.jpeg)
When a user proves their identity remotely, it all seems to happen in a second: they present their face, the system displays "identity verified," and the account is opened. This apparent simplicity can hide a multi-step technical process. And at each of these steps, a fraudster can strike—but not in the same way, nor with the same weapons. Understanding this journey means understanding why a single line of defense is no longer enough. ShareID's liveness detection has just been certified compliant at the highest level across the three industry reference standards, for both presentation attacks (PAD) and injection attacks (IAD).
Let's follow the signal, from the sensor to the decision.
Step 1 — Capture: what is presented to the camera
It all starts with the lens. The camera films a face, and the system must answer a first question: is this face that of a living person, actually present?
This is where PAD, or Presentation Attack Detection, comes in. Liveness detection, or liveness, aims to determine whether the biometric presentation corresponds to a legitimate interaction with a real person, rather than an artifact used to deceive the sensor. A high-definition printed photo, a video replayed on a phone screen, a silicone mask molded to the victim's features. PAD analyzes skin texture, facial contours, light reflections, and anomalies such as printing artifacts, moiré patterns on a screen, or unnatural skin in the case of masks.
To use a simple analogy: PAD is the security checkpoint at the entrance. It verifies what is actually presented to the sensor and seeks to determine if this presentation is an attempt at deception. This layer is now well-mastered. The international standard ISO/IEC 30107 governs its evaluation, and independent laboratories certify it. For years, checking this box was enough to feel protected. The problem is that modern fraudsters no longer need to stand in front of the camera to deceive it.
Step 2 — Transmission: what flows through the stream
Once captured, the signal does not stop at the camera. It travels from the sensor to the application, then to the server that makes the decision. Throughout this path, the stream can be intercepted or replaced, regardless of what the lens sees. This is the territory of the second family of attacks: injection attacks. Here, the fraudster bypasses the camera entirely. They have nothing to present physically. Instead, they inject biometric data directly into the system that was not produced by the legitimate capture process—for example, a manipulated image or video, a replayed or generated stream, or a stream originating from a virtual capture device.
The decisive point is this: this attack never passes in front of the lens. PAD, which monitors what is presented to the camera, therefore does not see it. The injected signal arrives "clean" in the pipeline, as if it came from a real sensor.
Upstream control at the camera may be flawless, but it prevents nothing if the fraud occurs further down the line, in the stream that carries the signal. PAD monitors one point of the journey; the fraudster acts on another.
This is precisely what IAD, or Injection Attack Detection, detects. Its role is to determine if biometric data has been injected into the system or if the capture process has been hijacked, particularly through the use of injection tools or devices. This detection relies on checks focusing on the capture channel, the execution environment, the consistency of the stream, the temporal characteristics of the data, and the content of the video sent to our servers.
Two attacks, two defenses: the key distinction
A common mistake is to believe that PAD and IAD are two versions of the same thing. They are two different defenses, responding to two different attacks, at two different points in the process.
A system can be excellent at PAD and completely blind to injection. The ISO/IEC 30107-3 standard covers the evaluation of PAD mechanisms and attacks that occur at the capture device level during presentation. Therefore, it does not, on its own, cover injection attacks that occur elsewhere in the processing chain. A "liveness" certified check can remain vulnerable to an injected deepfake. It is to fill this gap that the European specification CEN/TS 18099 was published at the end of 2024, the first reference dedicated to the detection of injection attacks.
Tailor your defenses to the risk
Covering both stages doesn't mean imposing the strictest controls on everyone. The right principle is proportionality: adjusting the proof of life to the risk level of the transaction.
For low-stakes actions, a liveness passive check, which requires no effort from the user, is sufficient and maintains a seamless experience. As the stakes increase—sensitive operations, high amounts, or demanding regulatory requirements—the security is strengthened: liveness active with dynamic instructions, followed by injection detection at a higher assurance level. Security intensifies where the risk demands it, without unnecessary friction elsewhere.
This is exactly the approach taken by ShareID's liveness detection: a proof of life that covers both presentation and injection, calibrated to the risk level of each journey. This robustness has been independently validated against the industry's benchmark standards: ISO/IEC 30107-3, ISO/IEC 19989-3, and CEN/TS 18099. In the news →
.png)