Biometric liveness for AI-driven fraud in financial services

At a glance

What this is: iProov’s article describes MoMo’s use of Dynamic Liveness to harden remote biometric verification against AI-driven fraud, deepfakes, and digital injection attacks.

Why it matters: This matters to IAM teams because stronger identity proofing is becoming a control requirement in financial transactions, not just a user experience choice.

Context

Financial identity assurance is shifting from simple biometric matching to proof that the claimant is real, present, and not synthetic. In this article, iProov links that shift to AI-driven fraud patterns such as deepfakes and digital injection attacks, which can defeat remote verification when liveness checks are weak.

The regulatory pressure is also explicit. The State Bank of Vietnam’s Decision 2345 is pushing stronger biometric authentication for online transactions, which makes liveness quality a governance issue rather than a niche anti-fraud enhancement. For financial services, the control question is whether the verification step can still resist spoofing when the attack surface is generated content.

Key questions

Q: What breaks when biometric verification cannot prove liveness in financial services?

A: When verification only checks whether a face matches, it can accept deepfakes, replayed media, or injected signals as genuine users. The failure is not biometric recognition itself, but the inability to distinguish a live claimant from a synthetic presentation. In high-risk financial flows, that gap turns identity proofing into a fraud enabler rather than a control.

Q: Why do deepfakes make video-based identity verification so risky for remote operations?

A: Deepfakes undermine video verification because they can convincingly mimic a person’s face and voice, which makes social engineering easier to scale. That creates risk in remote onboarding, payroll changes, payment requests, and job interviews. Human reviewers are unreliable against high-quality synthetic media, so organisations need technical controls that verify presence and liveness instead of trusting appearance alone.

Q: How can teams tell whether their biometric assurance is too weak?

A: Warning signs include heavy reliance on a single check, no independent device or metadata validation, and a manual review process that assumes humans can reliably spot synthetic media. If the system would still approve an attacker after one signal is fooled, the assurance model is too shallow for high-assurance access.

Q: Should financial teams treat liveness as part of identity proofing or fraud prevention?

A: Both. Liveness sits at the point where identity proofing meets fraud resistance, because it decides whether the system is interacting with a real human or an artefact. In practice, that means identity and fraud teams should jointly define assurance thresholds, escalation paths, and controls for remote transactions.

Technical breakdown

How dynamic liveness defeats biometric spoofing

Dynamic liveness is a biometric assurance layer that tests whether the subject is physically present at the time of verification. Unlike static face matching, it aims to defeat replayed images, video attacks, and synthetic presentations by introducing challenge-response style signals and anti-injection checks. iProov says its Flashmark technology is designed to verify that the person is real, the right person, and present in the moment. In practical terms, liveness is the control that separates identity proofing from simple image comparison when deepfakes are cheap to generate.

Practical implication: treat liveness as a separate control from face match, and validate whether it resists replay, injection, and synthetic-media attacks.

Why generative AI changes remote identity verification

Generative AI lowers the cost of creating convincing fraudulent artefacts, which makes remote identity verification easier to attack at scale. Deepfakes can present a believable face, while digital injection attacks can interfere with the capture or transport path between camera and verification service. That combination matters because the attack is not only about fooling the algorithm, but about feeding it a fabricated identity event. In financial services, this changes the trust model for onboarding and transaction authentication, because assurance now depends on detecting live human presence under adversarial media conditions.

Practical implication: review where your verification stack assumes camera input is trustworthy and add controls that detect synthetic or injected media.

Biometric assurance under regulatory pressure

Decision 2345 shows that biometric assurance is increasingly a regulatory expectation, not just an internal fraud-prevention choice. When a central bank tightens transaction authentication requirements, identity teams have to map assurance strength to the risk of the transaction, the channel, and the fraud profile. That means the governance question is no longer whether biometrics exist, but whether they satisfy the required assurance threshold under adversarial conditions. For payment and fintech operators, this pushes liveness into the same conversation as customer trust, account protection, and online transaction policy.

