Notifications
Clear all
Topic starter
11/07/2026 8:26 pm
TL;DR: Government e-ID systems are expanding because biometric verification can streamline access and reduce fraud, but the article argues that passive liveness alone is no longer enough and that anti-injection controls are now required alongside presentation-attack defenses, according to Oz Forensics. The trust gap in digital identity has become a governance problem, not just a UX issue.
NHIMG editorial — based on content published by Oz Forensics: Government Digital ID, Biometrics for Security and Services
By the numbers:
- Global losses from identity-related fraud exceeded USD 50 billion in 2024, growing more than 20% year over year.
- Suspected fraudulent transactions surged by 33% from 2023 to 2024.
Questions worth separating out
Q: How should organisations secure digital identity verification against deepfake fraud?
A: Organisations should test identity proofing against both presentation attacks and injection attacks.
Q: Why do biometric identity systems need more than liveness detection?
A: Liveness detection proves that a real person is present, but it does not automatically prove that the captured signal reached the system intact.
Q: What do security teams get wrong about digital identity fraud controls?
A: They often treat spoofing defence as a complete solution and overlook the software path where fake media is inserted.
Practitioner guidance
- Validate both spoofing and injection paths Test biometric verification against printed photos, replayed video, virtual cameras, and emulator-based injection, then document which attack class each control actually blocks.
- Separate PAD assurance from anti-injection assurance Map ISO 30107-3 testing to presentation attacks and add distinct checks for CEN/TS 18099-style injection scenarios in the application and device pipeline.
- Measure abandonment alongside fraud resistance Track completion rates, help-desk friction, and user dropout for active and passive liveness journeys so accessibility issues do not become hidden control failures.
What's in the full article
Oz Forensics' full article covers the operational detail this post intentionally leaves for the source:
- Standards mapping for ISO 30107-3 and CEN/TS 18099 testing against specific biometric attack classes.
- Detailed explanation of passive versus active liveness from the vendor's implementation perspective.
- Examples of how deepfake injection attacks bypass camera-based controls in real verification flows.
- The article's recommended layered defence architecture for government and financial identity programmes.
👉 Read Oz Forensics' analysis of biometric identity verification and deepfake fraud →
Biometric identity verification and injection attacks: are controls keeping up?
Explore further
11/07/2026 8:56 pm
Biometric identity proofing is now an access-governance problem, not just a fraud-screening problem. Public-sector identity systems increasingly act as the front door to essential services, digital signatures, and cross-agency workflows. That means the real question is whether the verification layer can withstand both spoofing and injection, because a successful fake identity becomes an authorised access path. IAM and identity verification teams should treat proofing assurance as part of access governance, not a separate fraud bucket.
A question worth separating out:
Q: Who is accountable when biometric identity proofing fails in public services?
A: Accountability usually sits with the identity programme owner, the service operator, and the risk or compliance function that approved the assurance model. In regulated environments, the obligation is to prove that controls are tested against the actual threat classes the system faces.
👉 Read our full editorial: Digital ID biometrics need anti-injection controls, not just liveness
