Facial recognition matches a face against a reference image or searches it across a gallery, used for one-to-one verification or one-to-many search like spotting a repeat fraudster. It can both confirm identity and surface known bad actors, but a high match is strong evidence, not certainty.
What is facial recognition, in plain English?
Facial recognition turns a face into a numeric template and compares it to other faces. In its one-to-one form it verifies a claim: does this selfie match this specific reference image, like the photo on an ID. In its one-to-many form it searches: does this face appear anywhere in a gallery, such as a list of known fraudsters or previously banned users. The first confirms identity; the second surfaces bad actors.
The output is always a score, a probability that two faces are the same person, not a yes or no. Accuracy shifts with image quality, pose, lighting, and demographic factors, and those factors can push error rates unevenly across groups, which is both an accuracy and a fairness concern you have to manage deliberately.
In fraud and AML, facial recognition underpins onboarding checks and repeat-offender detection. Two rules keep it honest: treat scores as probabilities rather than proof, and always pair it with liveness, because a high match is spoofable without a check that a real, present human is in front of the camera.
One-to-one versus one-to-many
What changes | One-to-one (verify) | One-to-many (search) |
The question | Is this the person they claim to be? | Have we seen this face before? |
Compared against | A single reference, like the ID photo. | A whole gallery of stored faces. |
Typical use | Onboarding and step-up verification. | Spotting repeat or banned fraudsters. |
Main risk | Spoof beating the match. | False hits as the gallery grows. |
Who is involved?
Who | Their role |
The user | Presents a face to be verified, or unknowingly searched against a gallery. |
The biometric vendor | Generates templates and returns match scores for verification or search. |
The fraud and privacy teams | Govern retention, consent, thresholds, and fairness across demographic groups. |
The repeat fraudster | Reappears under a new name, hoping a gallery search does not link them to the old one. |
What it looks like in practice
In practice
A user banned last quarter for chargeback abuse comes back under a fresh name, new email, and new card. The one-to-one document check passes, because the new application is internally consistent. On its own, onboarding would welcome them back.
A one-to-many search against the gallery of previously banned faces returns a strong hit on the old account. An analyst confirms the same person under two identities and blocks the signup. The score was not a certainty, so it went to a human, but paired with liveness and the banned-face gallery it was enough to stop a known bad actor returning.
Why it matters to operators
Facial recognition does two jobs at once. One-to-one keeps impostors out at onboarding, and one-to-many catches the repeat offenders who simply change their paperwork. That second capability is powerful, because a lot of fraud is the same people coming back through the front door with new details.
The responsibility that comes with it is real. Scores are probabilities, and error rates can fall unevenly across demographic groups, so treat a match as strong evidence, not certainty, and route consequential decisions to human review. Govern data retention and consent carefully, and always pair recognition with liveness, since a high match is spoofable without it.
What to watch in the data
- Gallery hit on a new identity. A fresh application matching a banned face is a strong repeat-offender signal worth a manual confirm.
- Uneven error rates. Match performance that varies by demographic group is both an accuracy and a fairness issue to monitor.
- Match without liveness. A high score with no liveness check can be a photo, mask, or deepfake, not a real person.
- Score at the margin. Near-threshold results should go to review, not an automatic accept or reject.
- Retention and consent gaps. Storing faces without clear consent and retention limits is a compliance risk on top of a fraud one.
Quick questions
How is facial recognition different from face match?
Face match is the one-to-one case: comparing a selfie to a specific ID photo. Facial recognition is the broader capability that also includes one-to-many search across a gallery, such as spotting a repeat fraudster.
Is a match a certainty?
No. It is a probability that two faces are the same person. Image quality, pose, lighting, and demographic factors all affect it, so a high match is strong evidence that should support, not replace, a human decision on consequential cases.
Why does liveness matter here too?
Because a match can be driven by a photo, mask, or deepfake. Liveness confirms a real, present human is in front of the camera, so recognition without it is spoofable regardless of how high the score is.
What are the fairness concerns?
Error rates can differ across demographic groups, which means false matches and misses may not be evenly distributed. That requires monitoring performance by group and setting thresholds and review paths that account for it.
How does it catch repeat fraudsters?
Through one-to-many search. When someone returns under a new name, their face can be matched against a gallery of past bad actors, linking the new identity to the old one even when every document detail has changed.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.