What are liveness checks and why do they matter?

profile picture Amba Karsondas 8 min read
4 different people doing liveness checks

A lot of life happens online now. You can open a bank account from your sofa. Start a new job without meeting anyone in person. Prove your age with a selfie. Interact on gaming platforms. Use a dating site. Rent a flat. Meet people you’ve never seen in real life.

But all of these things only work if one thing is true: there’s a real person on the other side of the screen.

When that assumption holds, things feel easy. When it doesn’t, people lose money, accounts get taken over, services grind to a halt and trust disappears fast.

That’s why liveness checks matter, even if you’ve never heard of them. They’re a quick, automated check that takes place while your age or identity is being verified. They give you the same peace of mind as seeing someone face to face and knowing they’re real.

 

What liveness checks actually do (and why they’re necessary)

Liveness checks, also known as liveness detection, are how an app or website checks that you’re a real, physically present human being, right now – and not a spoof or a fake.

There are two main ways people try to trick liveness checks.

  1. Presentation attacks – that’s when someone puts something fake in front of the camera, like a photo of another person, a video replayed on another device (such as a phone or laptop), a mask, or even a very convincing AI-generated face.
  2. Injection attacks – instead of using the camera, the attacker bypasses it altogether and feeds fake images or video straight into the system.

Good liveness checks are designed to spot and block both. When you’re asked to take a quick selfie or look at the camera, liveness detection looks for signs that the image or video is being captured live and in that moment.

That check sounds small, but it does something important. It stops people using stolen or fake faces to get through systems that were designed for humans. Without liveness detection, biometric checks can be tricked. But with it, they become something you can actually rely on.

 

How liveness checks work

We’ve designed our liveness checks to balance strong protection with low effort for users, because security only works if people can actually get through it.

We use something called passive liveness detection. This works by analysing natural signals in the image or video, like depth or texture, to confirm that the capture is happening live. From the user’s point of view, it just feels like taking a normal selfie. 

Passive liveness checks work differently from active liveness checks. Active liveness checks ask users to perform a movement such as nodding, smiling, blinking or repeating a short phrase.

Passive liveness detection is ideal when you want strong protection with the least possible friction, especially for repeat users or everyday interactions. Because there are no instructions to follow, fewer checks fail (whether that’s due to user error, accessibility issues or the camera missing a movement). It also blocks bad actors from spoofing the checks by using a photo, video or deepfake to replicate those actions.

 

Why liveness checks have become a big deal

A few years ago, uploading a photo or simply showing an ID often felt good enough. Today, deepfakes, synthetic faces and automated bots have changed the rules. Tools that once took specialist skills are now widely available, with anyone able to generate realistic faces or manipulate video in minutes.

At the same time, more services have moved online. There are fewer in-person checks and fewer human gatekeepers. That combination creates an opening – and it’s openings that fraudsters are good at exploiting.

The scale of the problem makes that gap hard to ignore. Global fraud losses reached an estimated $442 billion in 2024 (around £330 billion), rising by around 20% year on year, even as AI-driven systems prevented more than $25.5 billion (around £19 billion) in attempted fraud.

Liveness detection helps close that gap by proving that a check is happening here and now, with a real person in control. For businesses, that means fewer successful attacks. For users, it means fewer moments where something goes wrong and better protection for their services, money and accounts.

 

When liveness checks work, everyday life work better

You don’t feel liveness checks when they’re done well, but you feel the absence of them everywhere. They lead to:

Safer interactions with real people

On platforms where people interact with each other, such as banking, dating, marketplaces and social apps, fake accounts cause real harm. They scam, impersonate, waste time and make people suspicious of everyone.

Liveness checks help platforms filter out bots and fake profiles early, before they can do damage. That makes spaces feel safer and more human, because bad actors are quietly kept out.

Fewer account takeovers and impersonation attacks

When someone pretends to be you, the fallout is personal. Money disappears and accounts get locked. You then often have to spend hours proving that you’re actually yourself. Trust in the service takes a hit, even if it wasn’t your fault.

Liveness checks add a critical layer of protection by making it much harder to use stolen images, videos or AI-generated faces to take over an account. That reduces fraud and support costs for businesses and lowers the chances of users needing to ask, “how did this even happen?”.

