By Jesus Aragon, CEO and Co-Founder, Identy.io
Digital services have changed how people interact with governments, financial institutions and businesses, but the way we prove who we are online hasn’t always kept pace. In many cases, identity verification still means taking a photo of a physical ID, uploading it to a digital service and pairing it with a facial image.
Each time someone sends a copy of an ID, they may expose their name, address, date of birth and identification number, even when only a small portion of that information needs to be verified. Once that copy has been shared, individuals also have limited visibility into where it is stored or how it may be used.
This model is becoming more difficult to secure as the fraud landscape changes. Advances in AI are making it easier to create convincing synthetic documents, images and video, while new attack methods can be injected into the identity verification process itself. These risks are becoming more pronounced as deepfake fraud attempts have increased over 2,000% in the last three years. Organizations need to think beyond digitizing existing forms of identification and consider how identity can be established securely from the beginning.
Remote Identity Fraud Is Changing
Traditional biometric security has largely focused on presentation attacks, where someone attempts to fool a system using a physical artifact such as a mask, printed photograph or replayed video. However, deepfake fraud can reach identity systems in different ways.
In a presentation attack, manipulated content can be shown to the camera, such as a deepfake displayed on another screen. In an injection attack, manipulated or pre-recorded content is introduced directly into the identity verification process, bypassing the normal camera capture. A system focused only on determining whether a physical presentation is genuine may miss attacks targeting other parts of the verification process.
As AI makes it easier to imitate someone’s appearance, organizations need additional layers of protection around the capture process. Multimodal biometrics, passive liveness detection, presentation and injection attack detection, capture checks and biometric verification all help with determining whether the person enrolling remotely is who they claim to be.
Independent testing is also critical for understanding how these systems perform against real attacks. In the 2025 DHS Remote Identity Validation Rally (DHS RIVR), Identy.io achieved 0% attack acceptance across the evaluated presentation attack classes while also receiving the highest user satisfaction score.
Why Multimodal Biometrics Matter
Face recognition remains an important tool for remote identity verification because it is intuitive and supported by most modern smartphones. Facial images are widely available online, creating an increasingly accessible starting point for attackers using generative AI.
Multimodal biometrics can strengthen remote enrollment by requiring more than one biometric characteristic. Rather than relying on an ID document and facial image, a smartphone can be used to capture both face and fingerprints using touchless technology, binding them to the same identity without requiring physical contact or specialized scanning equipment. This approach places the individual at the center of the verification, using their unique biometric characteristics rather than relying on physical documents.
Fingerprints provide an important additional factor because high-quality fingerprint images aren’t as readily available as facial photographs. Combining the two makes an attack more difficult because compromising one biometric doesn’t automatically compromise the entire enrollment process.
At Identy.io, we are applying this multimodal approach to remote enrollment by bringing face and touchless fingerprint capture together on the smartphone. This is supported by deepfake and injection detection, as well as on-device matching, to protect the identity process from the start.
By bringing these capabilities together on a device that people use every day, the goal is to make stronger identity verification available remotely without introducing specialized biometric hardware into the enrollment process. This makes secure biometric enrollment more accessible to individuals across a range of devices and environments, allowing them to establish and bind their digital identity using a smartphone.
From Enrollment to a Reusable Digital Identity
Once an individual has established their identity with a trusted authority, they shouldn’t need to start the process over every time they access another digital service. Remote biometric enrollment can provide the foundation for issuing a reusable digital credential that is bound to the individual’s biometrics. The biometric can then be used as an authentication factor when the credential is presented again, while cryptographic signatures protect the credential’s integrity and authenticity.
This creates a different approach to digital identity. By establishing a trusted identity once, individuals can use their verified digital credentials across multiple services and interactions without repeatedly submitting copies of physical documents. For organizations, it creates an opportunity to support digital services without depending on the same document-based verification process every time.
Remote identity systems need to keep pace with increasingly sophisticated fraud techniques. The next phase of remote enrollment will be about bringing together secure mobile capture, multimodal biometrics and protections against established and emerging attacks.
Stronger security shouldn’t come at the expense of usability or individual control. Capture once. Verify with confidence. Reuse with control.
