A new customer opens an account, uploads a valid ID, and takes a selfie. The face matches the photo on the ID, so the verification goes through.

But that check doesn’t answer a key question: Is there actually a real person in front of the camera?

Someone could use a printed photo, replay a video, or use a synthetic face and still look convincing on screen. If your KYC flow only checks the image and the face match, you could approve an identity without confirming the person behind it.

That’s where liveness detection comes in. It checks whether a real person is present during the selfie capture. This article covers how fake selfies bypass basic KYC checks, how liveness detection works, and how to add it to your verification flow without complicating onboarding.

What Liveness Detection Actually Does

Liveness detection answers a simple question: Is there a real, present human behind the camera at the time of verification?

This is formally known as Presentation Attack Detection, or PAD, the term used across the biometric security industry and in international testing standards. Instead of accepting a static image, liveness checks evaluate signals that indicate human presence. This includes facial movement, depth, light reflection, and how the face interacts with the camera during capture.

In practice, this changes how your system makes decisions. You are no longer asking, “Does this face match the ID?” 

You are also asking, “Was this face captured live right now?”

The second question is what stops most spoofing attempts early. 

It is also important to place this correctly in your flow. Liveness does not replace identity verification. It strengthens it at the exact point where users prove they are physically present. Without it, your system assumes every image is real. With it, you begin to validate how that image is produced before accepting it.

Passive vs Active Liveness and the Impact on UX

Not all liveness checks work the same way. The approach you choose directly affects both fraud prevention and user experience.

1. Passive liveness

Passive liveness runs in the background during a normal selfie capture. The user does not need to follow instructions or perform actions. The system analyzes signals like texture, depth, and natural movement without interrupting the flow.

This keeps onboarding fast and smooth. It works well in mobile-first environments where users expect quick verification. The limitation is that, on its own, it may not be strong enough against more advanced spoofing attempts.

2. Active liveness

Active liveness requires the user to do something specific. This could be turning their head, blinking, or following on-screen prompts. These actions confirm that the person is physically present and interacting in real time.

This adds a stronger layer of security, especially against replay attacks. The trade-off is that it can slow users down or introduce friction if the experience is not well designed.

How to think about both

In practice, most fintech teams combine both approaches. Passive liveness handles the majority of users with no friction. Active liveness is triggered when risk increases.

This allows you to keep onboarding simple for legitimate users while still controlling for higher-risk scenarios. The goal is not to choose one approach, but to apply both based on context.

Why Selfies Alone Fail Against Modern Fraud

A selfie can look like a valid match without proving that the person presenting it is real and physically present. When there is no check for this, a fraudulent identity can pass the selfie stage and move further into the onboarding process.

In practice, this creates a gap:

• A loan or credit line can be issued against a synthetic identity that never repays.
• An onboarded account can be used to move stolen or laundered funds through the platform.
• A compliance gap can surface during an audit or investigation, long after onboarding appears complete.

When a fake selfie gets through, the consequences can extend well beyond onboarding. This is why fintechs need to understand how attackers get around basic selfie checks.

Common Spoofing Methods Fintechs Need to Account For

To implement liveness properly, you need to understand how attacks actually show up in your flow. Most spoofing methods follow a few consistent patterns.

1. Photo replay attacks

The attacker presents a printed or digital image of a real person to the camera. In weaker systems, this can pass as a valid selfie because there is no depth or presence check.

2. Video replay attacks

A recorded video of a real user is played during verification. Because there is movement, basic motion checks may still pass, making this harder to detect without stronger liveness signals.

3. Deepfake and synthetic faces

AI-generated faces or manipulated videos are used to create realistic but fake identities. These can mimic natural expressions and are becoming more accessible.

4. Emulator and injection attacks

Instead of using a camera, the attacker feeds pre-recorded or generated content directly into the verification flow. From your system’s perspective, it appears as if the input is coming from a real device.

All of these methods exploit the same weakness. They rely on systems that accept visual input without validating how that input was created.

This is why liveness detection needs to evaluate both the face and the capture environment, not just the image itself.

How to Implement Liveness Without Adding Friction

A common concern is that liveness detection will slow down onboarding or increase drop-offs. This usually happens when it is applied as a fixed step for every user.

