Liveness detection is the technology that confirms a real, live human is physically present during a biometric capture: not a photo, video replay, mask, or deepfake. It’s the safeguard that keeps face-based identity verification from being fooled by a picture of the target.

Without liveness, a selfie check is trivial to beat: hold up a photo of the victim, play a video, or feed in a deepfake. Liveness is what makes biometric verification meaningful.

Active vs. passive liveness

• Active liveness asks the user to do something, blink, turn their head, smile, follow a prompt. It’s robust but adds friction and can be scripted around by sophisticated attacks.
• Passive liveness works invisibly, analyzing the capture for signs of a real person (texture, depth, micro-movements, lighting response) without asking the user to act. It’s smoother and increasingly the preferred approach, often combined with active checks for high-assurance cases.

The threats liveness defends against

Liveness (and the broader field of presentation attack detection) targets a spectrum of spoofs:

• Print attacks, a printed photo of the target.
• Replay attacks, a video played on a screen.
• Mask attacks, 2D or 3D masks.
• Deepfakes and injection attacks: AI-generated faces, and images injected directly into the capture pipeline to bypass the camera entirely.

The last category is the fast-moving frontier. As generative AI makes convincing fake faces cheap, and as attackers learn to inject synthetic video into the verification stream, liveness detection has to evolve from "is this a photo?" to "is this a genuine live capture from a real camera of a real person?"

Why it matters

Liveness is the difference between identity verification that resists modern attacks and one that doesn’t. For financial services onboarding, weak or absent liveness is an open door for synthetic identity and impersonation fraud. Strong, deepfake-aware liveness (the kind built into modern IDV) is now a baseline requirement, not a nice-to-have.

How liveness detection actually works

Under the hood, liveness looks for the signals that separate a real, present human from a representation of one. Passive techniques analyze a single capture (or short sequence) for cues a spoof struggles to reproduce: skin texture and micro-detail, the depth and three-dimensionality of a real face, natural reflections and how the face responds to light, and involuntary micro-movements. Active techniques add a challenge (blink, turn your head, follow a moving dot) and check that the response is natural and correctly timed. Many high-assurance systems combine both, using passive checks for smoothness and active checks when risk justifies extra certainty. Increasingly, machine-learning models trained on large sets of genuine and spoofed captures do the discrimination, which is also why they must keep retraining as attack techniques evolve.

The injection-attack frontier

The frontier has moved from what’s held up to the camera to what’s fed into the software. Injection attacks bypass the physical sensor entirely, inserting a pre-recorded or AI-generated video directly into the capture stream. So no real camera ever sees a real person. This defeats liveness checks that only ask "is this a photo or a live face?" because the injected feed can be a convincing synthetic "live" face. Countering it requires proving the capture came from a genuine, untampered camera on a genuine device, capture-integrity and environment checks layered on top of classic liveness. As generative video improves, this becomes the decisive battleground for face-based verification.

Matching liveness to risk

Liveness isn’t one-size-fits-all. A low-risk interaction might use light passive liveness for minimal friction; opening a bank account or recovering a high-value account warrants the strongest available combination of passive and active checks plus injection-attack defense. The goal is to spend friction where the stakes justify it. And because the arms race is real, liveness should be independently tested against recognized standards rather than taken on a vendor’s word, a claim of "liveness detection" means little without evidence of how it performs against current spoofs and deepfakes.

Liveness in verification vs. authentication

Liveness shows up in two related but distinct contexts, and it’s worth keeping them straight. In identity verification, liveness confirms that the selfie being matched to an ID is a genuine live capture: stopping someone from verifying with a photo, video, or deepfake of the real person. In biometric authentication (like server-side face login), liveness confirms that the returning user is physically present, not being spoofed with a recording. The threat model is similar; the moment differs, establishing identity versus confirming a known one.

In both cases, liveness is what makes a facial biometric meaningful rather than trivially foolable. Without it, a face match only proves that an image matches, not that a real person is there. As deepfakes and injection attacks target both flows, strong liveness (and, increasingly, capture-integrity checks) has become the deciding factor in whether face-based identity can be trusted at all. It’s the unglamorous safeguard that everything else in face verification depends on.

Frequently asked questions

What is liveness detection?

Technology confirming a real, live person is present during biometric capture, not a spoof.

What’s the difference between active and passive liveness?

Active liveness asks the user to perform an action; passive liveness works invisibly by analyzing the capture.

Does liveness detection stop deepfakes?

Strong liveness and presentation-attack detection are designed to, but it’s an evolving arms race as deepfakes improve.

Related: Presentation Attack Detection (PAD) · Deepfakes · Face Authentication · Identity Verification (IDV) · Selfie / Biometric Verification