Liveness Detection: How It Works and How to Test a Vendor's Claims

What is liveness detection?

Liveness detection is a biometric check that confirms a real, live person is present during identity verification. It analyses a selfie or short video to spot signs of a spoof, such as a printed photo, a screen replay, a mask or a deepfake. It runs alongside face matching, which checks the selfie against an ID photo.

For banks, fintechs, payment companies and gaming operators, liveness detection is what stops a fraudster from opening an account with someone else's photo. In Nigeria, it often sits next to a NIN or BVN check, comparing the live selfie with the photo on the government record.

This guide explains how liveness detection works and the attacks it must stop. It then answers the two questions buyers most often ask vendors: what was it tested against, and how accurate is it on African faces?

How does liveness detection work?

The customer takes a selfie or short video during onboarding. The liveness model analyses it for signs that the face is not real or not present. These signs include texture, depth, reflections, screen edges and unnatural movement.

There are two broad approaches. Active liveness asks the customer to do something, such as turn their head or follow a moving dot. Passive liveness analyses a single capture without asking the customer to act, which usually means less friction and fewer drop-offs. Many systems use passive by default and add an active step when risk is higher. Our guide to active vs passive liveness detection compares the two in detail.

If the capture passes, face matching compares it with a trusted photo, such as the one on an ID document or a government record. Liveness answers "is this a real person here now?" Face matching answers "is it the right person?" You need both.

What attacks does liveness detection need to stop?

Attacks fall into two groups, and they are tested differently.

Injection attacks are an increasingly important risk, because they pair naturally with deepfakes. A fraudster does not need to hold anything up to a camera. They insert synthetic video into the data stream instead.

Regulators have noticed. In November 2024, the US Financial Crimes Enforcement Network (FinCEN) issued an alert on deepfake media used to get around identity verification. It reported a rise in suspicious activity reports describing deepfake identity documents since 2023. For more on how fraudsters use the technology, see what deepfakes are and how fraudsters use them.

What attacks is your liveness detection tested against, and who tested it?

This is the question that separates evidence from marketing. Many vendors market liveness as protection against deepfakes. Fewer can show an independent test report that proves it.

For presentation attacks, the reference is ISO/IEC 30107-3. It is a testing and reporting standard, not a pass mark. It defines how a lab presents attack instruments to a system and how results are reported, using two error rates:

The two pull against each other. Tightening a system to stop more attacks usually rejects more real customers. That is why a single "accuracy" figure tells you little.

ISO/IEC 30107-3 is not the test framework for injection attacks. A separate European technical specification, CEN/TS 18099, published in 2024, provides definitions, detection guidance and a test methodology for injection attack detection. Because it is newer, independent test results against it may be less commonly available.

When you ask a vendor about testing, ask for five things. Which standard was used? Which independent, accredited lab ran the test? Which attack types were included? When was the test done, and on which product version? Can you see the report, not just a badge?

What are your error rates on African faces?

This question matters more in Africa than most vendors admit. Face recognition and liveness models learn from training data. If that data under-represents darker skin tones, the model can perform worse on those faces.

The evidence comes from the US National Institute of Standards and Technology (NIST). Its December 2019 study of demographic effects tested face recognition algorithms from many developers. With high-quality application photos, it found false positive rates were highest in West and East African and East Asian people in many algorithms. Its West Africa group included people from Ghana, Liberia and Nigeria.

The study also found the size of the gap varied widely between algorithms. Some developers' algorithms showed no detectable difference. That is the point for buyers: the gap is a property of the specific model, so you must ask about the model you are buying. NIST continues to publish updated demographic results, so compare the vendor's current model, not the 2019 study alone.

A false positive in face matching means wrongly accepting an impostor as the right person. A false negative means wrongly rejecting a genuine customer. Both cost you, one in fraud and the other in lost customers.

Ask the vendor for error rates broken down by demographic group, at the threshold it actually uses in production. NIST makes the same recommendation, because most systems run at one fixed threshold. Also ask how the model performs on low-end phones and in poor light, which are common real-world conditions for many African customers.

Liveness detection checklist: questions to ask every vendor

How Youverify approaches liveness detection

Youverify liveness detection checks for deepfakes, screen replays and injection attacks. It runs passive by default, with active challenges when a flow calls for them, configurable product by product.

Liveness detection runs on the same customer record as document capture, face matching and NIN verification against the source of record. A failed or borderline check opens a case with the evidence attached, rather than a silent rejection. Youverify also holds ISO/IEC 42001 certification, which relates to its AI management system. 

To see liveness detection running in your own onboarding flow, request a free demo today.

Conclusion

Liveness detection is now a front line against deepfake fraud, but vendor claims are easy to make and hard to check. The useful questions are specific: which attacks, which standard, which lab, and which error rates on faces like your customers'.

A vendor that answers those is one you can defend to an examiner.

About the Author

Victoria Okere is a compliance content writer at Youverify, specializing in AML compliance, financial crime risk, regulatory technology, and emerging trends in financial services.