What should organisations do when liveness success improves but fraud pressure is also rising?

Why rising fraud pressure changes how you read liveness results

Organisations should treat better liveness completion as only one signal. If fraud pressure is increasing, the real question is whether the control still resists injection, replay, and proxy-based abuse under the same mobile conditions users actually face. A higher pass rate can mean better usability, but it can also hide a weaker trust boundary if the test environment is easier than production.

What matters is the relationship between acceptance and rejection, not acceptance alone. If rejection falls while fraud attempts rise, the control may be becoming easier to satisfy without becoming more trustworthy. That is especially true when attackers adapt to the exact device, network, camera, browser, or app conditions that legitimate users use.

Successful liveness should therefore be read as a control-quality indicator only when it is paired with evidence that adversarial traffic is still being stopped. In practice, that means testing for presentation attack resistance, injection resistance, and the stability of the check across the same mobile journey that real customers take.

How to test the control against real-world fraud conditions

The most useful test is not a lab-perfect demo, but a production-shaped evaluation. Use the same handset classes, camera paths, network quality, app versions, and recovery flows that your customers rely on, then compare completion rates with rejection rates under normal and adversarial conditions.

That comparison should include at least three questions: does the control still reject manipulated input, does it still behave consistently on lower-end or older devices, and does it still force fraudsters into a detectable failure mode rather than a silent bypass? If the answer to any of those is no, the success rate is giving you an incomplete picture.

It also helps to segment results by condition rather than averaging them away. A control that performs well on premium devices may still fail on older handsets, weak cameras, degraded lighting, or mobile web paths. Those segments are often where fraud pressure and user friction diverge most sharply.

For identity assurance, comparison across conditions is the point. NIST SP 800-63 Digital Identity Guidelines is useful here because it frames assurance as something that must remain meaningful under the conditions in which authentication is actually used.

What organisations should watch when success rises and fraud rises together

The main warning sign is decoupling. If liveness success improves while fraud attempts or confirmed abuse also increase, the control may be optimised for user completion more than adversarial resistance. That can happen when thresholds are tuned too permissively, when fallback paths are too easy, or when the test corpus does not reflect current attack tooling.

Another warning sign is overconfidence in aggregate metrics. A single global pass rate can look healthy even when a small but important segment is becoming easier to exploit. Fraud teams should look for shifts in failed challenge patterns, repeated retries, abnormal device clustering, and unusual geographic or network concentration.

Attackers also adapt to the control itself. If the environment allows injection, replay, emulation, or synthetic interaction to resemble legitimate user behaviour closely enough, the apparent gain in success can simply mean the control is absorbing more weakly challenged traffic rather than becoming stronger.

That is why threat-oriented testing matters. MITRE ATT&CK Enterprise Matrix helps teams think in terms of attacker behaviour, while NIST Cybersecurity Framework 2.0 gives a useful structure for governing detection, response, and recovery when the control is being probed rather than simply used.

Risk and Threat Considerations

Rising success rates can create a false sense of control if fraudsters are simultaneously learning how to bypass the check. The risk is not just a weaker metric, but a trust boundary that becomes easier to satisfy without becoming harder to abuse.

Failure mechanism: The control is tuned or measured in a way that improves genuine user completion while missing injection-style abuse, replay, or other adversarial paths that still present as successful sessions.

Impact: Organisations may accept more fraudulent enrolments or logins, miss emerging attack patterns, and discover the weakness only after abuse has scaled across the same mobile channels they assumed were stable.

Practitioner Guidance

What to prioritise: Compare completion, rejection, retry, and confirmed fraud outcomes in the same view. If only completion is improving, treat that as an incomplete control story rather than a success.

What to verify: Test on real user conditions, not a cleaner lab path. The device mix, app version, network quality, and fallback behaviour must all be included before you trust the result.

Common mistake: Teams often tune for lower friction and then assume resistance stayed constant. In practice, the first thing to challenge is whether the control still fails safely when abuse is attempted at scale.

Practitioner takeaway: A better pass rate is only an improvement if the control still forces attackers into failure, friction, or detection under the same conditions that genuine users experience.

Related resources from NHI Mgmt Group

• How should payments organisations in APAC respond to rising fraud risk as digital transactions expand?
• Why do banking and fintech organisations face rising risk from identity fraud and deepfake abuse?
• How should organisations evaluate biometric liveness controls against deepfake and spoofing fraud in identity verification flows?
• How should organisations adapt fraud controls for fast-growing digital markets with high AI-driven attack pressure?