How Deepfake Injection Attacks Bypass Liveness Detection

The product manager had the demo ready before the call started. She wanted to show us the liveness step, because she was proud of it. Blink prompt, head turn left, head turn right, smile. Four challenges, randomised order, ten second window.

Then she said the part that made the meeting useful. Her fraud team had flagged three accounts that month. All three had cleared every challenge. And her onboarding drop-off at that exact step was the worst number in her funnel.

She was paying a conversion tax for a control that had already been defeated. She had no way to know, because both facts lived in different dashboards owned by different teams.

That combination is the story of liveness detection in 2026. The check got harder for real customers and easier for attackers, at the same time, for the same reason.

How injection attacks bypass different types of liveness detection

There are six broad families of liveness detection running in remote identity verification today. Active challenge-response. Passive single-frame or short-video analysis. Texture and artefact analysis. Depth sensing through structured light, stereo, or time-of-flight. Illumination-based methods that emit controlled light and read the reflection. Multi-modal checks that pair face with voice and lip-sync.

Against presentation attacks they rank very differently. Depth and illumination-based methods are genuinely strong. Texture analysis handles printed photos and screen replays well. Active challenges defeat a static image easily.

Against injection they collapse into one row, and the row reads: bypassed.

The reason is architectural, not a question of model quality. Every one of those methods analyses content. They ask whether the frames look like a live human. None of them asks where the frames came from. When an attacker supplies the frames directly, a check that only reads content has no way to tell.

Depth is the clearest case. If the depth channel is just another stream the operating system exposes, a synthetic depth map can be supplied alongside a synthetic RGB frame, and they will agree with each other perfectly. Depth becomes injection-resistant only when it is cryptographically bound to trusted hardware, and at that point the thing protecting you is the binding, not the depth.

Illumination-based liveness deserves credit as the hardest of the six to fake. Modelling how a randomised flash sequence scatters across real skin, in the right order, at the right moment, is genuinely difficult. It raises attacker cost more than anything else on the list. It still does not verify that the flash ever landed on a face.

How virtual cameras and emulators bypass KYC liveness checks

The delivery layer is where this stops being theoretical.

Streaming software with a virtual camera output is ordinary, legitimate software. Every podcaster and remote presenter uses it. It takes any video source and presents it to the operating system as a webcam. The onboarding app requests a camera, the operating system offers the list, and a synthetic device sits in that list looking like hardware.

On mobile there are three more paths, all documented publicly. The app runs inside an emulator, and the emulator maps the host machine's virtual camera as the phone's camera. Or the device is rooted and a hooking module intercepts the camera API, returning frames from a local file instead of the sensor. Or nothing touches the camera at all and the media payload is substituted in transit between client and backend.

None of this is speculative. MITRE ATLAS carries it as case study AML.CS0033, "Live Deepfake Image Injection to Evade Mobile KYC Verification," from an iProov red team exercise dated October 2024 and published in December 2025. The finding was that both passive and active liveness were evaded.

Volume followed the tooling. iProov recorded native virtual camera attacks rising 2,665% across 2024, after face-swap injection attacks rose 704% between the first and second half of 2023. Group-IB's Weaponized AI report, published in January 2026, documented 8,065 biometric injection attempts against the digital KYC loan onboarding of a single financial institution between January and August 2025. Roughly thirty-three attempts a day, at one institution, for eight months.

Each of those paths does leave evidence, which is the useful half of this. None of that evidence requires looking at the face.

Why active liveness creates friction without stopping deepfakes

Here is where the industry has been paying twice.

The published gap between active and passive liveness completion is not marginal. HyperVerge's benchmarking reports drop-off under 1% for a simple passive selfie capture, 3 to 10% for short passive video where the user holds still, and as high as 50% for active liveness, attributing it to cognitive load and lack of comprehension. Mitek describes an enterprise deployment where active liveness completion sat at about 60%, and moving to passive lifted it past 95%.

The failures are not the users' fault either. Ambient lighting, camera compression, background movement, connection latency triggering a timeout, older devices with poor focus. Genuine customers fail these prompts for reasons entirely outside their control, and a share of them never come back.

Now put that next to the security question. Active liveness exists to defeat a replayed recording, on the logic that a fixed video cannot respond to a random prompt. That logic held when the alternative was a printed photo. It does not hold against a real-time face-swap model, which turns when asked and blinks when asked, because performing an action on cue is exactly what generative models are good at.

So the trade is: real customers find it hard, and the current dominant attack finds it trivial. Institutions have been buying friction and calling it defence.

This is the argument for moving the effort. Passive liveness for the content layer, because it costs the customer almost nothing, and spend the saved friction budget on provenance checks that actually address injection. The certification gap behind that recommendation is a longer story, and it sits in our post on injection attack detection.

Why human video KYC agents are not deepfake detectors

Now the part that surprised me while researching this, because it contradicts the comfortable version of the argument.

The comfortable version says human-assisted video verification beats automated liveness because a trained officer can spot a deepfake. The evidence says otherwise. An iProov study found only 0.1% of people correctly identified deepfake content across the tested set. Human beings, including trained ones, are close to useless as visual deepfake detectors. Any vendor telling you your agents are the safety net is selling you a story.

But watch what actually happens on an agent-led call, and the value is somewhere else entirely.

An automated liveness challenge is a finite, known set. Blink, turn, smile, read four digits. An attacker builds a rig once, tests it against that set, and reuses it at scale. That is why volume grew: the challenge was scriptable.

An improvising human is not a finite set. Asking someone to hold their ID beside their right cheek, then move it away, then cover their mouth with their left hand, then answer a question about something visible behind them, imposes a workload no rig was pre-tested against. Real-time face-swap models degrade exactly there: strong profile turns beyond their training distribution, dynamic occlusion where a hand crosses the face and edges smear, and speech under pressure where audio and lip movement drift apart.

So the officer's role is not perception. It is generating unpredictable load in real time, so that failures become visible to the systems and the recording, rather than relying on the officer to notice them.

That reframing has a practical consequence. If you run agent-assisted verification, scripting your officers is the mistake. A standard question list converts your one non-scriptable control into a scriptable one. The value was the improvisation, and a script removes it.

It also means the unscripted phase must be instrumented. Log response latency, pose changes, and occlusion events, and score them. An officer who cannot articulate what felt wrong is still generating usable evidence, as long as something is recording it.

How to detect liveness injection attacks in your KYC flow

Open your funnel and your fraud log side by side, which in most institutions means getting two teams in one room.

Find the drop-off rate at your liveness step. Then ask what that step is defending against, specifically. If the answer is a replayed video or a printed photo, your active challenges are still doing work. If your fraud team is seeing accounts that passed every challenge cleanly, the challenges are costing you customers and buying nothing, and the honest move is to make the content check easier while adding a provenance check underneath it.

The blink was never proof of a human. It was proof that something could blink on command. Those stopped being the same thing.