Fake Accounts, Replayed Selfies and Deepfakes: How Liveness Checks Keep Them Out

Let me describe a morning no fintech wants to have.

You open your dashboard and see 400 new accounts, all created overnight. The names look normal. The selfies look fine. A few days later, money starts moving through them, and none of them belong to real customers.

How did they get in? Probably not with a stolen ID card. More likely with a script that signed up hundreds of times, using photos of photos, videos replayed from a phone, or faces made by AI that never belonged to anyone.

That is why more banks and fintechs are adding a liveness check. It's a small step, but it's one of the most effective ones you can add.

What is a liveness check?

It answers one simple question: is there a real, live person in front of this camera right now?

That's different from asking whether the face matches an ID. A face match tells you two pictures look alike. It can't tell you whether one of those pictures was taken a second ago by a living person, or pulled off someone's Facebook page.

Why a normal selfie isn't enough

Imagine an attacker who has a photo of your customer. Without a liveness check, they can try all of these and a plain selfie check will let most of them through:

• Holding up a printed photo
• Playing a video of the person on another screen
• Wearing a mask or using a cut-out
• Feeding a fake video into your app with software that pretends to be a camera
• Using an AI-generated face built to look like the ID holder

A liveness check is built to catch exactly these.

How it works: two approaches that work well together

Active liveness asks the user to do something unpredictable, like blink, turn their head or smile. The prompt is random each time, so a pre-recorded video can't know what's coming. Our version does this in the browser using face tracking.

Passive liveness asks for nothing. Behind the scenes, we study the pictures for things a real face has and a fake one doesn't, like natural skin texture, reflections and depth. We also look for what screens and printouts leave behind, like glare and flat lighting.

The strongest setup uses both. Active checks stop replays, and passive analysis catches the tricks that get past them. Our liveness endpoint does both and returns a score from 0 to 100. If the score is below the line you set, you can send the case for a person to review.

Where bots really get in

Many people think of bots as something that attacks the sign-up form, and a CAPTCHA will do. But the risky moments are often elsewhere:

1. Opening an account. Farms of fake identities.
2. Recovering a password or a lost phone. Attackers pretending to be the real owner.
3. High-risk actions. Raising a limit, adding a new payee, changing a phone number.
4. Applying for a loan. Repeat or made-up applicants.

Putting a liveness step at these moments works well. An honest customer spends about ten seconds on it. A script or a replay attack runs into a wall.

Where it fits in your flow

A good order looks like this:

1. Check the number, a BVN or NIN.
2. Run the liveness check to confirm a real person is there.
3. Compare the live capture to the photo on record for that identity.
4. Decide whether to approve, review or decline, using the scores.

We explain why this combination is stronger than either piece alone in Why face match alone isn't enough.

Tuning it so it doesn't annoy real people

• Set the bar based on risk. A small wallet can accept a lower score than a loan product.
• Keep a manual review lane. Borderline scores shouldn't be an automatic rejection.
• Expect poor conditions. Cheap phone cameras and dim rooms are normal here. Give clear on-screen tips about lighting and framing.
• Use it as one signal among several. Combine it with checks on the device and how fast sign-ups are arriving.

A word on privacy

Face data is sensitive. Collect it only to do the check, tell people plainly why, and don't keep it longer than you need. IdentifyOrg doesn't hold biometric data after the session unless you choose to keep it. More on this in our data protection checklist.

Try it

Liveness is one of several checks you can run with a single account and a single key, paid for from a naira wallet. Create a free account, try it with a test key, and look at the API reference when you're ready to build.