Digital ID biometrics need anti-injection controls, not just liveness

At a glance

What this is: Oz Forensics says government digital ID systems need anti-injection controls as well as liveness detection because synthetic video can bypass camera-based verification.

Why it matters: This matters to identity and security teams because biometric onboarding and remote access flows must now defend both the capture layer and the data pipeline, not just the face presented to the camera.

Context

Digital identity programmes try to make remote access to public services easier, faster, and harder to abuse. The control problem is that biometric verification now has to distinguish a real person in front of a device from a synthetic signal injected into the verification pipeline, which makes this an identity verification governance issue as much as a user-experience issue.

That distinction matters for government, financial services, and KYC workflows because liveness checks were designed to address presentation attacks, not every form of synthetic input. When the trust model stops at the camera, the organisation can validate the wrong thing with high confidence. In this article’s framing, the typical posture is now incomplete rather than unusual.

Key questions

Q: What breaks when biometric verification cannot prove liveness in financial services?

A: When verification only checks whether a face matches, it can accept deepfakes, replayed media, or injected signals as genuine users. The failure is not biometric recognition itself, but the inability to distinguish a live claimant from a synthetic presentation. In high-risk financial flows, that gap turns identity proofing into a fraud enabler rather than a control.

Q: Why do injection attacks defeat passive liveness controls?

A: Passive liveness analyses the biometric image, but injection attacks manipulate the transport path before the image reaches the verifier. If a virtual camera or emulator supplies the stream, the model may see a legitimate-looking face and still be processing fraud. Teams need provenance controls, not just better spoof detection.

Q: How do security teams test biometric verification against synthetic video attacks?

A: They should test the full capture pipeline, not only the face model. That means validating sensor spoof resistance, then separately checking whether virtual cameras, emulators, and injected streams can enter the application. A useful test suite distinguishes accepted live capture from any synthetic source that mimics it.

Q: How should identity teams handle biometrics when legal requirements limit their use?

A: They should treat biometrics as one control in a broader assurance model, not as the only acceptable design. If regulations restrict biometric processing, teams need a documented fallback that preserves risk tolerance, clearly defines consent, and does not create a weaker path for recovery, reset, or deletion. The key is to redesign the journey, not simply replace one factor with another.

Technical breakdown

Presentation attacks vs injection attacks in biometric verification

Presentation attack detection, or PAD, is designed to spot fakes presented to a sensor, such as printed photos, replayed videos, or masks. Injection attacks work differently: the attacker bypasses the camera path and feeds a synthetic stream into the application through a virtual camera, emulator, or similar software layer. That means the verification stack may see a clean biometric signal even though no real person is present. PAD therefore protects the capture surface, while anti-injection controls protect the data path between device and verifier. Both layers are required when remote identity proofing depends on facial biometrics.

Practical implication: Treat biometric verification as a multi-layer control problem and validate both the sensor path and the input pipeline.

Why passive liveness is necessary but not sufficient

Passive liveness analyses texture, light, and micro-movements without forcing the user into explicit actions. That improves usability and supports inclusion because it removes friction for users with low digital literacy, disabilities, or constrained device interaction. But passive liveness is still a liveness signal, not a guarantee that the input arrived through a trusted capture route. If an attacker can inject synthetic video upstream of the model, the system may still accept a convincing but fraudulent signal. The security question is therefore not whether passive liveness works, but what trust boundary it actually covers.

Practical implication: Use passive liveness for accessibility, but add device and pipeline controls that verify input provenance.

Standards for proving anti-spoofing and anti-injection coverage

The article distinguishes ISO 30107-3 for presentation attack detection from CEN/TS 18099 for injection attack detection. That split is important because a system can perform well against one class of fraud and remain exposed to the other. The governance issue is standards drift: organisations may assume that one certification covers the whole biometric threat surface when it does not. For digital ID and KYC programmes, control assurance should map explicitly to the specific attack class being defended, not to the generic idea of “liveness.”

Practical implication: Align assurance testing to the exact fraud mode and require evidence for both spoofing and injection resistance.

Threat narrative

Attacker objective: The attacker wants to pass biometric verification with a fake identity and obtain access to services or accounts without a real live user present.

