Remote identity verification needs stronger liveness against spoofing

At a glance

What this is: This is an analysis of DHS RIVR Track 3 liveness testing and the article’s core finding that spoofing resistance must be proven against realistic presentation attacks.

Why it matters: It matters because identity verification teams need to judge whether biometric controls can resist spoofing without creating excessive friction for legitimate users across onboarding and authentication flows.

By the numbers:

• Incode met 3 out of 4 DHS performance thresholds in the active liveness track.

👉 Read Incode's analysis of DHS RIVR Track 3 presentation attack detection

Context

Presentation attack detection is the control layer that tries to distinguish a real person from a spoofing attempt during remote identity verification. In this article, the primary issue is not whether biometrics work in principle, but whether they hold up against the kinds of fraud techniques attackers actually use, including photos, replay attacks, and high-fidelity masks.

For IAM and identity verification teams, the governance question is whether a system can prove resilience in independent testing while still keeping user friction low enough for production use. This is where identity verification, fraud prevention, and access assurance intersect, because weak liveness opens the door to account takeover, synthetic identity abuse, and fraudulent onboarding.

Key questions

Q: Should organisations use active or passive liveness detection?

A: Choose based on risk and user friction. Active liveness is stronger in visible challenge scenarios but adds more friction, while passive liveness is smoother and better for high-volume or lower-friction flows. Most mature programmes use a hybrid model, reserving active challenges for higher-risk events and using passive checks elsewhere.

Q: Why do APCER and BPCER both matter in identity verification?

A: APCER shows how often spoofing is accepted, while BPCER shows how often real users are rejected. If you only optimise one, you can create a weak control that is either easy to bypass or too disruptive to use. Mature identity programmes assess both together because security and usability are part of the same decision.

Q: What are the signs that liveness controls are failing in production?

A: Watch for unusual approval spikes, device-specific anomalies, repeated recovery events, and a growing gap between lab performance and live conversion data. A second signal is when fraud analysts start overriding biometric results too often, which usually means the control is miscalibrated for the actual attack surface.

Q: How do organisations validate biometric controls beyond a single test result?

A: Combine independent evaluations, internal red-team testing, and ongoing fraud telemetry. Then re-run validation after model updates, policy changes, or shifts in attacker behaviour. The goal is to prove that the control still works in production conditions, not just in a benchmark environment.

Technical breakdown

How presentation attack detection works in remote identity verification

Presentation attack detection, or PAD, is the process of determining whether a biometric sample comes from a live person or from a spoofing artifact. In remote verification, systems examine facial texture, motion, device signals, or challenge responses to detect images, replays, and masks. Passive liveness does this without user prompts, while active liveness asks the user to perform a task. The technical trade-off is simple: passive flows reduce friction, but they must still resist increasingly realistic attack media.

Practical implication: identity teams should test PAD separately for passive and active flows, because the control behaves differently in each mode.

Why APCER and BPCER matter for identity verification governance

APCER measures how often spoofing attempts are incorrectly accepted, while BPCER measures how often legitimate users are incorrectly rejected. Those two numbers describe the security and usability boundary of the system. A low APCER with a high BPCER can stop fraud but create operational friction, while a low BPCER with a weak APCER can smooth onboarding but leave the door open to impersonation. Evaluation frameworks such as DHS RIVR are valuable because they make both outcomes visible together.

Practical implication: teams should evaluate both fraud rejection and legitimate-user acceptance before adopting liveness as a production control.

Why point-in-time testing does not equal operational assurance

Independent evaluation captures the configuration submitted at a moment in time, not the full lifecycle of how the control behaves after tuning, model updates, or threat evolution. That matters because spoofing methods change quickly, and biometric models can drift as conditions, devices, and attacker techniques shift. A strong test result is evidence, but it is not a substitute for ongoing validation, change control, and red-team style abuse testing. In identity programmes, assurance has to persist beyond the lab result.

Practical implication: reassess liveness performance after model changes, policy changes, and significant fraud pattern shifts.

Threat narrative

Attacker objective: The attacker wants to impersonate a real user well enough to pass verification and gain trusted access to an account, service, or onboarding flow.

1. Entry occurs when an attacker presents a spoofing artifact such as a printed photo, replayed video, or mask to a remote identity verification flow.
2. Escalation follows if the system accepts the presentation as a live user and issues trust to the fraudulent identity attempt.
3. Impact is fraudulent onboarding or account access that bypasses identity controls and can be used for account takeover or downstream abuse.

