Biometric verification has become an important part of digital fraud prevention, helping organisations confirm identities during customer onboarding, account access and sensitive transactions. However, as biometric technology becomes more sophisticated, so do the methods used to attack it…
Fraudsters may attempt to impersonate legitimate customers using photographs, recorded videos, synthetic facial images or other manipulated material. Some attacks go further, attempting to bypass a device’s camera and insert fraudulent media directly into the verification process.
For organisations investing in biometric security, this creates a fundamental challenge.
A system might accurately recognise a face without establishing that the image came from a genuine person participating in a legitimate verification attempt.
The US National Institute of Standards and Technology (NIST) addressed these risks explicitly in its updated Digital Identity Guidelines, published in 2025, highlighting the growing importance of detecting forged media and protecting remote identity verification against digital injection attacks.
For fraud prevention teams, the question is no longer whether biometric technology can recognise somebody. It’s whether the organisation can trust the entire process used to establish who that person is.
At a Glance: Strengthening Biometric Fraud Prevention
| Area to assess | Why it matters | What to check |
|---|---|---|
| Presentation attacks | Fraudsters may imitate biometric characteristics | Liveness detection, testing and attack resistance |
| Deepfakes | Synthetic media can impersonate genuine customers | Forgery detection and verification safeguards |
| Injection attacks | Manipulated media may bypass the capture device | Capture integrity, device checks and secure transmission |
| Identity enrolment | A false identity can undermine later authentication | Document checks, identity evidence and risk assessment |
| Layered security | No single biometric check addresses every threat | Device intelligence, behavioural signals and step-up verification |
| Customer experience | Strong controls must still work for legitimate users | False rejection rates, accessibility and recovery options |
Understand the Different Types of Biometric Attack
Biometric fraud prevention begins with understanding how systems can be targeted.
A presentation attack involves attempting to deceive a biometric sensor using an artificial representation of the characteristic being checked.
For facial recognition, this could involve a photograph, recorded video or physical imitation.
Other threats target the information being processed rather than the physical sensor.
An attacker may attempt to manipulate biometric data, interfere with the capture process or compromise the identity reference against which subsequent checks are made.
The National Cyber Security Centre (NCSC) distinguishes presentation attacks from broader attacks on biometric systems.
This matters because a security control designed to detect one attack may not address another.
Fraud prevention teams should map potential attack methods against each stage of their verification process.
Make Liveness Detection More Than a Tick-Box Feature
Liveness detection is widely used in remote facial verification. More formally described in many technical standards as presentation attack detection (PAD), it aims to distinguish genuine biometric presentations from attempts involving artificial material.
Some solutions use passive analysis, while others ask users to complete particular actions.
However, the presence of a liveness feature does not guarantee that every impersonation attempt will be detected.
NIST recommends appropriate presentation attack detection within biometric authentication and identity-proofing processes, particularly for facial recognition.
Fraud teams should ask how the technology has been independently tested, which attack types were included and how performance compares under realistic operating conditions.
A supplier’s claim that a system is liveness-enabled provides less useful information than evidence showing what it can reliably detect.
Understand the Deepfake Challenge
Generative AI can create increasingly convincing representations of people’s faces and voices.
These may be used in impersonation attempts involving onboarding, identity verification or access to existing accounts.
The challenge is not simply that synthetic images can appear realistic.
Digital manipulation may also be used to alter genuine identity evidence or create material that appears consistent across different verification steps.
NIST’s updated identity-proofing guidance recognises that AI-generated media can be combined with other attacks to deceive automated document validation and biometric processes.
Fraud teams should therefore examine how proposed verification systems assess the authenticity of submitted media.
However, they should be cautious about solutions claiming universal deepfake detection.
Detection capabilities need to be evaluated against relevant threats, and performance must be reviewed as attack techniques evolve.
Protect Against Digital Injection Attacks
An injection attack attempts to introduce manipulated information into the verification process without presenting it through the expected capture mechanism.
For example, fraudulent video may be inserted into the flow between a user’s device and the system processing the biometric comparison.
This can create difficulties for controls designed primarily to detect artificial material shown to a genuine camera.
NIST recommends technical safeguards that increase confidence that submitted media originates from an authentic capture process.
These may include detecting signs of virtual cameras, device emulators, tampering or other suspicious conditions.
Fraud prevention teams should establish which protections their providers offer and how those protections are maintained.
The important distinction is that verifying the apparent authenticity of an image is not the same as verifying the integrity of the process that supplied it.
Check the Trustworthiness of Identity Enrolment
Biometric authentication depends on a trustworthy reference.
If an attacker succeeds in registering their own biometric information against a fraudulent or compromised identity, subsequent authentication may work exactly as designed.
The system could consistently recognise the enrolled person while reinforcing the original identity error.
Organisations should therefore examine how identity evidence is established and verified during enrolment.
Depending on the risk, this may involve document validation, identity record checks and other appropriate controls.
NIST distinguishes between identity proofing and subsequent authentication, recognising that they address different questions.
