identy.io

Best liveness detection software: A Buyer’s evaluation framework

Antony Vendhan — Fri, 04 Sep 2026 09:28:17 +0000

Most liveness detection vendors will show you the same demo. A phone, a face, a green checkmark. That tells you almost nothing about how the system behaves when someone actually tries to break it.

This guide gives you a framework to evaluate liveness detection software on the things that separate one vendor from another once the pilot ends and real volume starts. We do not rank products here. Vendor rankings age badly, and the right choice depends on your channel, your devices and your regulatory context. What does not change is the set of questions worth asking.

Detect Deepfakes before they become a Threat

Deepfakes are becoming more sophisticated, increasing the risk of fraud and identity manipulation in digital environments. Download our 10-step guide to learn how to detect threats early and protect your organization with proven best practices.

What liveness detection software actually protects against

Liveness detection answers one question: is the biometric sample in front of the camera coming from a real person who is physically present right now?

That question splits into two very different attack surfaces, and a lot of buyer confusion starts here.

Presentation attacks happen in front of the camera. Someone holds up a printed photo, replays a video on a second screen, or wears a silicone mask. The sensor sees something real, but not a real person. This is the category that ISO/IEC 30107 covers, and the standard is explicit that it deals with attacks taking place at the capture device during presentation.

Injection attacks bypass the camera completely. The attacker feeds a synthetic video stream directly into the application, using a virtual camera, an emulator or a compromised device. Nothing is presented to a sensor at all, so a system that only evaluates the image content can be satisfied by a well made deepfake. These attacks sit outside the scope of ISO/IEC 30107-3, which means a PAD certificate says nothing about them.

A vendor can be strong on one and weak on the other. When you compare liveness detection software, treat these as two separate line items rather than a single score.

Criterion 1: independent PAD certification under ISO/IEC 30107-3

Ask for third party evaluation results, not internal benchmarks. The relevant standard is ISO/IEC 30107-3, which defines how presentation attack detection is tested and reported. Independent labs run these evaluations, and the results are the closest thing the industry has to a common language.

Two details matter more than the certificate itself.

Level 1, Level 2, and Level 3 are not the same test

Level 1 covers lower cost attack instruments such as printed photos and screen replays.

Level 2 covers more sophisticated instruments, including custom made masks, and Level 3 evaluations introduce attack instruments that reflect higher attacker effort and resources, like Tom Cruise’s Mission Impossible masks.

A vendor that says “iBeta certified” without specifying the level has told you very little.

Check the metric alongside the level. Subsystem evaluations usually report APCER but it is mandatory to confirm BPCER as well, the classification error rates for attacks and for genuine users. Full system evaluations report IAPMR, the rate at which an attack is matched as a genuine user. These are not interchangeable, and a strong number on one says nothing about the other, and it is important to balance both security with usability.

Results are bound to test conditions

Any figure you are shown, including a zero false acceptance result, describes performance against the specific attack instruments used in that evaluation, under that lab’s protocol, on that date. It is a strong signal. It is not a guarantee against attack types that were not in scope. A vendor who explains this distinction unprompted is usually the one who understands their own system best.

Government led evaluations

Beyond lab certification, look for participation in government led programmes. The DHS Science and Technology Directorate ran the Remote Identity Validation Rally through 2025, evaluating document validation, selfie to document matching and presentation attack detection at the Maryland Test Facility, with results published under anonymised system identifiers.

RIVR is useful for a specific reason: it tests with human participants under conditions closer to real deployment, and it reports both security and usability metrics side by side. That combination exposes the tradeoff most vendor decks hide. A system can accept zero attacks and still reject a meaningful share of genuine users, and RIVR makes both numbers visible at once. Willingness to be measured that publicly is itself informative.

Criterion 2: passive liveness or active liveness

Active liveness asks the user to do something. Blink, turn your head, follow a dot, read a number aloud. Passive liveness analyses the capture without asking for any action.

Active checks were the early answer to presentation attacks, and they still have a place in high risk flows. The cost is measured in abandonment. Every instruction is a moment where a user misunderstands, gets frustrated or gives up, and the effect is not evenly distributed. Older users, users with limited mobility and users on older devices drop off more.

Passive liveness removes that friction, but only if it is genuinely passive. Some systems described as passive still require a specific framing or a slow approach to the camera. Ask to see the actual capture experience on a mid range Android device, not on the demo phone.

Note that the two are evaluated differently. Passive evaluations process previously acquired samples, while active evaluations assess the complete capture process with real users, which is why transaction time and satisfaction only appear in the active results. Comparing a passive score to an active score is not a like for like comparison.

The practical question is not which approach is better. It is whether the vendor lets you configure the level of challenge per risk tier, so that a routine login and a high value account opening do not have to use the same flow.

Criterion 3: on-device or server-side processing

Ask where the biometric sample is analysed. On the device, or on a server after upload. On-device processing changes several things at once. The raw image does not have to leave the phone, which narrows your data protection exposure and simplifies conversations with legal and compliance teams. Latency drops, because there is no round trip. And the flow keeps working where connectivity is poor, which matters far more in field operations, rural branches and emerging markets than most vendor decks acknowledge.

Server side processing has its own advantages, including easier model updates and centralised logging. The point is not that one architecture wins. The point is that this is an architectural decision with downstream consequences for privacy reviews, cost per transaction and geographic reach, and it should be made deliberately rather than inherited from whichever vendor you picked.

Criterion 4: injection attack detection and capture chain integrity

This is where injection attacks are won or lost, and it is the criterion most often missing from evaluation checklists.

A liveness engine that receives a video frame has no way of knowing whether that frame came from the device camera or from software pretending to be the device camera.

Protection has to be built at the point of capture. Look for vendors that can explain, in technical terms, how they bind the captured sample to the physical sensor and how they detect emulators, virtual cameras and tampered runtime environments.

Ask directly: what happens if I run your biometric SDK on a rooted device with a virtual camera feeding a deepfake video? A good answer is specific. A vague answer about advanced AI detection usually means the check happens after capture, which is the wrong layer.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Criterion 5: coverage across users and devices

Liveness detection has to work for everyone who needs to use it, not for the average of your user base. Ask for performance data broken down by demographic group, by device tier and by lighting condition. Systems that perform well in aggregate can still fail disproportionately for specific skin tones, ages or device classes, and those failures land as support tickets, branch visits and abandoned applications. Device coverage deserves its own question.

If your users include people on entry level Android phones with basic front facing cameras, confirm that the system runs on that hardware rather than requiring depth sensors or recent flagship chipsets. Universality is a technical property, and it is worth testing before you commit.

Criterion 6: SDK integration and documentation

Documentation quality is a reasonable proxy for engineering quality. Before signing, have one of your own developers integrate the SDK in a sandbox and time it.

Specific things to check:

Platform coverage for the environments you actually ship, including native iOS and Android, and any web or hybrid framework in your stack
SDK size and its effect on your app bundle
How model updates are delivered, and whether they require a full app release
Whether the UI is customisable enough to match your brand without forking anything
What the fallback path looks like when liveness fails, and whether that path is auditable

Criterion 7: questions to ask in a liveness detection demo

Bring these to the vendor call.

