baht, and on any request to raise a mobile transfer limit past 50,000 baht. Group-IB put that first threshold at approximately USD 1,430.

GoldFactory defeated a control introduced in March 2023 inside twelve months, using the control's own challenge script.

Why didn't the document check catch it?

Document verification confirms that an identity document is genuine and that its data is internally consistent. In the GoldPickaxe case there was no forged document to catch. The criminals held a real person's genuine identity, a real face scan, and a real banking credential. Document forensics had nothing to flag.

That is not a shortcoming in the method. Document verification runs hologram pattern analysis, font consistency checks, and machine-readable zone validation, and it catches altered and counterfeit credentials. FinCEN's Alert FIN-2024-Alert004, issued 13 November 2024, names criminals "altering or creating fraudulent identity documents" with generative AI among the schemes it asks financial institutions to report, under the key term FIN-2024-DEEPFAKEFRAUD. That layer earns its place. You can read more on what document forensics can and cannot prove.

GoldPickaxe was the other case. The identity was authentic and stolen whole. When that happens, one layer is left standing: the one that decides whether the face in front of the camera belongs to a living person who is actually there.

Why active liveness detection let a stolen face through

Active liveness detection issues a challenge and grades the response: blink, turn your head, smile. The reasoning is sound, because a printed photograph cannot blink and a face on a screen cannot turn. The weakness is that the challenge set is small, public, and close to identical across vendors.

There are only so many things a face can be asked to do on camera. GoldFactory never had to break the challenge. It asked the victim to perform it, recorded the result, and kept the footage.

Passive liveness detection asks for nothing. It reads the captured frames for signals a real face produces and a reproduction does not: skin texture, depth cues, the behavior of light across a surface. GoldFactory could not have harvested that, because there is no prompt to record. What it could still harvest was the footage itself.

Where that footage enters the system is the question both methods leave open, and it is the question the two certificates answer differently.

What does an iBeta Level 2 liveness certificate prove?

An iBeta Level 2 certificate records that an accredited lab attacked a liveness system with physical artifacts presented to its camera, under ISO/IEC 30107-3, and measured how many succeeded. Per iBeta's published methodology, Level 1 artifact materials are capped at $30 and Level 2 at $300, with Level 2 running two to four days per subject or species.

Level 1 is the cheap end: artifacts built inside an eight-hour window from what iBeta describes as equipment readily available in a normal home or office. Level 2 is the workshop end, where iBeta's examples include resin and latex masks. Level 3 exists above both, and a handful of vendors hold it.

Authenticate holds Level 2, alongside SOC 2 Type II, HIPAA-ready handling, PCI DSS v4.0, and NIST 800-63-3. Clearing it is a real result and a hard one to get. It is also, on its own, an answer to only half the question.

ISO/IEC 30107-3:2023 limits itself in its own scope clause, which states that "the attacks considered in this document take place at the biometric capture device during presentation," meaning a presentation attack detection certificate issued against that standard does not cover attacks injected after the capture device. The standard puts it plainly: "Any other attacks are considered outside the scope of this document."

The certificate is not overselling itself. It states precisely what was tested. The market reads it as a general defense against deepfakes, and it was never written to be one.

Which test covers injection attacks?

An injection attack feeds a prepared or synthetic video straight into an application's video stream, using a virtual camera, an emulator, or a tampered device, so nothing is ever presented to a physical lens. ISO/IEC 30107-3 does not cover it. CEN/TS 18099, published on 30 November 2024, does.

The specification came with a deadline attached. ETSI TS 119 461, the identity proofing standard behind eIDAS, requires qualified trust service providers to have injection attack detection tested by an accredited laboratory against CEN/TS 18099 at level Substantial, or level High for extended identity proofing, before the end of 2026.

The attack volume is what put it there. iProov's Threat Intelligence Report 2025 cataloged 127 face swap tools, 91 virtual cameras and 10 emulators, which it describes as more than 115,000 potential attack combinations. Its April 2026 report recorded injection attacks against iOS devices up 741% across 2025, including a 1,151% year-over-year rise in the second half.