Fraud prevention teams should ensure that the original identity verification process is sufficiently robust for the transactions or services it enables.
Strong authentication cannot compensate for weak initial identity proofing.
Use Layered Fraud Signals
Biometrics should rarely be the only source of information supporting a high-risk decision.
Other relevant signals may include device characteristics, account history, transaction behaviour and evidence of unusual activity.
A customer attempting a high-value transaction from an unfamiliar device, for example, may justify additional verification even where an initial biometric check succeeds.
However, additional signals should be selected according to the risks involved.
More information does not automatically produce a better decision, particularly where data is unreliable or difficult to interpret.
A layered approach allows organisations to evaluate the wider circumstances of an interaction rather than treating biometric matching as conclusive proof of legitimacy.
The objective should be proportionate assurance, with stronger checks where the potential consequences of fraud are greater.
Recognise the Role of Passkeys
Passkeys can strengthen account authentication by replacing traditional passwords with phishing-resistant cryptographic credentials.
Customers may unlock a passkey using facial recognition or a fingerprint on their own device.
However, the biometric information generally remains on that device, while the online service receives cryptographic proof of authentication.
The FIDO Alliance explains that this approach avoids sending biometric information to the relying service.
Passkeys therefore address a different security requirement from remote biometric identity verification.
A passkey can provide strong evidence that an authorised credential is being used, but its security also depends on trustworthy enrolment and account recovery.
Fraud prevention teams should consider how passkeys and remote identity verification can complement one another rather than treating them as interchangeable technologies.
Secure Account Recovery
Account recovery can become a weak point in an otherwise robust authentication system.
A customer who loses their device, changes their appearance or cannot complete a biometric check may require an alternative route to regain access.
Fraudsters may attempt to exploit those alternatives.
Organisations should establish how recovery requests are assessed, what additional evidence is required and when human intervention becomes appropriate.
Recovery controls should reflect the sensitivity of the account and the consequences of unauthorised access.
However, the process must remain usable for legitimate customers.
A secure authentication strategy should not depend on customers always being able to complete the same biometric check under every circumstance.
Balance False Acceptance and False Rejection
Biometric performance is commonly assessed through false match and false non-match rates.
A false match occurs when a system incorrectly matches different people.
A false non-match occurs when it fails to match biometric samples from the same person.
Both matter in fraud prevention.
A false acceptance may create a security risk, while an incorrect rejection can prevent a legitimate customer from accessing a service.
The Information Commissioner’s Office (ICO) advises organisations to consider real-world false acceptance and rejection risks and assess potential differences in performance between groups.
Fraud teams should therefore avoid evaluating solutions through a single accuracy percentage.
They need to understand how the system performs at the thresholds appropriate to their use case.
A verification process is not successful simply because it rejects more people. It must distinguish genuine fraud from legitimate activity.
Test Performance Across Different Customers
Biometric systems need to operate effectively across a diverse user population.
Real-world performance may be influenced by lighting, device quality, accessibility requirements and other conditions.
Differences in error rates between demographic groups can also create fairness concerns.
Buyers should establish how suppliers test performance and whether the evidence reflects their intended customer base.
Organisations should provide suitable alternative verification arrangements for people who cannot reliably use the primary biometric method.
Such arrangements must be accessible without becoming an easy route for fraudsters to bypass stronger controls.
The objective is to create a system that provides effective protection without unnecessarily excluding legitimate customers.
Use Human Review Where It Adds Value
Some verification attempts will require additional investigation.
These may involve ambiguous results, conflicting identity evidence or circumstances suggesting that automated checks are insufficient.
Human review can help resolve cases that do not fit straightforward automated decisions.
However, organisations should establish when cases are referred, what information reviewers receive and how decisions are documented.
Reviewers also need appropriate training in the limitations of biometric evidence.
A convincing-looking identity document or facial image should not automatically be accepted as genuine.
The most effective arrangement combines suitable automation with clear processes for handling uncertainty.
Protect Biometric Information
Biometric recognition involves sensitive personal information. Under UK data protection law, biometric data processed to uniquely identify someone is special category personal data and requires additional protections.
The ICO advises organisations to assess the necessity and proportionality of biometric recognition, establish a lawful basis and relevant special category condition, and carry out an appropriate data protection impact assessment.
Buyers should examine how biometric samples and templates are stored, secured, retained and deleted.
They should also understand whether information is processed by the organisation or an external provider.
The ICO’s biometric guidance is currently under review following changes introduced by the Data (Use and Access) Act, making ongoing legal oversight important.
Strong fraud protection must include strong safeguards for the information used to provide it.
Monitor Attack Patterns and Emerging Risks
Biometric fraud prevention should not be treated as a one-off installation.
Attack techniques evolve, and controls that perform effectively today may need updating as fraudsters adapt.
Organisations should monitor suspicious verification attempts, repeated failures and patterns indicating coordinated activity.
However, an increase in rejected attempts does not automatically demonstrate that fraud prevention is improving.
It may reflect changes in legitimate customer behaviour, capture conditions or system thresholds.