Which ISO/IEC 30107-3 level have you been evaluated at, by which lab, and on what date?
What attack instruments were in scope, and which were not?
What were your APCER and BPCER, or your IAPMR, and which metric applies to your evaluation type?
How do you detect injection attacks, and at what layer?
Is processing on-device, server side, or configurable?
Can I see performance broken down by demographic group and device tier?
What is the minimum device specification you support?
What happens to the captured image after the decision is made?

The answers you get to questions two, three and six will tell you more than any comparison table.

Choosing the best liveness detection software for your risk profile

Choosing liveness detection software is less about finding the highest score and more about matching the system to where your risk actually sits. A remote onboarding flow for a digital bank has a different threat profile than an in branch identity check or a returning user login.

Start by mapping which of your flows face presentation attacks, which face injection attacks, and which face both. Then evaluate vendors against that map rather than against a generic feature list. The vendor that can explain its own limits clearly is usually the one that will still be working three years from now.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

References

ISO/IEC 30107-3:2023, Information technology. Biometric presentation attack detection. Part 3: Testing and reporting, Edition 2, January 2023. ISO/IEC JTC 1/SC 37. https://www.iso.org/standard/79520.html
ISO/IEC 30107-1:2016, Information technology. Biometric presentation attack detection. Part 1: Framework. ISO/IEC JTC 1/SC 37. https://www.iso.org/standard/53227.html
iBeta Quality Assurance, ISO 30107-3 Presentation Attack Detection Test Methodology and Confirmation Letters. https://www.ibeta.com/iso-30107-3-presentation-attack-detection-confirmation-letters/
U.S. Department of Homeland Security, Science and Technology Directorate, Remote Identity Validation Rally. https://www.dhs.gov/science-and-technology/remote-identity-validation-rally
DHS S&T, DHS S&T Announces New Remote Identity Validation Rally, press release, 6 March 2025. https://dhs.gov/science-and-technology/news/2025/03/06/dhs-st-announces-new-remote-identity-validation-rally
Maryland Test Facility, Remote Identity Validation Rally: Results. https://mdtf.org/rivr/Results
Biometric Update, Aware active and passive liveness tested in RIVR’s biometric PAD track, April 2026. https://www.biometricupdate.com/202604/aware-active-and-passive-liveness-tested-in-rivrs-biometric-pad-track
Identy.io, Identy.io Achieves Zero Attack Acceptance in DHS RIVR Face Liveness Evaluation, Business Wire, 18 March 2026. https://businesswire.com/news/home/20260318279525/en/Identy.io-Achieves-Zero-Attack-Acceptance-in-DHS-RIVR-Face-Liveness-Evaluation-Leads-Field-on-Speed-and-User-Satisfaction
Identy.io, ISO/IEC 30107-3 PAD Level 2: Biometric Buyer’s Guide. https://www.identy.io/iso-iec-30107-3-pad-level-2-biometric-buyer-guide/

La entrada Best liveness detection software: A Buyer’s evaluation framework se publicó primero en identy.io.

Mule account detection: The identity layer transaction monitoring cannot see

Jesús Aragón — Thu, 27 Aug 2026 07:17:12 +0000

Mule accounts pass KYC. That is the whole problem.

A money mule account is opened with a real name, a real document and a real face. Every check the onboarding flow was designed to run comes back clean, because nothing about the identity is false. The fraud is not in the identity. It is in the relationship between accounts, and that is a layer most onboarding stacks never look at.

This article covers what mule account detection requires, why the two controls banks rely on most cannot see the pattern, and where biometric identification changes the picture. It closes with the Mexican market, where a recent regulatory change makes this concrete.

Detect Deepfakes before they become a Threat

What a mule account is, and the three types that matter for detection

A mule account receives funds from illicit activity and moves them onward, breaking the trail between the crime and the cash. Fraud proceeds, scam payments and laundered money all pass through them.

The scale is not marginal. In the ninth edition of the European Money Mule Action, run in 2023, law enforcement agencies coordinated by Europol identified 10,759 money mules and 474 recruiters in a single operational cycle, leading to 1,013 arrests. A total of 2,822 banks and financial institutions took part alongside them. Those are the ones that were found.

Mule accounts come from three routes, and they are not equally hard to detect.

Recruited mules are real people who agree to lend their identity, usually for a small payment. Europol’s awareness materials point to newcomers to a country and people in financial difficulty as frequent targets, often approached through fake job advertisements online. The account is genuinely theirs.

Coerced or unwitting mules are people whose identity is used without informed consent, often through fake job offers or romance scams. Europol describes recruitment through advertised roles such as money transfer agent, through online advertising and through messaging apps. The paperwork is legitimate and the person is present at onboarding.

Synthetic identities combine real data points with fabricated ones to create a person who does not exist but who passes document checks. These are the hardest to catch, and they are the ones that scale, because the same fabricated profile can be reproduced with variations rather than built from nothing each time.

What links all three is volume. Mule networks do not open one account. They open dozens or hundreds, often at the same institution, often within weeks. That repetition is the detectable signal.

Why transaction monitoring detects mule accounts late

Transaction monitoring is designed to flag anomalous movement of funds. It works, and it is required. But it is a lagging control by construction.

The account has to exist, be funded and move money before a rule fires. By the time an alert reaches an analyst, the funds have often already been forwarded, which is why recovering them is difficult once the chain is in motion.

Mule operators also tune their behaviour to stay under thresholds. Amounts sit below reporting limits, transfers are spread across accounts, and dormancy periods are inserted before the account is used. A network of forty accounts each moving modest sums is far less visible to a rules engine than one account moving the same total.

Transaction monitoring is the right control for the money. It is the wrong control for the account farm.

Why 1:1 verification cannot detect mule account networks

Most identity verification at onboarding is 1:1. The system compares the selfie to the document photo and answers a single question: is this person the person on this document?

That is a useful question. It stops document fraud and impersonation. It also cannot detect mule networks, and the reason is structural rather than a matter of accuracy.

A 1:1 check evaluates one application in isolation. It has no memory of the other applications. If the same person opens six accounts using six genuine identities they have been paid to lend, each check returns a correct positive result. If a synthetic identity operator uses the same face across twelve fabricated profiles, every single check passes, because in each case the selfie really does match the document in front of it.

The system is answering the question it was asked. The question is incomplete.

How 1:N biometric identification changes mule account detection

The missing question is different: have we seen this face before, under a different name?

Answering it requires 1:N identification, where a new biometric sample is searched against the entire enrolled population rather than compared to one document. This is what an ABIS, an Automated Biometric Identification System, is built to do.

At onboarding, the effect is immediate. The applicant’s biometric is searched against existing customers and against prior applications. If the same person appears under a second identity, the system surfaces it before the account is opened rather than after the money has moved.

This is deduplication, and it changes what each of the three mule types looks like. It is worth being precise about which ones, because deduplication does not reach all of them equally.

Synthetic identity fraud detection

This is where 1:N is strongest. Fabricated profiles have to reuse something. Generating a single convincing face is no longer expensive, but keeping a face, a document and a data trail consistent across dozens of profiles and over time is a different problem, and reuse across profiles is exactly what 1:N search detects.

