Topic starter
11/07/2026 8:22 pm
TL;DR: Mandatory reimbursement rules for authorised push payment fraud are shifting loss responsibility to banks, while AI-driven deepfakes and injection attacks are helping criminals bypass legacy onboarding checks, according to Oz Forensics. The control problem is no longer just verifying a face, but proving the signal is live and trustworthy under reimbursement pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Oz Forensics: “Stop Reimbursement Costs: The Biometric Defense”.
By the numbers:
- UK banks reimbursed £112 million to victims, with a reimbursement rate hitting 88%.
- The UK introduced a 50/50 liability split for fintechs between the sending bank and the receiving bank.
- Oz Forensics says solutions certified against CEN/TS 18099 for Injection Attack Detection are the 2026 essential.
Key questions
Q: What breaks when banks rely on face matching without liveness detection?
A: Face matching alone breaks when an attacker can inject a replayed, synthetic, or manipulated video stream into the app.
Q: Why do APP fraud reimbursement rules change identity control priorities?
A: They convert identity failure into a direct financial liability.
Q: How can banks tell whether liveness controls are actually working?
A: They should test whether the control rejects emulators, virtual camera feeds, replayed sessions, and injected synthetic video under realistic fraud tooling.
Practitioner guidance
- Harden the biometric capture path Require controls that detect emulators, virtual cameras, and replayed video before the biometric sample reaches match logic.
- Validate liveness against injection abuse Test onboarding and payment journeys with deepfakes, injected streams, and synthetic identities so that failure modes are visible before attackers scale them.
- Tie fraud loss exposure to verification assurance Align reimbursement risk owners with the teams that govern biometric evidence, so control gaps are evaluated as financial liabilities rather than UX defects.
Bottom line: APP fraud reimbursement shifts mean that banks now own more of the loss, so biometric assurance has become a financial control as much as an identity control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
Liability shift changes the identity control problem, not just the fraud budget. APP fraud reimbursement rules move banks from loss avoidance to loss containment under proof pressure. That changes identity verification from a front-end onboarding check into a financial control that must withstand adversarial review. Practitioners should judge biometric programmes by whether they can support liability defence, not only conversion.
A question worth separating out:
Q: Should banks compare passive liveness with active challenge flows?
A: Yes, but the comparison should be based on fraud risk, user friction, and the strength of the capture-path assurance required. Passive liveness reduces abandonment and still raises the bar against spoofing, while active challenge flows can add friction but may help in higher-risk journeys. The right choice depends on the liability exposure of the flow.
👉 Read our full editorial: Biometric defense against app fraud liability shift in banking