Topic starter
02/08/2026 12:01 pm
TL;DR: 3.2 million injection attacks were reported in 2025, and 97% of MyFace liveness transactions happened on mobile, according to Yoti research, while an August peak of 527,013 attacks followed the UK Online Safety Act rollout. The signal is clear: identity verification now has to absorb AI-generated spoofing without weakening genuine-user completion.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “The evolution of presentation attack detection trends in 2025”.
By the numbers:
- Yoti detected a total of 3.2 million injection attacks in 2025.
- The vast majority, 97%, of MyFace liveness transactions are completed on mobile phones.
Key questions
Q: What breaks when liveness checks rely on the camera feed alone?
A: They break when the attacker can intercept or replace the feed before the verification logic sees it.
Q: Why are AI deepfakes a problem for identity verification?
A: AI deepfakes weaken verification because they make voice and video far less reliable as identity signals.
Q: How can security teams tell false rejects from real attack attempts in liveness checks?
A: Teams should separate operational failure reasons, such as low light, small images, and connectivity problems, from indicators that suggest spoofing, such as multiple faces or a missing face in the image.
Practitioner guidance
- Audit the capture boundary for bypass paths Map where synthetic or pre-recorded imagery can enter the verification flow, then confirm that only live camera capture reaches the liveness decision point.
- Separate user-quality failures from attack indicators Track rejection reasons such as poor lighting, missing faces, multiple faces, and low-quality images so tuning changes do not blur usability issues with attack detection.
- Test liveness on mobile under realistic conditions Run validation on the device types, camera quality bands, and connectivity conditions your users actually have, rather than only on ideal test hardware.
Bottom line: Deepfake injection attacks turn liveness detection into a frontline control for identity and age verification rather than a narrow anti-fraud feature.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:07 pm
Liveness is no longer a peripheral fraud check. It has become a primary trust boundary for age assurance, identity verification, and authentication flows that rely on remote capture. Once AI-generated imagery can enter the verification stream, the quality of the identity decision depends on the control that proves presence, not just on the match score. Practitioners should treat PAD as a core identity control, not a UX feature.
A question worth separating out:
Q: What should organisations do when liveness success improves but fraud pressure is also rising?
A: They should review both completion and rejection data together, then test the control on the same mobile conditions their users actually face. Higher success rates are only meaningful if the system is still resisting injection attacks, because completion without resistance can hide a weaker trust boundary.
👉 Read our full editorial: Deepfake injection attacks are testing liveness controls in 2025