Presentation Attack Detection for Secure Identity Verification

Biometric capture is the starting point for digital identity, and greater reliance on AI for identity fraud prevention. In 2016, this became more pronounced as malicious activity continued to develop. PwC’s 2026 report on the latest fraud trends reveals the rapid transition from innovation to use in fraud with deepfake technology, which uses AI to create highly realistic images and videos. This is supported by global fraud statistics.

In this context, Presentation Attack Detection (PAD) plays a vital role in security, controlling access based on biometric verification. This technology assesses whether the face presented is the real face of a person or is the spoof face of a photograph, mask, video, or face generated digitally.

NIST’s digital identity guidelines define identity verification as a process that establishes the proper association of identity evidence with an individual. It discusses the presentation attacks on presentation attack detection (PAD) systems and how the latter mitigate this against the attacks, and the certification requirements that must be met by all PAD tools prior to being released.

What Is a Presentation Attack?

A presentation attack (PA) occurs when a person attempts to fool a biometric system by using a fake or modified fingerprint or other biometric. So, the biometric matching process is circumvented. The ISO/IEC 30107-1 standard defines terms used to describe this attack, in which fake materials are known as Presentation Attack Instruments (PAIs). The ISO/IEC 30107-3 standard defines the methods for measuring system performance and reporting the results in terms of different types of attacks.

Such an attack is against the input layer of a biometric system when the biometric is captured by a camera or sensor. Presentation attacks differ from software attacks that target the system architecture as they do not require information about the system base components. FIDO’s biometric requirements state that Presentation Attack Detection (PAD) is the automatic detection of a user or presentation attack.

The detection must be done at the capture stage before a decision is made to recognize the face. At this point, a facial recognition system should be performing 1:1 matching, but it doesn’t have biometric presentation attack detection (PAD), so it’s vulnerable.

To understand why PAD matters, it helps to see where presentation attacks enter the biometric verification flow. PAD operates at the capture stage, before the system moves to face matching or access decisions.

PAD works at the capture stage to stop fake faces before they reach facial recognition. By checking the input first, PAD prevents spoofing attempts from compromising the rest of the verification process. 

The Four Attack Types That iBeta Level 2 Requires a PAD System to Stop

ENISA’s remote verification research identifies four types of facial presentation attacks: photo, video replay, 3D mask, and deepfake. The remote verification system should be able to prevent these attacks.

• Facial recognition cameras: 2D attacks, in which 2D photos or computer images are used, are possible using facial recognition cameras. The Financial Crimes Enforcement Network (FinCEN) has reported that criminals have circumvented ATM facial recognition technology by using images of ATM users 
• 3D attacks are made by using 3D masks or silicone masks. These attacks work because 2D-based image matching systems are unable to verify if the face is real or not, as there is no depth. 
• Digital injection attacks or Video injection attacks target systems that use cameras by injecting video streams into the system. These attacks can bypass server-side liveness detection because they use a client-side software development kit (SDK) to secure the stream from the camera. This can be due to device security vulnerabilities. 
• Deepfake attacks involve advanced methods to rapidly create realistic artificial faces with technologies like Generative Adversarial Networks (GANs) and other models.

How PAD Systems Confirm Liveness: And Where They Fail Without Client-Side Protection 

A Presentation Attack Detection (PAD) system is used to detect biometric samples, to determine whether a person is alive or not, and to establish their identity. In 2023, the US National Institute of Standards and Technology (NIST) published a research report by the Face Analysis Technology Evaluation (FATE) program. It evaluated 82 software-based PAD algorithms that 45 developers submitted to the study.

• Texture Analysis

Texture analysis is the analysis of the skin surface on a small scale. On the human face, these variations are sebaceous glands, pores, and hair follicles. These details can not be represented with printed photos and masks.

• Depth sensing

It is based on structured light, time-of-flight, and stereo cameras to make a 3D scan of the face and display those parts that can’t be displayed with printed images.

