Liveness detection confirms a real, present human is being captured rather than a photo, mask, screen replay, or deepfake, and comes as active or passive. It is the frontline defense against spoofs held up to the camera, but on its own it does not prove the capture came from a genuine camera.
What is liveness detection, in plain English?
Liveness detection checks that the face in front of the camera belongs to a real, present human and not a spoof. Its job is to reject a printed photo, a mask, a screen replay of a video, or a deepfake held up to the lens. It comes in two forms: active liveness asks the user to do something, like turn their head or blink, while passive liveness works from a single capture using cues the user never sees.
It is the natural partner to face match. A face match tells you two images look alike; liveness tells you the selfie was a genuine live person rather than a replay of the real owner. Without liveness, a strong match score is easy to fake with a photo or video of the target, so the two are almost always run together.
Its important limit is scope. Liveness confirms a live human was captured, but it does not prove the capture came from a genuine camera. That is exactly the gap injection attacks exploit, feeding synthetic media below the camera layer. So liveness needs to be paired with device integrity and capture-provenance checks, and its spoof rates tracked as deepfake tools keep improving.
Active versus passive liveness
What changes | Active liveness | Passive liveness |
User effort | Do an action: blink, turn, smile. | Nothing extra, one capture. |
Friction | Higher, more steps and retries. | Lower, nearly invisible. |
Coaching risk | Actions can be scripted or replayed. | Nothing obvious for a coach to script. |
Best fit | Higher-assurance step-ups. | Smooth, high-volume onboarding. |
Who is involved?
Who | Their role |
The user | Presents their live face, sometimes performing an action for active liveness. |
The biometric vendor | Runs the liveness model and returns a live or spoof result alongside the face match. |
The fraud team | Pairs liveness with device checks and tracks spoof rates over time. |
The attacker | Tries photos, masks, replays, and deepfakes, or bypasses the camera with injection. |
What it looks like in practice
In practice
A fraudster tries to open an account with a stolen ID and a printed photo of the real owner held to the phone. The face match likes the similarity, but passive liveness flags the flat texture and lack of depth, and the case fails. The spoof held to the lens is exactly what liveness is built to stop.
A month later a different attacker skips the lens entirely and injects a deepfake through a virtual camera. Liveness sees smooth, natural motion and passes it, because nothing physical was presented. The face was fake but the liveness model had no artifact to catch. Only the device-integrity check, spotting the virtual camera, stopped it. Same defense, two very different outcomes.
Why it matters to operators
Liveness is what makes biometrics trustworthy at all. Without it, every face match is one clear photo of the target away from being beaten, which would make remote onboarding nearly useless against impostors. It is the control that turns a selfie from a picture into evidence of a present person.
The mistake is treating it as complete. Liveness proves a live human was captured; it does not prove the image came from a real camera, which is how injection attacks slip past. So pair liveness with device integrity and capture-provenance checks, and keep watching its spoof rates, because deepfake and mask technology improves and yesterday's strong liveness can weaken over time.
What to watch in the data
- Flat texture and no depth. Missing depth cues and even lighting point to a photo or screen replay rather than a real face.
- Pass with a virtual camera. A liveness pass on a session served by a virtual camera or emulator suggests injection, not a genuine capture.
- Rising spoof rates. A creeping increase in spoofs that get through can mean attack tooling has outpaced your liveness model.
- Scripted actions. Perfectly timed blinks or head turns can signal a replayed or coached active-liveness attempt.
- Liveness alone. A flow that relies on liveness with no device or provenance check is exposed to injection by design.
Quick questions
What is the difference between active and passive liveness?
Active liveness asks the user to perform an action like blinking or turning their head. Passive liveness works from a single capture using cues the user never sees. Passive adds less friction; active can offer higher assurance.
Does liveness stop deepfakes?
It stops deepfakes held up to the camera, but not deepfakes injected below the camera layer. Injection bypasses the lens, so liveness needs device integrity and provenance checks to cover that gap.
Why pair liveness with face match?
Face match confirms similarity; liveness confirms a real, present human. Alone, a match can be beaten with a photo of the target. Together, they confirm the right person is genuinely present.
Can liveness be beaten?
Yes, by high-quality masks, sophisticated replays, and especially injection attacks that never present anything physical. That is why spoof rates must be tracked and liveness layered with other controls rather than trusted alone.
Is passive liveness less secure than active?
Not inherently. Each has strengths: passive reduces friction and gives coaches nothing obvious to script, while active can raise assurance for step-ups. The right choice depends on the risk of the flow and the attack patterns you face.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.