NHI Mgmt Group analysis

Presentation attack detection is now an identity governance issue, not just a biometric accuracy issue. Once spoofing becomes reliable enough to imitate legitimate users, the control is no longer only about computer vision performance. It becomes a trust decision about who or what may enter the identity lifecycle in the first place. For IAM and fraud teams, that means PAD belongs in governance conversations alongside onboarding risk, authentication assurance, and account recovery design.

Passive liveness creates the right user experience only when the fraud model is well understood. Passive flows reduce friction, but they also reduce the signals available for challenge-response detection. That makes them attractive for scale and vulnerable if the threat model is too shallow. The practitioner takeaway is to treat low-friction verification as a controlled risk trade-off, not as a default success criterion.

Named concept: presentation assurance gap. This is the difference between a system that performs well in a controlled benchmark and one that remains trustworthy under evolving spoofing pressure. The gap widens when teams rely on a single score, a single lab result, or a single modality. Identity leaders should close that gap with continuous validation and fraud telemetry, not static certification logic.

Independently validated identity systems are useful only if the results change operational decisions. Government-led testing, third-party conformance checks, and internal tuning cycles should inform onboarding thresholds, fallback rules, and exception handling. Without that governance layer, benchmark results become marketing artefacts instead of control evidence. Practitioners should use evaluation results to tune policy, not to declare the problem solved.

What this signals

Remote identity verification is moving closer to the identity security stack, which means fraud controls, biometric assurance, and access governance are converging. When spoofing resistance improves, teams still need to ask whether the verification event is strong enough to justify downstream trust, especially when onboarding feeds privileged accounts or recovery paths. Presentation assurance gap: the risk of trusting a control because it passed a lab test instead of because it still holds under current attacker behaviour.

For programmes that bridge identity verification and access control, the practical signal is to treat verification confidence as an input to policy rather than a binary pass-fail. That approach becomes even more important when those identities later interact with NHI governance, because automated workflows often inherit the trust decisions made at onboarding.

For practitioners

• Separate passive and active liveness policy decisions Treat passive selfie checks and active challenge flows as different controls with different failure modes. Calibrate each against its own fraud risk, user friction target, and fallback path.
• Measure both spoof acceptance and legitimate-user rejection Track APCER and BPCER together in production and testing, then review them by device type, geography, and onboarding step to find where performance degrades.
• Re-test after model or policy changes Require new validation whenever models are retrained, thresholds change, or major fraud patterns emerge, because point-in-time certification does not guarantee current operational resilience.
• Use liveness results to tune onboarding risk Tie verification strength to account risk, recovery pathways, and step-up controls so a single biometric check does not carry the full burden of identity assurance.

Key takeaways

• Remote identity verification only works when spoofing resistance is tested against realistic attack media, not assumed from biometric accuracy alone.
• APCER and BPCER together define the real security and usability boundary of a liveness control.
• Independent evaluation should change policy decisions, because point-in-time results do not guarantee ongoing operational assurance.

Key terms

• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• Passive Liveness: Passive liveness is a verification method that checks whether a biometric sample appears to come from a live human without requiring the user to perform actions. It reduces friction, but it still depends on the integrity of the capture and analysis path. If that path is manipulated, passive liveness alone will not protect the decision.
• Dynamic Liveness: A verification method that checks for active, changing human presence rather than a static image or recorded artefact. It is designed to resist replay, deepfake, and virtual-camera attacks by requiring real-time interaction and freshness across the verification step.
• APCER: APCER is the rate at which a biometric system incorrectly accepts an attack presentation as genuine. It is a direct measure of spoof resistance and matters most when the identity decision carries fraud, onboarding, or access risk.

What's in the full article

Incode's full article covers the operational detail this post intentionally leaves for the source:

• Track-by-track RIVR results, including the separate passive and active liveness measurements
• Detailed explanation of APCER reporting and why worst-case subtype performance matters
• The relationship between RIVR testing, iBeta Level 3 conformance, and post-test model iteration
• Context on how the evaluation maps to workforce identity, digital onboarding, and high-risk authentication flows

👉 The full Incode post covers the passive and active liveness results, APCER interpretation, and evaluation context.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, machine identity security, and secrets management. It helps security and identity practitioners connect assurance decisions to the broader controls their programmes depend on.