Account farms and repeat enrolment

Where the same individual enrols under more than one identity, which is the defining pattern of an account farm, deduplication surfaces it on the second attempt rather than on the fortieth. This holds whether the identities are synthetic, borrowed or stolen.

Recruited and coerced mules: what deduplication does not reach

If a recruited mule opens one account in their own name, using their own genuine document, nothing at onboarding will flag it. The person is real, the document is real, the face matches, and the enrolment is legitimate at the moment it happens. Deduplication does not change that, and a vendor claiming otherwise is overstating what the control does.

What does apply is a different placement of the same technology. Biometric step-up at the point of transaction requires the account holder to be physically present when funds move, which breaks the arrangement where one person opens an account and another operates it remotely. It does not detect the recruitment. It removes the utility of the account.

Cross channel reuse

The same person appearing in a branch, in an app and through a partner channel under different identifiers is invisible to any control that treats those channels separately. A shared biometric gallery makes it a single query, provided the institution has the legal basis and the governance to hold and search one.

A note on scope. Europol’s operations reach mule networks by pooling intelligence across institutions and borders. Not every jurisdiction allows that, and some deliberately prohibit it. Where sharing is restricted, deduplication works within one institution’s own enrolled population: narrower reach, but available in real time at the point of enrolment rather than after the fact.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Implementing biometric deduplication in onboarding

Adding 1:N to an onboarding flow raises engineering and governance questions worth planning for.

Capture quality determines search quality. A 1:N search across a large gallery is far more sensitive to sample quality than a 1:1 comparison. Poor lighting, motion blur and low resolution produce missed matches. Capture has to be controlled at the point of collection, on the device, rather than corrected later.

Liveness has to sit underneath it. A 1:N search on a sample that was injected or presented from a screen produces a confident answer about the wrong thing. Presentation attack detection, tested under ISO/IEC 30107-3, and injection attack detection are prerequisites rather than optional additions. Where a vendor cites evaluation results, ask which conditions the evaluation was run under.

On-device processing helps on three fronts. Keeping the capture and the initial processing on the phone reduces the volume of biometric data in transit, keeps latency low enough for the check to happen inside the onboarding flow, and lets the process complete where connectivity is unreliable. For institutions operating across rural areas or in markets with uneven network coverage, this is a coverage requirement rather than an optimisation.

Governance has to be defined before deployment. Retention periods, consent language, the declared purpose of the database, the legal basis for searching against an existing population, and the human review path for a match all need to be settled with legal and privacy teams up front. This is not paperwork that follows the build. In several jurisdictions biometric data is classified as sensitive personal data, and searching an enrolled population for fraud prevention is a different purpose from authenticating a customer. Different purpose, different legal basis, different disclosure. A match is an investigative signal, not a verdict, and the process around it should reflect that.

Multimodal raises the ceiling. Face alone is workable. Face combined with fingerprint gives a materially stronger deduplication result, particularly at national scale, and it provides a fallback when one modality is unusable.

Mule account detection under Mexico's new CNBV biometric rules

Mexico offers a concrete example of this shift, because the regulatory framework moved first.

On 1 July 2026 the Comisión Nacional Bancaria y de Valores published in the Diario Oficial de la Federación a resolution amending the general provisions applicable to credit institutions, in respect of identity verification in in-person banking transactions. Until then, those provisions recognised only fingerprint as a biometric verification method for those transactions. The resolution adds facial biometrics, requires verification against the records of the electoral institute, the foreign affairs ministry, or another Mexican tax or federal authority providing a comparable service, with a minimum match of 90 percent, and replaces the technical annex governing biometric capture. It entered into force on 2 July 2026, and institutions were given a maximum of 90 business days to adapt.

The resolution also allows institutions to build their own biometric databases of customers, subject to dedicated infrastructure, encryption and access controls. Institutions must notify the supervisor when they begin or cease using such a database. Selling, transferring, sharing or exchanging those databases between institutions or with third parties is prohibited, and queries run against each institution’s own database only. For now the database is limited to fingerprint and facial data, until the Commission issues technical specifications for other biometric types.

The immediate reading is compliance. Institutions need facial capture in in-person flows that previously relied on documents, fingerprint and manual review.

The second reading is architectural, and it needs one qualification stated clearly. The resolution frames these databases around authentication of clients. It does not mandate, and does not by itself authorise, 1:N search for fraud prevention or the reuse of a credential for other purposes. Those are different purposes, and under Mexican data protection law biometric data is sensitive personal data, so an additional purpose requires its own legal basis, its own disclosure in the privacy notice and its own express consent. Compliance with the resolution does not carry those purposes with it.

What the resolution does leave behind is a consistent biometric record of the customer base, held by the institution itself, built to a defined technical standard. That record is the precondition for deduplication. Whether it becomes one is a separate decision, taken deliberately and documented with legal counsel before the first enrolment rather than after.

An institution that treats the requirement as a checkbox will deploy facial capture, satisfy the supervisor, and still be unable to answer whether the same person holds accounts under three names. An institution that scopes the purpose properly at the design stage keeps that answer available to it.

The deadline is the same for both. The optionality afterwards is not.

Where to start with mule account detection

Mule account detection is a sequencing problem more than a technology problem. Transaction monitoring will keep doing what it does well. What sits in front of it determines how much reaches it.

Three questions to put to your team:

If the same person opened accounts under three different identities today, at what point would we find out?
Do we have a biometric record consistent enough across channels to search against, and a declared purpose that covers searching it?
Is our capture step strong enough that a 1:N result would be trustworthy?

If the answer to the first question is “when the money moves”, the gap is at onboarding, and it is an identity layer question.

Talk to our team about evaluating a digital identity platform, and about where ABIS fits in your onboarding architecture.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

References

Europol, Paper trail ends in jail time for 1,013 money mules, European Money Mule Action (EMMA 9) results, 2023. https://www.europol.europa.eu/media-press/newsroom/news/paper-trail-ends-in-jail-time-for-1-013-money-mules
European Banking Federation, Paper trail ends in jail time for 1,013 money mules. https://www.ebf.eu/ebf-media-centre/paper-trail-ends-in-jail-time-for-1-013-money-mules-2-822-banks-and-financial-institutions-join-forces-with-law-enforcement-agencies-in-global-effort-against-money-laundering/
Comisión Nacional Bancaria y de Valores, Resolución que modifica las Disposiciones de carácter general aplicables a las instituciones de crédito, Diario Oficial de la Federación, 1 July 2026. https://dof.gob.mx/nota_detalle.php?codigo=5792307&fecha=01%2F07%2F2026
Basham, Ringe y Correa, Resolution amending the General provisions applicable to credit institutions, July 2026. https://basham.com.mx/en/resolution-amending-the-general-provisions-applicable-to-credit-institutions/
Infobae, Los bancos mexicanos ya pueden identificar con el rostro, 8 July 2026. https://www.infobae.com/mexico/2026/07/08/los-bancos-mexicanos-ya-pueden-identificar-con-el-rostro-para-quien/
ISO/IEC 30107-3:2023, Information technology. Biometric presentation attack detection. Part 3: Testing and reporting. https://www.iso.org/standard/79520.html

La entrada Mule account detection: The identity layer transaction monitoring cannot see se publicó primero en identy.io.

