en

Language

Home Identity Glossary Deepfake

Deepfake

What Is a Deepfake?

A deepfake is synthetic or manipulated media — usually an image, video, or audio recording — created using machine learning. It can make a person appear to say or do something they never said or did. The resulting faces, expressions, movements, and voices may be realistic enough to deceive people or automated systems.
In identity verification, fraudsters may use deepfakes to animate stolen portraits, generate synthetic faces, or perform real-time face swaps during onboarding, account recovery, or video calls with support agents. They can deliver this content in two main ways:
  • Presentation attack: The deepfake is shown to a physical camera, often using the screen of another device.
  • Injection attack: The deepfake is introduced directly into the capture or processing pipeline, such as through a virtual camera or manipulated data stream.

What Are the Key Components of Deepfake Detection?

Effective deepfake detection requires multiple security controls because deepfakes can be presented to a camera or injected directly into the capture pipeline. Combining document verification, biometric comparison, liveness detection, secure capture, and data-integrity checks provides stronger protection than relying on a single method.
The key components of a layered defense against deepfake-based identity attacks include:
  • Liveness detection: Determines whether biometric data comes from a real person who is physically present during verification and helps identify replayed or manipulated media.
  • Trusted capture and device security: Validates the source of biometric data and protects the capture process using secure applications, device-integrity checks, or trusted hardware. These controls help prevent virtual-camera feeds, manipulated uploads, and other injection attacks.
  • Secure transmission and data integrity: Protects sensitive identity and biometric data in transit through encryption and uses integrity checks to detect data that has been altered or replaced after capture.
  • Layered identity verification: Combines document authenticity checks, face matching, liveness detection, and device and session analysis instead of relying on a single security control.

How Can Regula Help Against Deepfakes?

Regula helps organizations defend against deepfake-based identity fraud through document authenticity checks, document liveness detection, biometric verification, and NFC/RFID chip verification.
During remote verification, Regula Document Reader SDK checks whether submitted identity documents are genuine and extracts the personal data and portrait. Document liveness detection asks the user to tilt the document in front of the camera so that dynamic security features, such as holograms and optically variable ink, can be examined. This helps distinguish a physical document from a screen image or another digital reproduction.
Regula Face SDK performs a 1:1 comparison between the applicant’s facial image and the document portrait. Organizations can use active or passive liveness detection to help confirm that a real person is present and identify common spoofing attempts, including screen replays that may contain deepfake video.

FAQ

What Is the Difference Between a Deepfake and a Face Spoof?

A deepfake is AI-generated or manipulated media designed to imitate a person’s face, voice, or behavior. A face spoof is a broader category that includes any attempt to deceive a biometric system, such as using a printed photograph, replayed video, mask, or deepfake. Therefore, a deepfake can be used in a face-spoofing attack, but not every face spoof involves deepfake technology.

How does liveness detection help against deepfakes?

Liveness detection can help identify deepfakes by checking whether biometric data comes from a real person who is physically present. It may detect screen replays, unnatural facial behavior, or other signs of manipulated media. However, liveness detection should be combined with trusted capture, injection-attack detection, face matching, and device and session analysis.

What Is the Difference Between Presentation and Injection Attacks?

In a presentation attack, fraudulent content is presented to a physical camera—for example, by displaying a deepfake video on another device. In an injection attack, manipulated images or video are introduced directly into the capture or processing pipeline through methods such as a virtual camera or altered data stream. Injection attacks can bypass controls that examine only what appears in front of the camera, so capture-source and data-integrity checks are also necessary.

Can Deepfakes Be Used with Fake Identity Documents?

Yes. Fraudsters may combine a manipulated or counterfeit identity document with a deepfake selfie or video to impersonate another person or support a fabricated identity. Document authenticity checks, document liveness detection, and NFC/RFID chip verification can help identify false or digitally reproduced documents. Face matching and liveness detection can then help determine whether the applicant is present and matches the verified document portrait.

How Can Organizations Reduce Deepfake Fraud?

Organizations should use a layered defense that combines document verification, face matching, liveness detection, trusted capture, device analysis, and secure data transmission. They should protect against both presentation attacks and injections into the capture pipeline. Regularly updating detection methods, monitoring suspicious verification attempts, and requiring additional checks for higher-risk cases can further reduce exposure.

On our website, we use cookies to collect technical information. In particular, we process the IP address of your location to personalize the content of the site

Cookie Policy rules