SpoofSense Face
SpoofSense verifies that a live, physically present human is behind every selfie — passively, from a single image. No blinking, no head turns, no challenges. Just one REST API call that stops print, mask, replay, deepfake and injection attacks.
The basics
Face liveness detection (also called liveness verification or anti-spoofing) is the technology that confirms the face in front of a camera belongs to a real, live person — not a photo, a screen, a mask, or an AI-generated imitation. It is the layer of an identity stack that decides whether a selfie can be trusted before face matching or KYC decisions run.
Without liveness detection, an attacker with a victim's photo — scraped from social media or a leaked database — can open accounts, take over logins and pass remote onboarding. With it, spoofed faces are rejected at the first step, before they ever become an approved identity.
Liveness checks are standardized under ISO/IEC 30107-3, the international presentation attack detection (PAD) standard, and independently tested by labs such as iBeta. SpoofSense is iBeta Level 1 and Level 2 compliant per ISO/IEC 30107-3.
Passive vs. active
Active liveness asks users to perform challenges. Passive liveness decides from a single frame. Here is how they compare in production identity flows.
| Passive liveness (SpoofSense) | Active liveness | |
|---|---|---|
| User action required | None — a single selfie | Blink, smile, turn head, follow a dot |
| Verification time | Instant, from one frame | 5–30 seconds of challenges |
| Drop-off risk | Minimal added friction | Higher — each challenge loses users |
| Attack resistance | Certified PAD plus deepfake and injection screening | Challenges can be replayed or deepfaked |
| Accessibility | Works for all users | Harder for users with motor or visual impairments |
Threat coverage
Certified presentation attack detection (PAD) catches printed photos, paper cutouts, and 2D or 3D masks presented to the camera.
Detects pre-recorded or live-replayed faces shown on phones, tablets and monitors using screen texture and moiré artifacts.
Screens for GenAI faces, face swaps and reenactment deepfakes with pixel-level artifact analysis.
Deepfake detection →Flags virtual cameras, emulators and injected video streams that try to bypass the camera entirely.
Injection attack detection →Verifying documents too? SpoofSense DocLive applies the same passive approach to ID documents, catching print, replay and portrait-tamper attacks during document capture.
How it works
01
Your app captures a single selfie through our Web or Mobile SDK, or any camera pipeline you already run.
02
The image is screened for presentation artifacts, screen replay signatures, GenAI fingerprints and injection signals in a single pass.
03
The REST API returns a liveness decision you can act on instantly — approve, reject, or step up.
Certification
ISO/IEC 30107-3 defines how presentation attack detection is tested; iBeta is the independent lab that runs those tests. Level 1 covers print and screen replay attacks, Level 2 adds sophisticated 3D masks. SpoofSense passes both — the compliance bar regulated identity programs look for.
FAQ
Face liveness detection verifies that the face presented during identity verification belongs to a live, physically present human — not a printed photo, a mask, a replayed video, or an AI-generated deepfake. It is the control that stops spoofed faces from passing selfie checks in onboarding, KYC and authentication flows.
Active liveness asks the user to perform challenges — blink, turn their head, follow a dot — which adds friction and drop-off. Passive liveness analyzes a single image or frame with no user action required. SpoofSense uses passive liveness, so genuine users complete verification without interruption while attacks are still caught.
Yes. SpoofSense is iBeta Level 1 and Level 2 compliant, tested per the ISO/IEC 30107-3 presentation attack detection standard.
SpoofSense detects presentation attacks (printed photos, cutouts, 2D and 3D masks), replay attacks shown on phone, tablet or monitor screens, AI-generated deepfakes and face swaps, and digital injection attacks that use virtual cameras or emulators to bypass the camera.
SpoofSense is a REST API with Web and Mobile SDKs. You send a single face image and receive a liveness decision in the response. Most teams integrate in under a day, and new accounts get 100 free credits to test with.
No — that is its main advantage. Because there are no challenge steps, genuine users pass without doing anything extra, which reduces abandonment compared to active liveness flows while keeping spoof detection strength.