Agricultural loans: Major Beneficiaries of Biometric Technology

Antony Vendhan — Thu, 13 Aug 2026 11:10:40 +0000

The agricultural sector remains one of the main economic drivers throughout Latin America. In Brazil, this industry accounts for nearly 6.9% of GDP, according to data from the Brazilian Confederation of Agriculture and Livestock (CNA), while in Colombia, the growth in agricultural value added was 4.1% last year, exceeding the national GDP, which stood at 2.8%.

Much of this growth is attributable to the granting of agricultural loans, which are essential in many cases to cover the costs of starting and maintaining these businesses. In Colombia, for example, more than 395,000 agricultural loans were granted in 2025, totaling a record $48.1 billion, while in Peru, 52,000 producers benefited from more than S/ 839 million in aid.

Although the agricultural sector is increasingly turning to digitalization as a tool to streamline a wide range of administrative procedures—especially when it comes to dealing with financial institutions—the reality is that this shift is still uneven. In countries like Brazil, where there are vast distances between rural areas and major cities, and where access to digital tools is uneven, not all producers have the same opportunities to conduct their business without having to travel to financial institutions’ offices.

Biometrics as a driver of financial inclusion

Let’s imagine the case of a farmer who has to travel hundreds of miles from his home to the nearest bank branch. For him, beyond the time investment required to complete the process, applying for a new agricultural loan would cost hundreds of dollars—an expense he might not be able to afford, depending on his financial situation. In such cases, biometrics proves to be a strategic tool for ensuring that any producer, regardless of where they live or their ability to travel, can conveniently apply for an agricultural loan at any time with complete security.

Operationally, this substantial change in how people interact with banks also brings significant time-saving benefits. While until not too long ago it was necessary to wait between 15 and 45 days to access the loan once applied for, thanks to the biometrics-based online application, this time can be reduced to just 48 hours. And for banks, this technology can lead to a reduction of up to 40% in operating costs, according to forecasts by McKinsey & Company.

However, as with any other online procedure, the ability to complete these processes remotely carries with it the risk of fraud and identity theft. For this reason, biometrics has established itself as a new layer of security that, beyond simplifying the process of applying for agricultural loans, helps protect users and financial institutions from the risks associated with identity theft.

In this context, companies like Identy.io have developed a suite of biometric-based solutions that help verify a user’s identity quickly and easily, right from their own mobile phone. Once the user completes the registration process, during which their digital credentials—such as fingerprints or facial features—are captured, the system stores all their digital information on their own phone to make it easier to perform subsequent checks against a centralized database, thereby verifying the user’s identity and ensuring they are who they claim to be in any type of transaction. Additionally, the BioCode QR — a compact, encrypted container holding biographical information and user’s facial and fingerprint data, cryptographically signed by the issuing institution — can be stored in a digital wallet or even printed, making identity credentials available whenever and wherever they’re needed.

The use of biometrics is not only beneficial for end users, but financial institutions also derive clear benefits from its implementation. For example, the report “Financial Data Unbound” by the consulting firm McKinsey estimates that dropout rates for loan applications processed digitally are 30% to 45% lower than those for traditional manual workflows. Similarly, this report shows that the cost per loan origination is reduced by 30 to 40%, allowing banks to make more aggressive offers without compromising their profit margins. For example, in Brazil, it is estimated that the ability to apply for loans remotely could reduce dropout rates by up to 29% and decrease data duplication and errors in applications by up to 18%, according to the specialized consulting firm Ken Research.

And in a context where cases of identity theft using deepfakes and digital doubles are becoming increasingly common, biometrics is establishing itself as the ideal tool to provide an additional layer of security in transactions. In the case of Identy.io’s biometric solutions, the incorporation of passive liveness detection technology—meaning it requires no movement or predefined action to verify that the user accessing the system is a real person and not a digital entity created by artificial intelligence—makes this type of identity theft virtually impossible.

La entrada Agricultural loans: Major Beneficiaries of Biometric Technology se publicó primero en identy.io.

How fingerprint biometrics is strengthening banking security

Antony Vendhan — Thu, 06 Aug 2026 14:50:03 +0000

The global financial system is currently facing mounting pressure due to the rise of digital fraud. According to recent data from the Central Bank of Brazil, in less than five months of 2026, 25 fraud incidents have already been recorded out of 33 security events reported by the agency—the highest figure ever recorded for this period. The rapid growth of tools like Pix and Openfinance, which currently handle billions of monthly transactions, has also expanded the attack surface for cybercriminals, who are increasingly operating with more sophisticated and professional structures. This trend is also reflected in other regional markets, such as Mexico, where around 14,000 complaints regarding banking-related fraud are recorded daily, according to the Bureau of Financial Entities (BEF).

This scenario has highlighted the need to strengthen user authentication and identification mechanisms within the digital financial ecosystem through the use of biometric authentication software. The Central Bank of Brazil itself warned about the increase in attacks targeting technological infrastructures, APIs, and authentication systems, in a context where many institutions still show flaws in technological risk management and the adoption of advanced security controls. Meanwhile, in Mexico, CONDUSEF reports that 76.9% of financial fraud in the country is concentrated in three main methods: calls pretending to be from banks, SMS messages about alleged suspicious charges, and fake websites mimicking legitimate financial institutions.

The growing use of artificial intelligence by criminal groups is increasing the complexity of fraud in Latin America, enabling automated attacks, fake apps, and sophisticated social engineering techniques capable of compromising digital identities more easily. In this context, biometrics is increasingly becoming a critical layer of protection to ensure that the person performing a transaction or accessing a financial service is truly who they claim to be.

Multimodal Biometrics as a New Barrier Against Banking Fraud

The accelerated growth of financial scams has exposed the limitations of many traditional authentication systems used by banks and digital platforms until now. Passwords, codes sent via SMS, and even certain facial recognition systems have begun to show vulnerabilities to increasingly sophisticated attacks, especially in a context where deepfakes and video injection techniques allow for the highly accurate replication of a person’s face and voice. This has led the financial sector to start investing in much more robust biometric authentication models based on advanced biometric authentication software.

In this scenario, multimodal biometrics—which combines different biometric factors such as facial recognition and fingerprint biometrics—is positioned as one of the most secure alternatives for validating a user’s identity. While facial biometrics can be compromised through advanced image or video manipulation techniques, fingerprint biometrics adds an additional layer that is practically impossible to replicate simultaneously. Combining both factors drastically raises the security level and reduces the risk of identity theft in banking operations, account openings, or the validation of high-value transactions.

Contactless Fingerprint Biometrics: A New Generation of Biometric Security

The contactless fingerprint biometric solutions developed by Identy.io have been specifically designed to respond to this new landscape of digital threats. Unlike traditional systems that require specialised physical scanners, this technology allows fingerprint biometrics to be captured directly from the user’s mobile phone camera, without the need for additional hardware. This makes it easy for anyone to authenticate from anywhere at any time using only their smartphone.

Another key differentiator of this technology is the incorporation of advanced passive liveness detection systems within the biometric authentication software. Using artificial intelligence algorithms, the system analyses multiple variables in real-time, such as subtle skin movements, fingerprint texture, or the way light reflects off the finger, allowing it to determine if the print truly belongs to a living person present at that moment. This makes it possible to detect fraud attempts using silicone moulds, artificial reproductions, or biometric forgeries. Consequently, verification can be performed even in complex lighting conditions and using conventional mobile phones, democratising access to advanced biometric authentication without the need for expensive devices or specialised infrastructure.