The exposure is not hypothetical. 400 companies per day are hit by deepfake identity fraud, and identity fraud costs $6 billion annually in the US alone.

Which signals catch an attack the camera never sees

Detecting an attack that never reaches the camera takes evidence from outside the image. Four families of signal do that work, and none scores the face: capture integrity, session binding, frame provenance, and device context. Each examines how the video arrived rather than what it shows. Liveness detection software reading the face alone sees none of them.

Capture integrity

A virtual camera driver sits between the lens and the app and hands over a file. Emulator detection, driver inspection, and hardware attestation establish where the stream actually came from, before a single frame is scored.

Session binding

A challenge generated server-side for one session, valid only for that session, cannot be satisfied with footage recorded last Tuesday. GoldFactory's stolen clips were worth stealing because the script was predictable and reusable. A challenge that is neither is worth far less.

Frame provenance

Compression history, sensor noise patterns, and the residue a face swap pipeline leaves behind survive into the delivered video, and all of it can be scored whether or not the face looks alive.

Device and behavioral context

A brand-new device. A rooted handset. A data-center IP address. A session completed faster than a human thumb can move. Cheap signals, individually weak, and each one costs an attacker real effort to defeat.

Authenticate's passive layer scores screen-replayed and injected video on frame evidence rather than on whether the face looks alive, and it runs on every check alongside the active prompt. Biometric liveness detection and face matching resolve together, against the document photo, inside the same 30-second flow.

Each check comes back as its own field: liveness status and method, biometric match confidence, document result. One verdict tells you nothing nine months later. Four fields let you reconstruct the decision. As of 2026 that flow runs in 203 countries, through Medallion™ or a single liveness detection API call.

See how Authenticate's selfie verification and liveness check fits into an onboarding flow.

Frequently asked questions

What is the difference between active and passive liveness detection?

Active liveness detection prompts you to perform an action, such as blinking or turning your head, and grades the response. Passive liveness detection analyzes the captured image or video without asking for anything, scoring texture, depth, and display artifacts. Active adds friction and a predictable script. Passive removes both. Running the two together covers more attack types than either one alone.

Can liveness detection detect deepfakes?

Liveness detection catches some deepfakes and not others, depending on how the deepfake reaches the system. A deepfake played on a screen and held up to a camera is a presentation attack, tested under ISO/IEC 30107-3. A deepfake injected into the video stream through a virtual camera never touches the lens, and that class is tested under CEN/TS 18099 instead.

What does iBeta Level 2 certification cover?

iBeta Level 2 certification means an accredited laboratory tested a liveness system against physical artifacts presented to its camera under ISO/IEC 30107-3 and measured the proportion that got through. Level 2 artifact materials are capped at $300 under iBeta's published methodology, with testing run over two to four days per subject or species.

What is selfie verification, and how does it relate to liveness detection?

Selfie verification asks a user to capture a live photo or short video of their own face, which the platform compares against the photo on their identity document. Liveness detection is the step inside that flow deciding whether the selfie came from a living person present at the camera. Authenticate runs both inside the same 30-second check.

Is liveness detection the same as facial recognition?

Liveness detection and facial recognition answer different questions. Facial recognition decides whether two faces belong to the same person, such as a selfie compared against the photo on a driver's license. Liveness detection decides whether the face in front of the camera belongs to a living person who is physically there. A verification flow needs both.

Can a photo or a recorded video pass a liveness check?

A printed photo or a video replayed on a screen is the attack class that presentation attack detection is built for and independently tested against, and a certified system rejects those at high rates. That same recorded video delivered through a virtual camera driver, instead of shown to the lens, is a different attack under a different specification.

What the second certificate does not settle

CEN/TS 18099 is a Technical Specification rather than a full International Standard. The ISO/IEC version is still in draft and is not expected before around 2027, so injection attack results are not yet comparable across laboratories the way presentation attack results have become. The deadline is real. The common yardstick is not, yet.

Until it arrives, a liveness certificate tells you which of the two tests a vendor passed, and on what date. A vendor holding only the older one is not behind the standard. It is behind the attack.

Verify your first user free. Get started with Authenticate's identity verification platform.