Digital services today require users to scan their faces with their mobile phones to ensure authenticity during the onboarding process. Despite this measure, fraudsters can bypass facial recognition systems through identity theft. This is also known as spoofing attacks.
💡 Researchers from Tel Aviv University have discovered a universal face template that can bypass most facial recognition systems.
The vulnerability lies in the broad sets of markers used by facial recognition systems to identify individuals, which can be exploited by attackers to create a fake face that matches many of those markers and tricks a large number of security systems.
To combat this issue, service providers are actively developing methods alongside the facial recognition process to help identify and prevent these attacks. By adding another layer of security to the facial recognition process, service providers are making it increasingly difficult for fraudsters to bypass it using a fabricated identity.
What Is The Most Common Facial Recognition Spoofing Method?
Presentation attacks are the most commonly employed form of spoofing, whereby fraudsters present false identities to deceive facial recognition systems. Presentation attacks can come in two forms: Static 2D and Static 3D.
- Static 2D attacks are relatively simple and use two-dimensional flat objects such as photos, paper, or masks to trick the facial recognition system. However, more sophisticated 2D attacks use smartphone or tablet screens to flash images in sequence to mimic live movement.
- Static 3D attacks are more complex and employ the use of 3D printed masks, sculptures, or facial reproductions. These attacks can be more challenging to detect, as they provide a physical depth that makes them appear more realistic to the system.
To learn more about the different methods of spoofing and how it works, read our article here
What Are the Anti-Spoofing Measures for Facial Recognition?
To achieve better results in detecting fraudsters, service providers are actively turning to liveness detection. Liveness detection systems have the ability to distinguish between an actual person and a prop, video, or photo presentation.
These systems are able to determine if a face is “alive” and real or a fabrication through a variety of measures:
- Motion analysis: The system determines whether the image is a live capture by analysing the movement of the user’s face and its surrounding area.
- Skin Texture Analysis: The system is able to determine if a person is real or not through skin texture analysis.
Skin texture is noticeably different in a live face as compared to a fake one.
- Use of 3D Cameras: Some of the newer methods utilise multiple cameras to capture different angles of the face simultaneously, making it more challenging for fraudsters to bypass the system.
- Machine Learning Algorithms: To train these algorithms, the system will analyse a large dataset of both genuine and spoofed facial images or videos. The algorithms then learn the characteristics of genuine and spoofed faces to accurately distinguish between the two.
How Effective Is Liveness Detection?
Liveness detection improves the effectiveness of identifying false identities from multiple angles. However, it is important to note that false positives can still occur if the system mistakenly identifies a non-living object as a real person.
For example, certain lighting conditions or camera angles can cause facial recognition algorithms to misidentify non-living objects as living ones.
Some systems use multi-factor authentication methods such as voice recognition or fingerprint scanning in addition to facial recognition to reduce false positives in facial recognition liveliness detection.
Why Anti-Spoofing is Important For Onboarding Processes
Anti-spoofing is important for onboarding processes because it helps verify the authenticity and integrity of user identities. It helps to prevent fraud and ensures the security of online transactions/services.
Prioritising anti-spoofing measures is crucial due to the ease with which facial recognition can be bypassed. Service providers can implement various methods to detect even the most advanced forms of fabricated identities, but developing new anti-spoofing methods proactively is essential.
At Innov8tif, we have developed a comprehensive and integrated electric know your customer (eKYC) system known as EMAS eKYC that incorporates liveness detection (OkayLive) and facial recognition (OkayFace) APIs to identify fake identities and prevent spoofing attacks. These APIs make up a part of our EMAS eKYC system, which aims to automate and secure user onboarding processes.
To learn more about our eKYC components, feel free to take a look at our official wiki pages detailing their functions: OkayFace & OkayLive
