Why Face Match Alone Isn't Enough (and What to Pair It With)

A lot of teams add one biometric check, see it working, and move on. That's a natural thing to do. But each check on its own leaves a gap, and fraudsters know exactly where the gaps are.

Let's look at both pieces, and why they work so much better together.

Two checks, two different questions

Face match asks: do these two faces belong to the same person? You give it a selfie and a reference photo, and it tells you how alike they are.

Liveness asks: is a real, living person in front of the camera right now? It has nothing to do with who the person is. It only checks that someone is actually there.

See the problem? If you only use face match, an attacker can upload a stolen photo of your customer, and the system says "same person, approved." If you only use liveness, you know a real human is present, but not that it's the right human. Someone could pass the live check with their own face while claiming another person's identity.

You close the loophole by using both, so you know a real person is here and that person is the one on the ID.

Pick the reference photo carefully

Face match is only as trustworthy as the photo you compare against. The best reference is the photo tied to a verified identity record, like the picture returned when you look up a BVN or NIN. It's much stronger than a photo the applicant uploads themselves, because a self-uploaded picture can be edited or swapped. An official record is hard to fake.

The order that works

1. Check the number first. Do a BVN or NIN lookup and keep the reference photo.
2. Run liveness. Get the capture from the live session. Here's the liveness endpoint.
3. Compare the faces. Match the live capture to the reference using the face match endpoint.
4. Look at everything together. The identity result, the liveness score and the similarity score.
5. Decide. Approve, send to review, or decline.

Why liveness before face match? It saves time and money. There's no point comparing a face you don't trust yet.

What the face match call looks like

curl -X POST https://api.identifyorg.com/v1/verify/face-match \
  -H "X-IdentifyOrg-Key: io_live_xxxx" \
  -F "selfie=@selfie.jpg" \
  -F "id_photo=@reference_photo.jpg"

You get back a match (true or false) and a confidence_score, so your own code decides what to do with it.

Setting thresholds without guessing

"What score should I accept?" is the question everyone asks. There's no magic number, but here's a sensible way to find yours.

• Start strict, then measure. Save the scores for approved and declined cases, look at the people who were wrongly rejected, and adjust.
• Match the strictness to the stakes. Higher limits and loans deserve a tighter threshold than a small wallet.
• Use a middle band. Clear passes go through, clear failures are declined, and anything in between goes to a human. Keep the band narrow so your review queue stays small.
• Learn from what happens next. If approved accounts later turn out to be fraud, tighten up. If honest customers keep getting blocked, loosen a little.

Be kind to real users

• Show tips on screen: face in the frame, even lighting, no bright window behind you.
• Allow a few retries, and explain what went wrong ("too dark," "face not centred").
• Offer a fallback, such as an assisted review, for people who can't complete the flow. Security shouldn't lock out people with older phones or disabilities.
• Keep it quick. The whole step should take well under a minute.

Privacy

Face data is sensitive. Tell users what you collect and why, keep captures only as long as the check needs, and store the result instead of the image where you can. IdentifyOrg doesn't keep biometric data beyond the verification session unless you opt in. See the data protection checklist for more.

Putting it together

Identity lookup, liveness and face match all live under one account. To see why the live check matters so much, read Fake accounts, replayed selfies and deepfakes. Or take a look at the products, or start free.