Furthermore, the combination of facial and fingerprint biometrics allows for the construction of much more solid multimodal authentication models within modern biometric authentication software. Even if an attacker managed to artificially replicate a person’s face using generative AI techniques, they would still need to simultaneously reproduce their real fingerprints, which enormously increases the complexity of the attack and makes authentication a significantly more secure and reliable process for the financial sector.

Privacy, Identity Control, and Secure Authentication from the Mobile Phone

The process of using these solutions begins during digital onboarding, when the user generates their biometric credentials using their own mobile device via biometric authentication software. By capturing all 10 fingerprints and facial recognition, a unique digital identity is created that is unequivocally linked to the user. This information is protected by advanced encryption protocols and stored directly on the user’s device under an on-device architecture, reducing the exposure of sensitive data to potential leaks or attacks on external servers.

Thanks to this model, biometric credentials can later be used for both 1:1 validations (confirming the user is who they say they are) and 1:N processes by comparing them against authorised centralised databases. This strengthens security in critical operations such as opening bank accounts, credit approvals, digital contract signing, or transaction authorisation, drastically minimising the risk of fraud or identity theft.

Identy.io’s solutions also allow for the generation of biometric QR codes, which contain verified user information and can be used to validate identity or share specific credentials securely at any time. Thanks to this system, the user maintains total control over what information they share, when, and with whom, while storing their critical data within a secure digital wallet protected by advanced encryption standards.

Unlike many traditional biometric systems that constantly depend on an internet connection or external infrastructure, Identy.io’s mobile-first and on-device architecture allows much of the processing and validation to be performed directly on the mobile phone via biometric authentication software. This not only improves speed and user experience but also reduces the exposure surface to potential attacks, significantly increasing privacy and security levels.

In an environment where financial fraud is constantly evolving and digital impersonation techniques are becoming increasingly sophisticated, multimodal biometrics is establishing itself as one of the most effective mechanisms for protecting user identity. The combination of facial recognition, contactless fingerprint biometrics, and advanced liveness detection technologies allows for the construction of much more robust, accessible, and secure authentication processes. In this way, biometric authentication software enables the financial sector to move towards more reliable digital banking models, where security, privacy, and user experience are the new industry standard.

La entrada How fingerprint biometrics is strengthening banking security se publicó primero en identy.io.

Best Identity Verification Software: How to Choose in 2026

Antony Vendhan — Fri, 31 Jul 2026 12:44:57 +0000

The best identity verification software is not a brand — it is a set of verifiable properties: independently benchmarked biometric accuracy, certified liveness detection, universal device reach, modality coverage that matches your use case, and a privacy architecture that survives regulatory scrutiny. This guide gives you the evaluation framework, the certification standards to demand, the red flags to avoid and a practical checklist you can take into any vendor conversation. For background on how verification works end to end, see our complete guide to identity verification.

Detect Deepfakes before they become a Threat

What the best identity verification software must do

Strip away the marketing and every identity verification solution is judged on four jobs: prove the document is genuine, prove a live person is present, prove the person matches the document, and do all of it fast enough that legitimate users do not abandon. A solution that excels at three and fails one is a liability — fraud enters through the weakest layer, and revenue leaks through the slowest one.

The 6 evaluation criteria that separate solutions

1. Certified liveness detection

Anti-spoofing claims mean nothing without third-party testing. Demand ISO/IEC 30107-3 PAD Level 2 certification from an accredited lab — the level that covers 3D masks and sophisticated artifacts, not just printed photos. We explain the standard and the attack types in our guide to liveness detection software. Identy’s engine passed Level 2 evaluation with a 0% penetration rate — see the certification details.

2. Independently benchmarked accuracy

Ask where the matching algorithms stand in NIST evaluations or equivalent independent benchmarks, broken down by demographic group. Internal accuracy figures without an external reference are unverifiable.

3. Modality coverage

Face-only solutions exclude the use cases where fingerprints or palms are the enrolled trait — national ID systems, banking cores, workforce deployments. Full coverage means face, contactless fingerprint and palm verification, as delivered by Identy’s biometric identity verification platform.

4. Universal device reach

If verification requires a dedicated sensor, your addressable user base shrinks to the devices that have one. Camera-based capture through the standard smartphone camera reaches 100% of smartphone users — decisive for financial inclusion and government programs.

5. Privacy architecture

Biometric data is a special category under GDPR and equivalent frameworks. Prefer solutions that process on-device where possible, store only encrypted templates (never raw images), and document data flows for your DPO before procurement asks.

6. True cost per verified user

The relevant metric is not price per verification — it is price ÷ pass rate, accounting for retries. A cheaper solution with a 75% first-pass rate costs more per verified customer than a pricier one passing 95% of legitimate users.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Red flags when evaluating identity verification solutions

No accredited PAD report. ‘Bank-grade liveness’ with no ISO/IEC 30107-3 evidence is a claim, not a control.
Accuracy figures without demographic breakdown. Averages hide failure modes that become discrimination complaints.
Hardware dependencies buried in the fine print. Pilot on the cheapest Android devices your users actually own.
Raw biometric image storage. If the vendor keeps selfies and fingerprint photos, their breach becomes your breach.
Opaque pricing tiers. Insist on modeling total cost at your real volume, pass rate and retry distribution.

The Buyer's Checklist

Request the ISO/IEC 30107-3 Level 2 test report and verify the issuing lab’s accreditation.
Request NIST or equivalent benchmark positions for every matching algorithm in scope.
Pilot with your real user base and devices; measure first-pass rate, median completion time and abandonment.
Run a data-protection review: template storage, on-device options, retention and deletion guarantees.
Test the SDK integration effort on your actual stack — explore the Identy biometric SDK documentation as a reference for what complete tooling looks like.
Negotiate on cost per verified user, not cost per attempt.

How Identy measures against these criteria

Identy verifies identity with face, contactless fingerprint and palm biometrics captured by any standard smartphone camera, combined with document verification and passive liveness certified at ISO/IEC 30107-3 PAD Level 2 (0% penetration rate). Templates are encrypted and processing can run on-device, and the SDK ships for native mobile and web. See the id verification software product page for capabilities and a demo request.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Frequently Asked Questions

What is the best identity verification software?

The one that verifies documents and biometrics with independently benchmarked accuracy, holds ISO/IEC 30107-3 PAD Level 2 liveness certification, works on any smartphone camera without dedicated hardware, covers the modalities your use case requires and keeps biometric data private by design.

How much does identity verification software cost?

Typically per verification: from under $0.50 for basic document checks to $2+ for full document-plus-biometric flows with screening. Model the true cost as price per verification x pass rate and retries, not the list price.

What features matter most in identity verification solutions?

Certified liveness (ISO/IEC 30107-3 Level 2), independently benchmarked accuracy, document coverage in your markets, SDK quality and device compatibility, privacy architecture, and cost at your volume.

