Topic starter
28/04/2026 4:22 pm
TL;DR: Biometric authentication can still be spoofed by deepfakes, replay attacks, and presentation attacks, and the source article argues that liveness detection adds proof of presence across onboarding, recovery, and high-value transactions, according to Ping Identity. The governance issue is not biometrics themselves, but the assumption that a matching face or voice is enough without live-presence verification.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “What Is Liveness Detection? Preventing Biometric Fraud”.
Key questions
Q: How should security teams use liveness detection in biometric login flows?
A: Use liveness detection wherever a biometric result would unlock meaningful access, especially in onboarding, recovery, and step-up authentication.
Q: Why do biometrics need more than a face or fingerprint match?
A: Because a biometric match proves similarity, not trustworthiness of the surrounding process.
Q: What are the signs that liveness controls are too weak for current fraud tactics?
A: Common signs include repeated recovery abuse, suspiciously successful remote enrolments, high completion rates with poor assurance, and weak resistance to spoofed media during testing.
Practitioner guidance
- Define liveness requirements by use case Set different assurance levels for onboarding, recovery, and high-value transactions so the biometric control matches fraud impact.
- Combine passive checks with step-up challenges Use passive liveness for low-risk journeys and trigger active challenges when the transaction or account risk increases.
- Test for spoofing and injection paths Validate whether your current capture flow can resist deepfakes, replayed video, masks, and media injection before trusting biometric acceptance.
Bottom line: Biometric authentication can still be deceived when the system trusts resemblance more than live presence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:17 am
Biometric matching is not identity assurance: A face, voice, or fingerprint match proves resemblance, not live presence. That distinction matters because remote attackers now have convincing synthetic inputs that can satisfy a matching engine while bypassing the trust condition the control actually depends on. IAM programmes that equate biometric success with user legitimacy are treating the symptom as the control.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations use active or passive liveness detection?
A: Choose based on risk and user friction. Active liveness is stronger in visible challenge scenarios but adds more friction, while passive liveness is smoother and better for high-volume or lower-friction flows. Most mature programmes use a hybrid model, reserving active challenges for higher-risk events and using passive checks elsewhere.
👉 Read our full editorial: Liveness detection and biometric fraud: where authentication breaks