GenAI Beats Liveness Tests

Longer answer, even if not, you’d better have other authoritative data sources to rely upon.

You’re probably familiar with document-based ID verification procedures. You scan a government-issued ID and then take a selfie – sometimes blinking, nodding, or smiling on command to prove it’s really you and not just a static picture of your face. Once the preserve of opening a bank account, this method is now being widely applied to verify employees who request a password or MFA reset. Until GenAI deepfake tools became widely available, this was a very robust method, but sadly, those days are gone.

While iPhones use custom software for FaceID, 3^rd party verification applications, whether web or native, rely on the phone camera. Fraudsters take this opportunity to create highly convincing videos with sophisticated GenAI Deepfake tools to utilize in the verification process. The tools available even allow for the creation of highly convincing IDs that match the target’s appearance.

All Identity & Verification vendors will counter that they have sophisticated technology in play to detect such fakery, and no doubt they are doing their best, but it is an unwinnable arms race as the deepfake tools get faster, cheaper, and evolve to be more convincing quicker than the tech vendors can keep up. The risk of over-sensitive systems mean that false positives are an increasing risk. Imagine telling your employee that you think they’re a deepfake. This video beats liveness tests

So, what can you do? At Trusona, our end-user ATO Protect journey starts with an ID scan, no extra apps or sign-up required, but we’re more interested in the back of the drivers license rather than the front. Why? It’s harder to fake, and we check every identity with the US Department of Motor Vehicles (DMV) to see if what’s on the ID matches what’s in their database. For international ID documents, we use other authoritative data sources.

We don’t stop there, the cell phone number that receives the Trusonafy Link is checked for SIM Swap, and the biographical data held against that number is verified with the carrier to ensure it matches what’s on the ID.

We have a few other tricks up our sleeve to obtain location and device configuration data, and we can work with your company’s internal data to know the true persona of the caller. We can even enable the employee to verify calls they receive from helpdesk agents.

So even if there is some life left in liveness, at Trusona we’re selfie skeptics and prefer to trust the data deepfakes can’t interfere with.