References

NIST — Face Technology Evaluations (FRTE/FRVT), accuracy benchmarks. https://www.nist.gov/programs-projects/face-technology-evaluations-frtefate
ISO/IEC 30107-3 — Biometric presentation attack detection, Part 3. https://www.iso.org/standard/79520.html
iBeta — PAD testing levels and accredited evaluation. https://www.ibeta.com
FATF (2020) — Guidance on Digital Identity (remote onboarding assurance). https://www.fatf-gafi.org/
EDPB / GDPR Art. 9 — Processing of special categories of personal data (biometric data). https://gdpr-info.eu/art-9-gdpr/

La entrada Best Identity Verification Software: How to Choose in 2026 se publicó primero en identy.io.

Biometric Authentication: What It Is, Methods & How It Works

Rodrigo Ramos — Sat, 25 Jul 2026 11:07:25 +0000

Biometric authentication confirms a returning user’s identity through a unique biological trait (face, fingerprint or palm) instead of a password or token. Because the credential is the person, it cannot be phished, shared, reused across services or forgotten. This guide explains how biometric authentication works, the main methods and their trade-offs, how it differs from identity verification, and what it takes to deploy it on any smartphone without special hardware.

Detect Deepfakes before they become a Threat

What Is Biometric Authentication?

Biometric authentication is the second half of the digital identity lifecycle. Verification establishes who you are once, at onboarding; authentication proves you are still you every time you return. Technically, a live biometric sample is captured, converted into a mathematical template, and compared against the template enrolled at verification. A match above threshold grants access; everything else is rejected or escalated.

Three properties make biometrics superior to knowledge-based credentials: they are unique to each individual, always present (nothing to remember or carry), and when protected by liveness detection hard to steal in usable form, because a photo of a face is not a face.

How Biometric Authentication Work

Enrollment. During onboarding, the user’s biometric trait is captured and transformed into an encrypted template. Raw images are discarded; templates are stored on-device or in a secure enclave depending on the privacy architecture.
Capture. On each login or transaction, the user presents the trait to the device camera or sensor.
Liveness check. The system confirms a live human is present, blocking photos, replays, masks and deepfakes — the anti-fraud layer we cover in depth in our guide to liveness detection software.
Matching. The fresh template is compared to the enrolled one; a similarity score above threshold authenticates the user in under a second.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Biometric Authentication Methods

Facial recognition

The most frictionless method: the front camera captures the face passively during app use. Modern engines handle pose, lighting and aging, and pair with passive liveness for spoof resistance. Developers integrate it through a facial recognition SDK.

Fingerprint recognition

The most established modality. Beyond capacitive sensors, contactless fingerprint capture photographs the fingerprints with the standard rear camera and matches them against sensor-enrolled or card-enrolled prints, enabling deployment on any device — see the finger biometric SDK.

Palm recognition

Palm prints offer a large, stable trait that captures well at a distance with a phone camera, tolerating dirt and minor injuries better than fingerprints — a strong fit for workforce and financial-inclusion scenarios via the palm biometric SDK.

Other modalities and combinations

Iris and voice recognition serve niche high-security and hands-free contexts. Combining two or more traits raises assurance further; we analyze that approach in multimodal biometrics, the future of digital authentication.

Biometric Authentication vs Passwords, OTPs and Tokens

Passwords fail through phishing, reuse and credential-stuffing; SMS OTPs fail through SIM-swap; hardware tokens are costly and losable. Biometrics eliminate the shared secret entirely: there is nothing to intercept that can be replayed, provided the system enforces certified liveness. This is why frameworks such as NIST SP 800-63B recognize biometrics as an authentication factor when bound to a device and protected by presentation attack detection, and why passwordless initiatives from the FIDO Alliance lean on device-bound biometrics.

Security: Anti-Spoofing and Privacy

Two questions decide whether a biometric system is trustworthy. First, can it be spoofed? Only solutions independently tested against ISO/IEC 30107-3 — such as Identy’s PAD Level 2 certified engine — can substantiate anti-spoofing claims. Second, where does the data live? Privacy-first architectures keep templates encrypted on-device, process matching locally where possible, and never store raw biometric images, aligning with GDPR’s treatment of biometric data as a special category.

Use Cases

Banking and fintech: passwordless login, transaction signing and step-up authentication — detailed in face and fingerprint identification in banking and fintech.
Government services: citizen authentication for benefits, tax portals and digital ID programs.
Enterprise workforce: shared-device login in retail, logistics and healthcare without badge or password friction.
High-risk actions: payment release, account recovery and privilege escalation guarded by a biometric step-up.

Implementing Biometric Authentication with an SDK

Deployment reduces to one decision: hardware-dependent or contactless. Contactless SDKs use the existing smartphone camera for face, fingerprint and palm, which means every user’s device is already compatible. Evaluate accuracy benchmarks (NIST testing), liveness certification, on-device processing options, offline support and integration effort. The Identy biometric SDK covers all three modalities with passive liveness in native mobile and web packages.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Frequently Asked Questions

What is biometric authentication?

The process of confirming a returning user’s identity using a unique biological trait — face, fingerprint or palm — by comparing a live sample against a previously enrolled template.

What are the main biometric authentication methods?

Facial recognition, fingerprint recognition (including contactless capture), palm recognition, iris and voice. Multimodal systems combine several traits for higher assurance.

Is biometric authentication more secure than passwords?

Yes. Biometric traits cannot be phished, reused or forgotten, and certified liveness detection makes them resistant to spoofing — unlike passwords, the leading cause of account compromise.

What is the difference between biometric authentication and identity verification?

Verification happens once at onboarding against an official document; authentication happens on every return visit to confirm the same person is back.

Can biometric authentication work without special hardware?

Yes. Contactless SDKs capture fingerprints, palms and faces with the standard smartphone camera, extending biometric security to every device.

NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management. https://pages.nist.gov/800-63-4/
NIST — Face Technology Evaluations (FRTE/FRVT). https://www.nist.gov/programs-projects/face-technology-evaluations-frtefate
FIDO Alliance — User Authentication Specifications (passwordless / passkeys). https://fidoalliance.org/specifications/
ISO/IEC 30107-3 — Biometric presentation attack detection, Part 3. https://www.iso.org/standard/79520.html
EDPB / GDPR Art. 9 — Processing of special categories of personal data (biometric data). https://gdpr-info.eu/art-9-gdpr/

La entrada Biometric Authentication: What It Is, Methods & How It Works se publicó primero en identy.io.

Biometric verification solutions are strengthening security for telecommunications

Rodrigo Ramos — Tue, 21 Jul 2026 15:15:17 +0000

The rapid digitization of financial, administrative, and telecommunications services in Latin America has accelerated the adoption of biometric verification solutions and advanced biometrics for telecommunications to combat the growing rise of digital fraud and identity theft. In Mexico alone, nearly 16 million people could fall victim to some form of digital fraud by 2026, according to estimates based on data from the National Commission for the Protection and Defense of Financial Services Users (CONDUSEF), while the Federal Telecommunications Institute warns that more than 95.5% of the country’s mobile phone users are exposed to phenomena such as SIM swapping if they do not implement additional security measures beyond authentication via SMS or phone calls.