Practical implication: align biometric policy to transaction risk tiers and document how liveness meets the required assurance standard.

NHI Mgmt Group analysis

Biometric liveness is becoming the control boundary for AI-era identity proofing: Traditional face matching assumes the biometric sample is an honest capture of a real person. That assumption weakens when deepfakes and injection attacks can fabricate the input itself. The governance question is no longer how accurate the matcher is, but whether the proofing step can establish liveness under adversarial conditions.

Digital trust in financial services now depends on detecting synthetic presence, not only matching identity traits: Fraud teams have spent years optimising matching thresholds and step-up flows, but generative AI changes the threat model. The meaningful control variable is whether the system can prove the claimant is present in the moment, which is a different assurance problem from ordinary biometric enrolment. Practitioners should treat this as a transaction assurance issue, not just an onboarding issue.

Decision 2345 is a signal that biometric assurance is moving from optional hardening to regulated control design: Once a central bank raises authentication expectations, teams must evidence how identity proofing resists modern spoofing techniques. That creates pressure to separate simple biometric capture from higher-assurance liveness checks and to document where each applies. Financial IAM programmes should expect stronger scrutiny of remote verification paths.

Identity fraud prevention now requires a live-person assurance concept, not just stronger credentials: A useful named concept here is dynamic liveness assurance, meaning the explicit ability to distinguish a real, present human from a synthetic or replayed representation. That concept matters because the fraud problem has shifted from stealing credentials to manufacturing believable presence. Practitioners need to think in terms of assurance states, not just authentication factors.

AI-driven fraud exposes the limits of static proofing assumptions: Remote identity systems were built around the premise that visual evidence is hard to fake at scale. Generative AI breaks that premise by making spoofing cheap, fast, and repeatable. The implication is that financial services must continuously re-evaluate whether their proofing controls are resisting the current generation of synthetic-media attacks.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Dynamic liveness assurance: Financial services teams are moving toward controls that prove presence, not just resemblance, because AI-generated media can satisfy weaker biometric checks. That changes the programme design question from "how accurate is the matcher" to "what evidence proves a live human is on the other end."

The practical implication is that remote verification now needs explicit resistance to replay, injection, and synthetic-media attacks. Where that resistance is absent, biometric assurance becomes a weak link in transaction authentication rather than a trust signal.

This is also a governance problem, not only a detection problem. When regulators raise biometric assurance expectations, teams have to document which transaction paths rely on liveness and why those paths meet the required trust threshold.

For practitioners

• Strengthen liveness at remote verification Test whether your biometric flow can reject replayed video, still images, synthetic faces, and injected capture streams before authentication succeeds.
• Map assurance to transaction risk Define which online transactions require stronger biometric assurance and document the threshold that distinguishes ordinary sign-in from high-risk approval.
• Review your media-injection exposure Check whether the capture path, device trust assumptions, and verification channel can be manipulated before the liveness decision is made.
• Align identity proofing with regulation Trace local biometric requirements, including central-bank or sector mandates, into your remote onboarding and transaction policies.

Key takeaways

• AI-driven fraud is changing what biometric controls must prove, shifting the focus from matching identity traits to proving real-time presence.
• The article’s central tension is that deepfakes and digital injection attacks can defeat weak remote verification paths unless liveness is explicitly tested.
• Financial IAM teams should align biometric assurance with transaction risk and regulatory expectations, not treat liveness as a generic add-on.

Key terms

• Dynamic Liveness: A verification method that checks for active, changing human presence rather than a static image or recorded artefact. It is designed to resist replay, deepfake, and virtual-camera attacks by requiring real-time interaction and freshness across the verification step.
• Digital Injection Attack: An attack in which manipulated or synthetic media is inserted into a verification pipeline instead of being captured directly from the camera. The goal is to make a fraudulent input look like a legitimate live session and pass identity checks without an actual person present.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Biometric Identity Assurance: Biometric identity assurance is the use of physical or behavioural traits to verify that a person is who they claim to be. In practice, it is an evidence-producing control that supports authentication, auditability, and operational decision-making when high confidence is required.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.