What Is Biometric Verification#
Biometric verification is the process of confirming a person's identity by comparing their live biometric sample against a reference, typically a photograph on an identity document. In the context of remote identity proofing, this means comparing a live selfie against the portrait printed on a passport, national ID, or driver's license. The goal is to answer a simple question: is the person holding the document the same person depicted on it?
While the concept is straightforward, the technical implementation is sophisticated. Modern biometric verification systems must handle variations in lighting, camera quality, facial aging, cosmetic changes, and the full diversity of human faces across age, ethnicity, and gender, all while defending against an increasingly creative set of presentation attacks.
Liveness Detection#
Liveness detection determines whether the biometric sample comes from a live, physically present person rather than a photograph, video replay, mask, or digitally generated image. Without liveness detection, face matching alone is trivially defeated: an attacker simply holds a printed photo of the document holder in front of the camera.
Passive Liveness
Passive liveness analyzes a single image or short video stream for artifacts that distinguish real faces from attacks. Techniques include analyzing texture patterns (skin pores vs. print halftone dots), depth cues from defocus blur, specular reflection patterns, and micro-movements such as subtle eye tremors or pulse-induced skin color changes. Passive liveness is invisible to the user, creating a frictionless experience.
Active Challenges
Active liveness asks the user to perform a specific action such as blinking, turning their head, or following a moving dot on screen. These challenges are harder to replicate with static attacks but add friction to the user experience. More advanced active challenges include illumination-based techniques where the device screen flashes colored light patterns onto the user's face, and the reflected light is analyzed for consistency with a three-dimensional face.
ISO 30107-3 defines the standard framework for evaluating Presentation Attack Detection (PAD) systems. When selecting a biometric vendor, always request their ISO 30107-3 test results, paying attention to both the Impostor Attack Presentation Match Rate (IAPMAR) and the Bona Fide Presentation Classification Error Rate (BPCER).
Face Matching Technology#
Face matching compares two facial images and produces a similarity score. Modern systems use deep convolutional neural networks trained on millions of face pairs to generate compact face embeddings, which are numerical vectors that encode the geometric and textural features of a face. The similarity between two embeddings is computed using cosine distance or similar metrics.
The accuracy of face matching has improved dramatically over the past decade. Top-performing algorithms evaluated by NIST's Face Recognition Vendor Test (FRVT) achieve false non-match rates below 0.1% at a false match rate of one in a million. However, accuracy varies with image quality, pose angle, and demographic factors. Ensuring equitable performance across all demographic groups is both an ethical imperative and a regulatory requirement under algorithmic fairness frameworks emerging in the EU and elsewhere.
Flashmark Illumination#
Flashmark is an illumination-based liveness technique where the device screen displays a unique sequence of colored light patterns while the selfie camera captures the user's face. The reflected light creates a cryptographically verifiable color signature on the user's skin that is unique to that session. This approach defends against replay attacks because the light pattern changes with every session, making pre-recorded videos useless.
The Flashmark signal also provides depth information: a flat surface such as a printed photo reflects light uniformly, while a three-dimensional face creates characteristic shadow gradients and specular highlights that vary across the facial geometry. Combined with frame-level hash chains that link each captured frame to its predecessor, Flashmark creates a tamper-evident biometric capture pipeline.
Deepfake Defense#
The rapid improvement of generative AI has made synthetic face generation and face-swapping accessible and increasingly realistic. Deepfakes pose a serious threat to biometric verification: an attacker can generate a synthetic video of the document holder and present it through a virtual camera to bypass face matching and even basic liveness checks.
- Virtual camera detection: Identify when the video feed comes from software (OBS, ManyCam) rather than a physical camera by inspecting device APIs, driver signatures, and capture metadata.
- Injection attack detection: Monitor the camera pipeline for frame injection at the OS or driver level, where an attacker intercepts the camera feed and replaces it with synthetic content.
- Temporal consistency analysis: Analyze micro-temporal patterns such as blink frequency, head micro-movements, and blood flow signals that are difficult for current generative models to reproduce accurately.
- Artifact detection: Look for generative model artifacts including temporal flickering at face boundaries, inconsistent ear geometry, and unnatural eye reflections.
- Screen recapture detection: Identify moire patterns, pixel grid artifacts, and color temperature shifts that indicate the camera is pointed at another screen.
Deepfake technology evolves rapidly. Any single defense can be defeated in isolation. Effective biometric security requires a layered approach combining multiple independent detection methods, and continuous retraining of detection models against emerging attack techniques.
Privacy Considerations#
Biometric data is among the most sensitive categories of personal information. Unlike passwords, biometric identifiers cannot be changed if compromised. Regulations worldwide impose strict requirements on the collection, processing, and storage of biometric data.
Under GDPR, biometric data processed for the purpose of uniquely identifying a person is classified as special category data, requiring either explicit consent or a substantial public interest basis. The Illinois Biometric Information Privacy Act (BIPA) in the United States requires informed written consent before collection, prohibits the sale of biometric data, and mandates retention schedules with specified destruction timelines. BIPA violations carry statutory damages of $1,000 to $5,000 per violation, and class action litigation has resulted in settlements exceeding $600 million.
Best Practices for Biometric Implementation#
- Process biometric comparisons server-side where possible, reducing the attack surface on client devices.
- Store face embeddings rather than raw images when feasible, and encrypt embeddings at rest using hardware-backed key management.
- Implement configurable retention policies that automatically purge biometric data after the legally required period.
- Provide clear, plain-language consent flows that explain what biometric data is collected, how it is used, and how long it is retained.
- Regularly audit demographic performance of face matching algorithms and retrain models to address any disparities.
- Maintain a PAD evaluation program that tests your liveness system against new attack vectors at least quarterly.