What liveness actually proves
Face matching tells you the face at the camera is the same as the face on the document. What it does not tell you is whether that face is really there — or whether it is a screen, a sheet of paper, or a mask.
Liveness detection closes exactly that gap. Biometric verification without a proof of physical presence can be defeated with a leaked selfie archive.
Four attack types
The attempts a liveness layer has to separate leave different traces:
- Printed photo. The texture, edges and reflection of a face on paper differ from live skin.
- Screen replay. Video played from a phone or monitor carries a pixel grid, glare and a frame rate.
- 3D mask. Silicone and resin masks break down in surface behaviour and depth consistency.
- Deepfake and synthetic faces. Generative models leave their own synthesis traces.
When each type is judged by its own model, the result is more than pass/fail: it says why a record was flagged. That is what lets a compliance team justify its decision.
Passive liveness
The passive layer decides from a single frame. It asks the user for no movement at all.
Its operational advantage lands straight on conversion: no instructions, no retries, no accessibility failures. A flow that demands a head turn adds seconds, introduces errors, and struggles for older users or anyone with limited mobility.
Active liveness
The active layer demands a response produced on the spot, and the challenge is randomised for every session. A pre-recorded video, a printed photo or a prepared deepfake cannot answer it.
The cost is a few seconds and some completion rate. What you get back is a higher standard of proof — a sensible trade wherever disputes and fraud losses run high.
The right answer is both
In practice the question is not "passive or active" but which one in which flow. Leave the default flow passive and switch on the active layer for high-risk transactions. Once the thresholds are written against your risk policy, the system applies that decision consistently on your behalf.
The result arrives by webhook with its score and its classification reason, so manual review stays reserved for the edge cases.