At the same time, countries such as Peru and Colombia also face significant challenges related to both digital security and technological inclusion: according to data from the Crime and Violence Observatory, more than 2.7 million Peruvians experienced some form of identity theft in 2025, while a study by Accenture reveals that 32% of Peruvian business leaders currently consider identity theft to be their top concern.

Among the most frequent types of fraud in telecommunications are:

Fake call centres: Criminals pose as bank or telecommunications company employees to convince victims to install remote access applications, taking full control of the phone and accessing banking apps or personal data.
Non-existent prizes: Criminals resort to supposed prizes or fake promotions to pressure users into sharing confidential information or making immediate payments.
Virtual kidnappings: Criminals use calls manipulated with ambient sounds and leaked internet data to generate panic and demand urgent transfers.

These scam methods demonstrate how telecommunications fraud no longer depends solely on technical vulnerabilities, but also on the attackers’ ability to exploit people’s identity and trust.

Biometric verification solutions as a new barrier against telecommunications fraud

The growth of phone scams and identity theft attempts has forced the telecommunications sector to adopt stronger biometric verification solutions and more secure biometrics for telecommunications authentication mechanisms. In an environment where criminals resort to emotional manipulation and the use of artificial intelligence to deceive users, biometrics is establishing itself as one of the most effective tools for protecting both users and organisations. In this case, biometric verification technologies significantly reduce the risks associated with identity theft by ensuring that the person accessing a service, authorising an operation, or requesting a procedure is truly who they say they are.

The process begins with digital onboarding, where biometric verification solutions allow users to capture their fingerprints or facial features using their own mobile phone to generate secure digital credentials. From that moment on, these credentials can be used to validate the user’s identity against official databases, allowing for 1:1 and 1:N authentication processes with high levels of reliability. Furthermore, these solutions allow for the issuance of biometric QR codes containing validated user information, which can be used to authenticate or share specific data in a controlled manner, allowing each person to decide what information they share, when, and with whom.

This approach is particularly relevant for biometrics for telecommunications, where many scams occur precisely through fake calls, line change requests, SIM swaps, or fraudulent access to user accounts. Thanks to biometrics, it is possible to add a layer of security that is practically impossible to replicate using traditional methods based solely on passwords, SMS, or security questions, which are often vulnerable to social engineering attacks or data leaks.

Unlike the basic biometric systems integrated into many mobile devices, Identy.io’s biometric verification solutions are not limited to checking that the face or fingerprint matches those previously stored on the phone. The technology compares the user’s biometric information against verified credentials and authorised databases, ensuring the real authenticity of the digital identity and considerably raising the level of protection against sophisticated fraud attempts.

Passive liveness and on-device architecture in biometric verification solutions

One of Identy.io’s differentiating elements is the use of passive liveness detection technology, designed to detect fraud attempts without adding complexity to the user experience. Unlike other systems that require specific movements, such as blinking, smiling, or turning the head, this technology works transparently and automatically, analysing factors such as skin micro-movements, facial patterns, depth, or light reflections to confirm that the person interacting with the system is real and not a photograph, a video, a mask, or an AI-generated deepfake.

This is especially important in the current context, where cybercriminals increasingly use artificial intelligence tools to create synthetic identities or simulate real voices and images with a high degree of precision. Thanks to the use of advanced AI algorithms and proprietary biometric models, these solutions are capable of identifying anomalies imperceptible to the human eye and blocking fraudulent access before it can compromise the security of the user or the telecommunications operator.

Added to this layer of security is a completely on-device architecture, in which all the user’s biometric information is processed and stored directly on the mobile phone itself. This means that sensitive data does not need to be constantly sent to external servers to validate identity, drastically reducing the risks associated with leaks, interceptions, or attacks on centralized databases. Furthermore, this approach eliminates the dependency on a permanent internet connection and allows the solution to work even on low-end devices that only need a camera and a flash to capture biometric information.

In a context where phone scams and identity theft evolve at the same pace as technology, biometrics for telecommunications are becoming essential for protecting users without creating friction in their digital experience. Advanced biometrics, combined with secure architectures and user-centric privacy models, is emerging as one of the most solid responses to this new threat landscape. Through technologies such as passive liveness, digital credentials, and on-device biometric authentication, Identy.io demonstrates how biometric verification solutions can help telecommunications companies build more secure, accessible, and reliable digital ecosystems.

La entrada Biometric verification solutions are strengthening security for telecommunications se publicó primero en identy.io.

Liveness Detection Software: Stop Spoofing, Deepfakes & Biometric Fraud

Matus Kapusta — Fri, 17 Jul 2026 08:09:58 +0000

Biometric verification is only as strong as its ability to know a real human is in front of the camera. Liveness detection software is the anti-fraud layer that makes that determination — rejecting printed photos, screen replays, 3D masks, synthetic identities and injected deepfakes before they ever reach the matching engine. If you are new to the concept, start with our foundational explainer on what a liveness check is and why it matters in facial biometrics; this page focuses on how the software works, how it is certified, and how to evaluate it.

Detect Deepfakes before they become a Threat

Why Liveness Is the Core of Biometric Fraud Prevention

Face matching answers ‘is this the same person?’. Liveness answers a prior and more important question: ‘is this a person at all?’ Fraud rings no longer need to defeat the match — they need to defeat presence. Generative AI has industrialized that attack: deepfake tools can animate a stolen selfie in minutes, and virtual camera software can inject that video directly into an onboarding flow. Without certified liveness, a biometric system is a lock that accepts photographs of keys.
The financial impact is measurable across account opening fraud, account takeover, synthetic identity fraud and money-mule onboarding — the four attack patterns that liveness directly interrupts.

The Attacks Liveness Detection Software Stops

Print attacks: photographs of the victim presented to the camera — the entry-level spoof.
Replay attacks: videos or photos displayed on a phone, tablet or monitor.
3D mask attacks: silicone or resin masks reproducing the victim’s facial geometry (the Level 2 test threshold).
Deepfake presentation: AI-generated video of the victim shown on screen. See how it works in deepfake biometric verification.
Injection attacks: synthetic media injected via virtual cameras or intercepted APIs, bypassing the physical camera entirely — the fastest-growing vector and the reason camera-integrity signals now matter as much as image analysis.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Active vs Passive Liveness Detection

Active liveness

The user performs challenges: blinking, turning the head, following a dot. Effective against basic spoofs but adds friction, increases abandonment in onboarding funnels, and — counterintuitively — gives attackers a predictable script that deepfake puppeteering can follow.

Passive liveness

A single frame or a short passive capture is analyzed for texture, depth cues, micro-reflections, moiré patterns and signs of synthesis. The user does nothing. Passive liveness is now the industry direction because it combines lower abandonment with equal or better presentation attack detection, and it extends naturally beyond face to contactless fingerprint and palm capture.

Certification: ISO/IEC 30107-3 and PAD Levels

Vendor claims about anti-spoofing are only meaningful when tested by an accredited third party against ISO/IEC 30107-3, the international standard for presentation attack detection (PAD). Independent labs such as iBeta test at two levels:

PAD Level 1: printed photos, screen replays and basic 2D artifacts.
PAD Level 2: 3D masks and sophisticated artifacts with a larger attack budget — the enterprise benchmark.

Identy’s technology has passed ISO 30107-3 PAD Level 2 evaluation with a 0% penetration rate; the details are on our PAD Level 2 certification page.