Fraud teams should examine outcomes and investigate meaningful trends.
They should also review supplier updates, independent testing and relevant threat intelligence.
The aim is to identify emerging weaknesses before they lead to significant losses.
Measure Genuine Fraud Prevention Performance
Operational reporting should connect verification results with the wider outcomes of fraud prevention.
Useful measures may include confirmed fraudulent attempts, false rejection rates, successful customer completion, manual review volumes and the time required to verify legitimate users.
Organisations should also examine whether customers experience problems during enrolment, authentication or recovery.
Where appropriate, performance can be reviewed across different devices, customer groups and risk categories.
The most useful reporting distinguishes between stopping genuine attacks and creating unnecessary friction.
A system that rejects a higher proportion of customers is not necessarily more secure if legitimate users account for much of the increase.
Fraud prevention should be measured by both the risks reduced and the trustworthy activity enabled.
Questions to Ask Biometric Fraud Prevention Providers
When reviewing biometric security capabilities, fraud teams should consider:
- Which presentation and impersonation attacks can the solution detect?
- What independent testing supports its liveness detection claims?
- How does the technology identify manipulated or synthetic media?
- What safeguards protect against digital injection attacks?
- How is the integrity of the capture device or process assessed?
- What controls protect the original identity enrolment?
- Can biometric results be combined with other fraud signals?
- How are high-risk transactions and unusual behaviour handled?
- What account recovery safeguards are available?
- How are false acceptance and false rejection rates measured?
- What testing has been conducted across different user groups?
- When is human review required?
- How is biometric information protected and retained?
- How are new threats and attack methods incorporated into updates?
- What evidence demonstrates a reduction in fraud without excessive customer friction?
Frequently Asked Questions
Can biometric verification detect deepfakes?
Some biometric verification systems include controls designed to identify synthetic or manipulated media. Effectiveness varies, and organisations should assess independent testing and the types of attacks covered.
What is a biometric presentation attack?
A presentation attack involves using artificial material, such as a photograph or recorded video, to attempt to deceive a biometric sensor.
What is the difference between spoofing and injection attacks?
Spoofing is a broad term for impersonation attempts, often including presentation attacks. Digital injection attacks introduce manipulated information into the verification process without relying solely on the expected physical sensor interaction.
Is liveness detection sufficient to prevent biometric fraud?
No. Liveness detection can help address certain presentation attacks, but effective protection may also require capture-integrity checks, secure enrolment and other fraud prevention controls.
How do passkeys support biometric security?
Passkeys provide phishing-resistant account authentication. A customer may use biometrics locally to unlock the credential, without sending biometric information to the online service.
How can businesses reduce false biometric rejections?
Organisations can improve capture instructions, evaluate accuracy across devices and user groups, review decision thresholds and provide appropriate alternative verification methods.
Product & Services Guide
The Fraud Prevention Summit brings together senior fraud, risk, identity and security decision-makers with relevant solution providers through pre-arranged one-to-one meetings, offering an opportunity to explore biometric verification, deepfake detection, digital identity and wider fraud prevention technologies.
Trust the Process, Not Just the Face
Biometric verification can play an important role in protecting digital identities and preventing fraud.
But increasingly sophisticated impersonation techniques mean organisations must look beyond whether a facial image or fingerprint produces a successful match.
The integrity of enrolment, capture, comparison and subsequent authentication all matter.
A practical improvement framework is: verify → protect → assess → respond → adapt
Verify that identity evidence and enrolment processes are trustworthy.
Protect biometric capture and authentication against relevant attacks.
Assess verification outcomes alongside wider fraud signals.
Respond appropriately to suspicious or uncertain cases.
Then adapt controls as threats evolve.
The strongest biometric fraud prevention system isn’t necessarily the one that recognises people most accurately.
It’s the one that can distinguish a genuine customer from a convincing impersonation — without making legitimate customers prove themselves unnecessarily.
The Fraud Prevention Summit brings together senior fraud, risk, identity and security decision-makers with relevant solution providers through pre-arranged one-to-one meetings, offering an opportunity to explore biometric verification, deepfake detection, digital identity and wider fraud prevention technologies.
Related Reading
This is the second article in our November Biometrics series.
Our first article, Biometric Authentication: What Fraud Prevention Teams Should Compare Before Buying, explored biometric methods, accuracy, liveness detection, identity proofing, privacy, integration and customer experience.
This follow-up examines how organisations can strengthen those technologies against deepfakes, presentation attacks, digital injection and other impersonation threats, while maintaining effective verification for legitimate customers.
Sources
- NIST – Digital Identity Guidelines: Identity Proofing and Enrollment
- NIST – Digital Identity Guidelines: Authentication and Authenticator Management
- NCSC – How Biometrics Are Attacked
- ICO – Biometric Recognition Guidance
- ICO – Biometric Data: Fairness and Accuracy
- FIDO Alliance – Passkeys
- FIDO Alliance – Authentication Specifications
Image credit: https://unsplash.com/photos/a-wooden-block-that-says-biometric-on-it-FxbWpTzHJiE