• Micro-movement detection

It’s a presentation of objects that are alive with micro-movements. For example, changes in skin tone due to pulse, eye blinking, and breathing. Random micro-movements may be more perceptible when observing the recording process than the video.

• AI Artifacts Analysis: 

To detect the specific indicators of the presence of deepfakes, researchers of AI artifacts need to study real and fake videos. The system points out three issues: detection of rare compression artifacts, detection of time-inconsistent synthetic video, and generating fake face features by face recognition algorithms.

• Deepfake technology

It’s a method of producing faces that pass the test of texture and depth, which detects overlays and prints.

What ISO/IEC 30107-3 Requires from a PAD System

The ISO/IEC 30107-1 standard describes the fundamentals of the presentation attacks and the methods of detecting them. Conversely, ISO/IEC 30107-3 is more about the evaluation and reporting of the effectiveness of Presentation Attack Detection systems in actual security threat tests. These two sections can be viewed in a different way. When a vendor says that his system is in compliance with ISO/IEC 30107, but fails to state testing Part 3, he has not demonstrated that his system is effective in practice.

iBeta Quality Assurance is a certified and accredited independent testing lab under the NIST NVLAP, and is certified to ISO 30107-3. The company offers commercial presentations and spotting attack (PAD) certifications at two levels.

PAD Level 1: This level examines physical objects that are readily available and easy to access, including printed photos and normal video playback.

PAD Level 2 includes more complex artifacts, including 3D custom silicone masks and 2D dynamic attacks using biometric samples of specific persons. Level 2 requires that there are no violations reported in 750 individual test situations. Rounding or partial credit is not allowed.

To be considered a valid tool in catching fraud and identity verification, the presentation attack detection tool should be certified to iBeta Level 2 as per ISO/IEC 30107-3. The certification indicates that the tool has passed an independent laboratory examination, which assesses its ability to withstand typical real-life spoofing attacks.

Active vs. Passive PAD: Which Approach Fits Your Verification Flow?

Both active and passive methods for detecting biometric presentation attacks manage to achieve certification under ISO/IEC 30107-3. The choice of method impacts verification friction and the specific attack surfaces addressed by each approach.

Active PAD asks users to do actions like blinking, turning their head, or smiling. The system checks these in real-time responses and doesn’t allow pre-recorded videos because they can’t react to new challenges. Active PAD is very good at preventing spoofing, but it makes the verification process a bit slower. This trade-off is important for high-value transactions and situations where extra authentication is needed.

Passive PAD works without any input from the user. The AI model analyzes a natural facial capture and decides if the person is real based on surface detail, depth, and tiny movements. A technique that reduces drop-off during busy onboarding processes, which can affect how many users convert. The detection model must be strong enough to spot attacks without needing any challenge-response checks.

How Facia Addresses these Attack Types

Facia’s liveness detection has been certified at iBeta Level 2, according to ISO/IEC 30107-3. According to the announcement for the certification, made in March 2024, Facia said the test scenario consisted of 1,500 presentation attacks on both Android and iOS devices. This test showed the system has an Attack Presentation Classification Error Rate (APCER) of 0%. Also, the system was independently evaluated by NIST as part of the Face Recognition Vendor Test (FRVT).

• Validated the system has a 98.8% liveness detection accuracy. iBeta Level 1 has a false acceptance rate (FAR) of 1:100 million against 2D attacks.
• iBeta Level 2 shows a 0% attacking potential for cross-entity recognition (APCER) with no successful attacks against custom 3D silicone masks and enrolled-subject 2D dynamic attacks. The FRR is less than 1%.

Facia uses its own deepfake detection engine to combat deepfake attacks. Its customer onboarding solution combines Open PAD-certified, “liveness-spotting” faces, identity validation, and document matching in a single API. For heavily regulated industries that demand data residency, Facia provides an on-premises solution. This allows customers to process biometric matching on-premise so  that no biometric templates are sent to the cloud.

Book a Demo to see how Facia closes the spoofing gap in your identity verification stack.