How to Evaluate Liveness Detection Software

Certification: ISO/IEC 30107-3 Level 2 by an accredited lab, not internal testing.
Attack coverage: presentation AND injection attacks, including deepfake detection — compare options in our review of the best deepfake detection software.
User experience: passive capture, sub-second decisions, low false rejection on real users across demographics and devices.
Modality breadth: face, contactless fingerprint and palm liveness from a standard smartphone camera.
Deployment model: on-device SDK vs server API, offline capability, and data-privacy architecture (templates never leaving the device where required).
Integration effort: native mobile and web SDKs with clear documentation — explore the biometric SDK suite.

Experience Identy.io in action

Get a tailored demo of our contactless biometric platform and see how it fits your specific use case.

Frequently Asked Questions

What is liveness detection software?

It is software that confirms the biometric sample presented to a camera comes from a live, physically present person — not a photo, replay, mask or deepfake. It is the anti-fraud layer of any biometric verification or authentication flow.

What is the difference between active and passive liveness detection?

Active liveness asks the user to perform actions; passive liveness analyzes the capture with no user action. Passive delivers lower abandonment with equal or better attack detection.

What is ISO/IEC 30107-3 PAD certification?

The international standard for testing presentation attack detection. Accredited labs test at Level 1 (photos, replays) and Level 2 (3D masks and sophisticated artifacts). Level 2 is the enterprise benchmark.

Can liveness detection stop deepfakes?

Yes. Modern engines combine texture, depth and motion analysis with injection-attack detection to catch synthetic media, whether presented on a screen or injected into the camera feed.

Bibliography

ISO/IEC 30107-3 — Biometric presentation attack detection, Part 3: Testing and reporting. https://www.iso.org/standard/79520.html
iBeta Quality Assurance — Biometrics PAD testing (Levels 1 & 2). https://www.ibeta.com/biometrics-testing/
NIST — Face Analysis Technology Evaluation (FATE) / PAD track. https://www.nist.gov/programs-projects/face-technology-evaluations-frtefate
Europol (2024) — Facing reality? Law enforcement and the challenge of deepfakes / AI and policing reports. https://www.europol.europa.eu/publications-events/publications
FATF (2020) — Guidance on Digital Identity. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-on-digital-identity.html

La entrada Liveness Detection Software: Stop Spoofing, Deepfakes & Biometric Fraud se publicó primero en identy.io.

Security and greater convenience as a key to integrating biometrics into the user experience at the Football World Cup

Rodrigo Ramos — Wed, 15 Jul 2026 13:35:09 +0000

The Football World Cup is, without a doubt, one of the major sporting and social events of the decade. Until July 19th, 48 national teams will be competing for victory in a tournament which, for the first time in history, is held across three different host countries (Mexico, Canada and the United States). This edition was also one of the most popular in terms of visitor numbers, as more than 5.5 million spectators turned out to watch their favorite teams in action over the course of just three weeks.

Brazil is one of the countries—along with the three host nations—with the most fans in the stands: more than 500,000 Brazilians traveled to the United States, where their group stage matches were played. In the case of Colombia, the 120,000 fans traveled to two countries, as its matches were played in Mexico City and Guadalajara, Mexico, as well as in Miami, United States. This posed a significant logistical challenge for the visitors, who had to travel between venues by plane or by road and faced various border controls during their stay.

From a technological standpoint, this event also brought about significant innovations in the way visitors interact with authorities, in stadium access, and in the check-in process at their accommodations, to name just a few examples. In fact, digital transactions increased considerably during the tournament, which in turn led to a notable rise in fraud attempts. Therefore, it was necessary to verify fans’ identities to prevent fraud or identity theft in a manner that was fast, secure, and convenient enough not to cause any friction that might mar their experience. Biometrics thus became increasingly important as a means of streamlining many of the procedures visitors went through upon arrival in the cities where their national teams’ matches were played.

Biometrics as a tool to improve efficiency across all procedures during the World Cup

In a tournament that attracts millions of fans, being able to verify the identity of a user booking a room, buying a ticket for a particular match or simply attempting to pass through a border control is essential. In this regard, biometrics has established itself worldwide as a tool that significantly boosts the overall efficiency of all the processes in which it is used, whilst reducing friction and improving the overall user experience.

However, for this technology to be truly useful, it is important to carry out a few preliminary steps. The first of these is the onboarding process, through which the user captures their digital credentials – that is, their fingerprints or facial features – so that they can identify themselves correctly or validate their identity when necessary. In the case of the solutions developed by Identy.io, this process takes just a few seconds using the user’s own smartphone, by following the on-screen instructions. It is a simple and quick process in which the user does not need to perform any predefined actions, such as moving their head in a certain direction or blinking a certain number of times; instead, the system itself, thanks to the passive liveness check and its AI algorithms, is able to detect when the person in front of the camera might be a deepfake or a third party using a mask or a high-definition photograph to try to circumvent the system. This information is then cross-checked against centralised databases to verify the user’s identity (1:N identification) and ensure that the person is who they claim to be (1:1). Once it has been verified that the user is indeed who they claim to be, the user’s personal information is stored directly on their device under the strictest encryption protocols available on the market.

Once these digital credentials have been stored on the visitor’s mobile phone, they can be used for all kinds of digital procedures, even at times when, due to the large number of fans, there may be faults or outages in the connectivity service or the Wi-Fi systems in place. One of the areas where biometrics can prove most effective is in pre-border clearance, which will reduce waiting times for completing formalities and ease congestion at entry points in the countries visited. Government bodies will also benefit directly from the use of this technology, as it will drastically reduce potential cases of theft or identity theft, since it enables them to verify, almost in real time and with great accuracy, the identity of individuals attempting to cross a border or pass through an airport security checkpoint, by validating the user’s digital credentials against their centralised database and thus determining whether the tourist is indeed the person they claim to be.

To make it easier to use these digital credentials, visitors can choose to generate, using Identy.io’s solutions, a biometric QR code that embeds all their personal information once it has been validated. This QR code is particularly useful at digital check-in kiosks in hotels, for example, as a way of speeding up the check-in process. Thanks to these codes, visitors can choose which personal information to share, without needing an internet connection at that moment.

Biometrics to combat ticket reselling and as a way of speeding up entry to stadiums

Access to the stadiums where the matches were played also underwent a significant change thanks to biometrics. Until now, it was necessary to purchase physical tickets for each match, which increased the risk of counterfeiting or resale attempts. However, this World Cup pioneered the use of biometrics to streamline security checks at entry points and make them more efficient. When purchasing a ticket, users link their identity to it using their previously registered digital credentials. This way, in addition to being able to present their digital ticket at the stadiums directly from their cell phones, the risk of resale is eliminated, since only properly accredited individuals will be able to enter the stadiums.

In an increasingly digitized environment, and with one of the most heavily attended sporting events in history, ensuring spectator safety, enhancing their overall experience, and, in turn, reducing the incidence of fraud and identity theft are key to ensuring the smooth running of this and future World Cups. And biometrics is already a strategic ally in this regard.

La entrada Security and greater convenience as a key to integrating biometrics into the user experience at the Football World Cup se publicó primero en identy.io.