1. Entry occurs when the attacker uses a virtual camera, emulator, or similar software path to bypass the physical camera and feed synthetic biometric video into the verification flow.
2. Credential harvesting is replaced by signal capture and fabrication, where the fraudster uses deepfake content or purloined biometric data to construct a believable identity artifact.
3. Impact follows when the system accepts the injected stream as genuine and grants remote access to public services or other identity-gated workflows.

Breaches seen in the wild

• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Anti-injection is now part of identity verification governance, not an edge case control. The article shows that the old trust model stops too early if it ends at liveness detection. Once synthetic video can be injected upstream of the biometric check, the control problem shifts from proving “a face is present” to proving “the signal came through a trusted path.” Practitioners should treat provenance of the capture channel as a first-class governance requirement.

Verification trust gap: this is the named failure mode digital ID teams need to recognise. Presentation attack detection addresses spoofing at the sensor, but it does not close the gap created when a malicious input stream bypasses the camera entirely. That means certification language can overstate real-world assurance if it is not mapped to the exact attack surface. Identity programmes should separate camera authenticity from input authenticity in their control narratives.

Biometric inclusion and security are linked, not competing goals. Passive liveness is attractive because it reduces friction and supports adoption, especially for citizens who struggle with active prompts. But usability cannot become a reason to under-specify the threat model. The governance task is to preserve low-friction onboarding while hardening the downstream pipeline against synthetic input. Practitioners should judge controls by both usability and provenance assurance.

Government e-ID systems are becoming critical identity infrastructure, which raises the assurance bar. The article’s framing is strongest where it connects biometrics to public service access, KYC, and trust in state systems. That is not just an implementation detail; it is a policy and operating model issue. Once biometric identity becomes the front door to services, failure in the verification layer turns into service fraud, exclusion, and loss of public trust. Practitioners should align control design to the service criticality of the identity gateway.

Standards alignment must distinguish spoofing resistance from injection resistance. ISO 30107-3 and CEN/TS 18099 address different fraud modes, and conflating them leaves a blind spot. For digital identity teams, the practical consequence is simple: assurance evidence should be attack-class specific. If a control claim does not say which fraud path it blocks, it is not enough for governance or audit purposes.

What this signals

Verification trust gap: biometric programmes now need controls that prove where the signal came from, not only whether the signal looks human. That changes onboarding governance because capture provenance, device integrity, and verifier assurance become part of the same control stack.

Remote identity proofing is moving toward layered assurance. Teams that separate spoof resistance from injection resistance will produce clearer audit evidence, better fraud triage, and fewer false assumptions about what a liveness certificate actually covers.

For practitioners

• Map biometric controls to the full attack path Document which controls address presentation attacks, which address injection attacks, and which only improve usability, then test each separately against the relevant fraud path.
• Require input provenance checks for remote onboarding Add controls that validate the source of the biometric stream, including device integrity and capture path monitoring, so synthetic video cannot enter the verification workflow unnoticed.
• Separate liveness claims from certification claims Write assurance statements so they specify whether the system is tested for spoofing resistance, injection resistance, or both, and remove any generic “liveness” wording that overstates coverage.
• Tune user flows for both accessibility and fraud resistance Keep passive liveness for low-friction onboarding, but back it with controls that stop synthetic inputs without forcing users through high-friction active prompts.
• Review digital ID and KYC trust boundaries Reassess where the organisation assumes the face check ends and the identity proofing control begins, especially when biometric verification gates access to public services or regulated onboarding.

Key takeaways

• Biometric verification is now exposed to a trust problem that starts before the face check and extends into the capture pipeline.
• The key evidence is the distinction between spoofing and injection, which means one liveness control no longer covers the whole risk surface.
• Practitioners should test provenance, preserve passive liveness for usability, and demand attack-class specific assurance for digital ID flows.

Key terms

• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
• Passive Liveness: Passive liveness is a verification method that checks whether a biometric sample appears to come from a live human without requiring the user to perform actions. It reduces friction, but it still depends on the integrity of the capture and analysis path. If that path is manipulated, passive liveness alone will not protect the decision.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the wider governance decisions their programmes depend on.