Face authentication is a biometric method that verifies a user’s identity by matching their face against a stored reference, most commonly to unlock a device and its stored credentials during login. On modern phones, it’s the everyday face unlock that authorizes a passkey or app access.

There are two very different contexts for face authentication, and conflating them causes confusion.

On-device face unlock vs. server-side face matching

• On-device face unlock (like the phone’s face recognition) authenticates the user locally to release a private key or open an app. The facial data stays in the device’s secure hardware; the service never sees it. This is the passwordless-login use case.
• Server-side face matching compares a live selfie against a reference (for example, the photo on a verified ID) during identity verification. Here the image is processed to confirm the person is who they claim, which is a verification use case, not just authentication.

Why liveness and deepfake defense are critical

Server-side face matching faces a serious threat: presentation attacks (a photo, video, or mask) and, increasingly, deepfakes and injection attacks that feed synthetic imagery into the capture pipeline. Face authentication in a verification context is only as strong as its liveness detection and presentation-attack detection, the checks that confirm a real, live person is present rather than a spoof. As generative AI makes fake faces cheaper and more convincing, robust anti-spoofing is what separates trustworthy face authentication from a liability.

Face authentication in practice

For customer-facing businesses, face authentication shows up in mobile SDKs as a fast, familiar way to authenticate, and in onboarding as the biometric half of identity verification. Transmit Security has shipped face authentication in its mobile SDKs, pairing it with liveness and anti-deepfake measures so the convenience doesn’t come at the cost of spoofability.

The deepfake pressure on face authentication

Face authentication’s biggest challenge is that faces are now forgeable at scale. Generative AI can produce convincing synthetic faces and video, and injection attacks can feed that synthetic media directly into a capture pipeline, bypassing the camera. This matters mainly for server-side face matching (as in identity verification), where the system is deciding whether a submitted face is genuine. On-device face unlock is far less exposed, because the matching happens in the phone’s secure hardware and never trusts a remote image.

The takeaway is that face authentication is only as strong as the anti-spoofing wrapped around it. In a verification context, that means robust liveness and presentation-attack detection plus capture-integrity checks that confirm a real, live camera captured a real person. Deployed with those safeguards, face authentication is fast, familiar, and secure; deployed without them, it offers a false sense of security that today’s deepfake tooling can defeat. The convenience is only worth having if the spoofing defenses are current.

Frequently asked questions

Is face authentication secure?

On-device face unlock is secure and private; server-side face matching is secure only with strong liveness and deepfake detection.

Can face authentication be fooled by a photo or deepfake?

Without liveness and presentation-attack detection, yes, which is why those defenses are essential.

Does face authentication send my face to the company?

For device unlock, no, the data stays on the device. For identity verification, a selfie is processed to confirm a match.

Related: Biometric Authentication · Liveness Detection · Presentation Attack Detection (PAD) · Deepfakes · Identity Verification (IDV)