Topic starter
02/08/2026 12:04 pm
TL;DR: Liveness detection is framed as a core defence against presentation attacks, including masks, screen replays, deepfake video, injection attacks and bot attacks, according to Yoti’s January 2026 white paper, which says its MyFace solution achieved iBeta Level 3 approval with 100% attack detection. The identity lesson is broader: verification controls must prove presence, not just image quality, or spoofing remains viable.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Yoti MyFace liveness white paper”.
By the numbers:
- Yoti’s MyFace solution is iBeta Level 3 approved with 100% attack detection.
Key questions
Q: How should security teams use liveness detection in biometric login flows?
A: Use liveness detection wherever a biometric result would unlock meaningful access, especially in onboarding, recovery, and step-up authentication.
Q: When does passive liveness create more risk than it reduces?
A: Passive liveness becomes risky when the workflow faces replay, synthetic media or injection-style attacks and the organisation assumes friction reduction is the same as assurance.
Q: What breaks when verification only checks image quality?
A: The control fails because a convincing static or replayed image can satisfy the system without proving a live human is present.
Practitioner guidance
- Define the required proof of presence Set explicit assurance thresholds for verification and authentication flows so teams know when liveness is mandatory rather than optional.
- Test against presentation attack classes Evaluate controls against masks, screen replays, deepfake video, injection attacks and bot-driven spoofing.
- Choose active or passive liveness by risk Use active liveness where the workflow can absorb user prompts and needs stronger challenge-response evidence.
Bottom line: Liveness detection matters because spoofing succeeds when verification systems mistake a convincing signal for a real person.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:09 pm
Liveness is a trust boundary, not a cosmetic check: Verification programmes fail when they confuse image quality with proof of presence. Presentation attacks exploit that assumption by making a synthetic signal look believable enough to be accepted as a real user. The practical consequence is that identity assurance has to be measured at the point where the system decides whether a human is actually present.
A question worth separating out:
Q: What is the difference between active and passive liveness checks?
A: Active liveness checks ask the user to perform a task such as blinking, smiling, or turning the head. Passive liveness checks work in the background by analyzing facial texture, depth, light response, and micro-movements without explicit prompts. Active methods are generally stronger against spoofing, while passive methods are smoother for users and faster to complete.
👉 Read our full editorial: Liveness detection gaps remain central to human verification risk