A better approach is to apply liveness dynamically based on risk.

1. Start with passive liveness as the default

Let most users complete verification without interruptions. This keeps the flow fast and aligned with user expectations.

2. Introduce step-up checks when risk increases

Trigger active liveness when certain signals appear, such as:

• A new device with no history
• Unusual session patterns or repeated failed attempts
• Inconsistent location data

This ensures that additional friction is only applied when needed.

3. Optimise for mobile conditions

Most onboarding happens on mobile devices, often under varying network conditions. Liveness checks should be lightweight, fast, and able to handle different camera qualities.

4. Provide clear user feedback

If a check fails, the user should understand why and what to do next. Clear guidance reduces abandonment and helps legitimate users complete verification.

When implemented this way, liveness does not slow users down. It adds control exactly where it matters.

What to Look for in a Liveness Detection API

Choosing a liveness detection API goes beyond checking whether a provider claims to detect fake selfies. You need to know how the system performs, what evidence supports those claims, and whether it fits your users and onboarding flow.

When evaluating a provider, check these areas:

1. Real-time speed

Check how long the liveness check takes from capture to result. A slow response can add friction to onboarding, especially for users on weaker networks or older devices.

2. Independent testing against a recognized standard

Look for evidence that the provider has independently tested its Presentation Attack Detection (PAD) capabilities against ISO/IEC 30107-3. Check the testing lab, product version, configuration, and attack types covered so you know what the results actually apply to.

3. Detection accuracy

Do not rely on a single accuracy percentage. Ask for false acceptance and false rejection rates, along with the attack types and test conditions used to measure performance.

4. Device and environment compatibility

Your users will access verification from different devices and network conditions. Check which operating systems, browsers, cameras, and device types the API supports, then test it against the environments your users actually use.

5. Coverage across attack types

Find out which attacks the API has been tested against. Look beyond basic photo spoofing to threats such as video replay, masks, synthetic or manipulated faces, and injection attacks where relevant.

6. Easy integration

Check how easily the API fits into your existing onboarding flow and technical stack. Clear documentation, SDKs, test environments, and straightforward API responses can reduce the work required to integrate it.

7. Actionable outputs

A liveness result should give your system something it can act on. Check whether the API provides useful signals or reasons that help you approve a user, trigger another check, or block the verification attempt.

Where Liveness Fits in Your Onboarding Flow

Liveness detection works best when it is integrated into your identity verification flow, not added as a separate step.

A typical onboarding sequence looks like this:

1. Document capture
The user submits a valid ID through document verification.

2. Selfie capture with liveness checks
Liveness runs during capture to confirm the presence of a real person.

3. Face match
The captured face is matched against the ID.

This sequence ensures three things:

• The document is valid
• The face matches the document
• The person presenting that face is physically present

When combined, these checks close the gap that attackers rely on.

Liveness can also be applied beyond onboarding. It is useful during high-risk actions like password resets, device changes, or large transactions. This extends protection across the full user lifecycle.

How Dojah Helps Prevent Fake Selfies in KYC

If you are looking to strengthen your KYC flow, the next step is to see how this works in practice. 

Dojah’s Liveness Check helps you verify that a real person is present during selfie capture. It adds a liveness check to your KYC flow, so a face match alone does not determine whether the person is genuine.

With Dojah’s Liveness Check, you can:

• Detect spoofing attempts in real time: Dojah checks the selfie capture for signs that someone is trying to present a fake biometric input instead of their live face.
• Identify different spoofing methods: The liveness check helps identify attacks involving photo replays, video replays, and synthetic or AI-generated faces.
• Run liveness checks in mobile-first environments: You can add liveness to your mobile verification flow without creating a separate verification process for users.
• Maintain fast onboarding speeds: Liveness adds another security check while keeping the verification experience focused and straightforward.

Dojah provides identity verification infrastructure that helps fintechs strengthen KYC without building every verification capability from scratch.

See how Dojah’s liveness detection works and how it can help you prevent spoofing during onboarding

This article was originally published in May 2026 and updated in September 2026 to add guidance on liveness detection standards and clarify how liveness differs from facial recognition and face match.