Privacy-preserving and reliable age checks for genuine customers

Age-restricted platforms and services face a difficult balance of keeping underage users out without forcing everyone else to hand over excessive personal data. 

Facial age estimation is one way to do that. But we need liveness checks in order to help make that process possible. By confirming there’s a real person in front of the camera (and not a photo or edited image), age checks become more accurate and reliable.

It means fewer kids slipping through by using an image of someone else who is older than them. It also means fewer adults being wrongly blocked or asked to overshare their personal information just to prove how old they are.

Security that doesn’t get in the way

Bad security shows itself in unnecessary friction. This can be through endless document uploads and manual reviews, locked accounts and repeating the same checks again and again.

Good liveness detection works seamlessly, confirming human presence quickly and confidently, and then stepping aside. That means getting on with life instead of fighting security systems, whilst businesses see fewer false positives and smoother onboarding.

 

Why the quality of liveness checks matters

Not all liveness checks offer the same protection. Some only stop the most basic attacks, like 2D-printed images of someone’s face. Others are more robust and are tested against high-quality masks and 3D-printed faces. Independent standards, such as NIST’s benchmarking, help make sure that these liveness checks are effective at detecting real, genuine faces. Our latest model has been re-certified with a perfect score for NIST Level 1 and Level 2 liveness detection, showing that our system has been tested against the kinds of presentation attacks outlined above.

This liveness detection works alongside our Secure Image CAPture (SICAP) technology, which looks out for injection attacks and makes sure that images are captured live from the device camera.

Stronger liveness checks mean fewer genuine users are wrongly rejected and fewer successful fraud attempts, helping to build more trust in the systems we all rely on. As more checks move online, we’ve lost the reassurance that comes from face-to-face interaction. Liveness checks help replace that digitally. But this shouldn’t come at the cost of privacy. 

Good liveness checks don’t need to track people across services or store biometric data indefinitely. They can confirm that a real person was present at a specific moment without storing any information about that person. That balance matters, because people shouldn’t have to trade dignity or privacy for access to essential services. Equally, businesses shouldn’t have to choose between security and respect for users.

 

The bottom line

When liveness checks are done well:

  • real people get through quickly
  • fake users are stopped early
  • online services stay usable and trustworthy

As more of life moves online, the question “is this a real person?” sits behind almost everything we do. High-quality and reliable liveness checks are how we answer it.

Find out more about liveness checks here.

– Amba, PR & Communications Exec

Keep reading

An image of a woman holding a driving licence in one hand and her mobile phone in another.

How we build our AI models

At Yoti, AI is not a general-purpose experiment. Instead, it is a set of purpose-built tools embedded directly into our identity, authentication and age verification products, designed to deliver secure decisions quickly while not collecting or processing unnecessary data. Rather than using large, general-purpose AI systems, we build and deploy small, specialised models that each solve a clearly defined problem. This approach gives our customers stronger security, better privacy outcomes, faster performance and greater confidence in how decisions are made.   How do our AI-based checks work? At Yoti, our approach is to use multiple models to perform very

5 min read
An image of a teenager holding and using his mobile phone.

Yoti helps platforms navigate Australia’s new social media age restrictions

Australia’s new age restriction laws for social media come into effect today, signalling a major shift in how online services must support age-appropriate access for younger users. As platforms prepare for increased regulatory scrutiny and tight compliance timelines, Yoti is enabling our social media partners to deploy trusted, privacy-preserving age assurance at scale. These reforms, led by the eSafety Commissioner, require major social media platforms to take ‘reasonable steps’ to stop under 16s from creating an account or using their services. There are no exceptions to this age limit, not even those with parental consent. The rules apply to

3 min read
Zero trust authentication methods

How strong authentication powers Zero Trust and protects against cyber threats

Until recently, organisational cybersecurity typically relied on a fortress mentality, by building a strong perimeter with firewalls and VPNs, and trusting everything inside. But in today’s digital world of cloud apps, remote work and hiring, supply chain integrations, virtual connections and sophisticated attacks, that approach is no longer enough. Once criminals breach the walls, they can often move freely and undetected. If a business can’t reliably confirm who’s accessing its systems, it leaves the door open for cyber criminals. When authentication is weak, malicious actors can: Steal employee or customer login credentials through phishing and use them to access

6 min read