Active liveness is a check that asks the user to do something on camera, like blink, smile, or turn their head, to prove a real live person is present. It blocks the simplest spoofs, where a fraudster holds up a printed photo or a static mask to pass as someone else.
What is active liveness, in plain English?
Active liveness asks the user to perform an action on camera during identity verification: blink, smile, nod, or turn their head to follow a prompt. The action is the proof. A printed photo cannot blink, a static mask cannot turn to follow an instruction, so requiring live motion filters out the crudest presentation attacks where a fraudster simply holds up an image of someone else.
It sits inside the broader family of liveness detection, which exists to answer one question during a selfie or video check: is there a real, live person in front of the camera right now, or a spoof? Active liveness answers it by demanding a response, whereas passive liveness analyzes the image without asking the user to do anything.
Its strength is that it defeats simple, physical spoofs cheaply and understandably. Its weakness, and the reason it is rarely used alone anymore, is that the motion it asks for can now be faked. So active liveness is best understood as one layer, not the whole answer.
Active liveness versus passive liveness
What changes | Passive liveness | Active liveness |
User action | None; runs silently on the capture. | User must blink, smile, or turn on prompt. |
Experience | Seamless, invisible to the user. | More friction, but intuitive to follow. |
Blocks | Spoofs via image and signal analysis. | Static photos and masks that cannot respond. |
Weak spot | Depends on model quality. | The prompted motion can be faked in real time. |
What it looks like in practice
In practice
A neobank runs active liveness at onboarding: after the selfie, the app asks the user to turn their head slowly to the left and then the right. A fraudster attempting to open an account with a stolen ID holds a printed photo of the victim up to the camera, and the check fails instantly because the flat image cannot turn.
A more sophisticated attacker, though, uses a deepfake tool that renders a synthetic face turning its head in real time and injects the video into the app, bypassing the physical camera entirely. The head turn passes. The team learns that active liveness alone was never going to catch this, and pairs it with injection detection that checks whether the frames actually came from a live camera rather than a virtual one.
Why active liveness matters to operators
Active liveness is a cheap, understandable defense against the most common physical spoofs: printed photos, screen replays, and static masks. For a lot of low-to-medium risk flows it raises the cost of the simplest attacks meaningfully, and users generally understand why they are being asked to blink or turn.
The trap is treating a passed check as proof the video is real. Deepfake tools and injection attacks can now render a blink or a head turn in real time and feed it straight into the verification pipeline, never touching a real camera. So the operator lesson is to pair active liveness with device and injection checks, and to never treat a motion prompt passing, on its own, as evidence that a genuine person sat in front of a genuine camera.
What to watch for
- Injection attacks. Synthetic video fed directly into the app bypasses the camera entirely, so a passed motion prompt proves less than it seems.
- Real-time deepfakes. Tools that render blinks and head turns on demand defeat the motion challenge itself.
- No device signals. Without checks that frames came from a real camera, active liveness can be spoofed at the pipeline level.
- Accessibility friction. Some users struggle with motion prompts, so overly strict checks can lock out legitimate people.
- Single-layer reliance. Using active liveness as the only defense, rather than one layer among several, leaves clear gaps.
Quick questions
How is active liveness different from passive liveness?
Active liveness asks the user to perform an action, like a blink or head turn. Passive liveness analyzes the capture silently without asking the user to do anything. Passive is smoother; active is more explicit but can be defeated by faked motion.
Does active liveness stop deepfakes?
Not on its own. Modern deepfake tools can render prompted motion such as blinks and head turns in real time, so active liveness must be paired with injection and device checks to catch synthetic video.
What is an injection attack?
It is feeding pre-made or synthetic video directly into the verification pipeline, bypassing the real camera. Because the frames never come from a live capture, motion prompts can be satisfied by the injected content.
Is active liveness still useful?
Yes, as one layer. It cheaply blocks the most common physical spoofs like printed photos and masks. It just should not be the only defense, given how easily prompted motion can now be faked.
Why pair it with device checks?
Because device and injection checks verify that the video actually came from a real camera on a real device. That closes the gap active liveness leaves open, where synthetic frames satisfy the motion prompt.
Does active liveness add friction?
Yes, more than passive liveness, since the user has to follow a prompt. The trade-off is that the action is intuitive, but for high-volume flows the added friction and accessibility impact are worth weighing.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.