Generative AI has transformed biometric fraud. The ability to create convincing synthetic faces, voices and identities is no longer confined to well-resourced attackers. Today, high-quality deepfakes can be generated using commercially available tools with little technical expertise.
Reference: Nightingale, S.J., & Farid, H. (2022). AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, 119 (8), e2120481119.
Most discussions stop there.
The more important question is how those synthetic identities are delivered to a biometric system. Some attacks attempt to deceive the camera by presenting fabricated artefacts such as printed photographs, replayed videos or silicone masks. Others bypass the camera altogether, injecting manipulated biometric data directly into the application. Although both exploit the same advances in AI, they target entirely different parts of the biometric pipeline and require different defensive controls.
For financial institutions relying on remote identity verification, understanding that distinction is becoming increasingly important.
Two attack paths. Two different security problems.
Biometric identity systems are typically attacked in one of two ways. The first is a presentation attack, where an attacker attempts to deceive the biometric sensor itself by presenting a physical or digital artefact to the camera. This might include a printed photograph, a replayed video, a silicone mask or a deepfake displayed on a screen. The second is an injection attack, where the attacker bypasses the camera entirely and injects manipulated biometric data directly into the application’s data stream.
Although both attacks may use AI-generated content, they target completely different parts of the biometric pipeline and require different defensive controls. Understanding that distinction is becoming increasingly important as digital identity verification becomes central to customer onboarding across financial services.
Presentation attacks: challenging the sensor
Presentation attacks have been studied extensively over the past decade and are supported by a mature international standards framework.
ISO/IEC 30107 defines Presentation Attack Detection (PAD), providing a common approach for evaluating how effectively biometric systems distinguish between genuine users and fabricated presentation attack instruments (PAIs). Independent PAD evaluations measure performance using recognised metrics such as Attack Presentation Classification Error Rate (APCER) and Bona Fide Presentation Classification Error Rate (BPCER), allowing organisations to assess both security and usability.
For organisations deploying remote identity verification, PAD remains an essential control. It provides assurance that the biometric sensor can detect a wide range of attacks, from simple printed photographs through to highly sophisticated masks.
However, effective presentation attack detection only tells part of the story.
Injection attacks: bypassing the camera altogether
Injection attacks operate differently.
Rather than attempting to deceive the camera, an attacker targets the components responsible for processing biometric data. Synthetic or manipulated biometric information is injected directly into the application, bypassing the sensor and, in some cases, bypassing liveness detection mechanisms designed to protect it. This distinction is important because a biometric system can demonstrate excellent PAD performance while remaining vulnerable to injection attacks. The camera never receives a fraudulent presentation. Instead, the application receives data that appears to have originated from the camera itself.
Injection attacks may involve virtual cameras, mobile device emulators, function-hooking techniques, operating system manipulation or other methods for introducing synthetic biometric data into the application. The payload may consist of replayed biometric data, AI-generated facial imagery or increasingly sophisticated deepfake video sequences.
As these techniques become easier to automate, they become significantly more scalable than traditional presentation attacks.
Why financial services should pay particular attention
Every organisation using biometric identity verification has some level of exposure. Financial institutions, however, face a unique combination of risk factors. Digital onboarding has become the primary gateway into banking services. A successful attack at this stage can enable synthetic identity fraud, account opening using false credentials, money laundering and, ultimately, account takeover. The financial consequences of such attacks can be severe.
Case study: In 2024, British engineering firm Arup lost £20 million after a Hong Kong employee was deceived by a deepfake video call. CNN: Arup deepfake scam: loss reported | Deepfake CFO scam, Hong Kong
At the same time, financial institutions operate within an increasingly demanding regulatory environment. Frameworks such as PSD2, eIDAS 2 and the UK’s Digital Identity and Attributes Trust Framework place growing emphasis on robust identity verification and demonstrable assurance.
The consequences of failure therefore extend beyond direct fraud losses. Organisations must also consider regulatory scrutiny, operational disruption and reputational impact.
Why independent testing matters
Many biometric technology vendors perform extensive internal testing throughout product development. This is an essential part of producing secure systems. Independent evaluation serves a different purpose. An accredited laboratory approaches the system without prior knowledge of its design assumptions or optimisation strategies. Evaluation methodologies are designed to challenge the technology objectively, using independently developed attack instruments and clearly defined performance metrics.
This provides organisations with evidence that reflects how the system performs against realistic attack scenarios rather than only against internally selected test cases.
Reference: The UK Home Office’s research report on Deepfake Detection Technology found that “inconsistencies in testing datasets and evaluation metrics result in low confidence in the efficacy of detection tools, while providers often claim high accuracy without independent validation.” UK Home Office, 2023.
For presentation attacks, internationally recognised methodologies are defined through ISO/IEC 30107. For injection attacks, CEN/TS 18099 provides the current framework for evaluating Injection Attack Detection (IAD), while international standards continue to evolve as the threat landscape develops.
Evaluating the attacks that matter
Effective injection attack testing considers two distinct dimensions. The first is Injection Attack Methods (IAMs), the techniques used to deliver manipulated biometric data into the application. These may include virtual cameras, mobile device emulators, operating system modifications or function-hooking techniques. The second is Injection Attack Instruments (IAIs), the manipulated biometric content itself, such as replayed biometric sessions, AI-generated facial imagery or deepfake video. Evaluating only one dimension provides an incomplete picture. A system may successfully detect one attack method while remaining vulnerable to another, or identify known synthetic content while failing to recognise newer AI-generated variants.
A comprehensive evaluation considers both.
Building assurance, not simply achieving compliance
Compliance remains an important part of deploying biometric systems responsibly. Standards provide common terminology, evaluation methodologies and minimum expectations for security testing. However, compliance alone cannot demonstrate how a system performs against emerging threats. Attack techniques continue to evolve, often more rapidly than formal standards. Independent evaluation therefore complements compliance by providing objective evidence of system performance against contemporary attack methods and realistic threat scenarios.
For organisations operating in highly regulated sectors, this evidence supports procurement decisions, product development, risk management and regulatory engagement alike.
Looking beyond today's attacks
Biometric security is no longer defined solely by whether a system can detect a printed photograph or a replayed video. The widespread availability of generative AI has expanded both the sophistication and the scale of biometric attacks. While Presentation Attack Detection remains fundamental, organisations should also understand how their systems perform when attackers bypass the sensor entirely.
Independent evaluation across both presentation attacks and injection attacks provides a more complete picture of biometric resilience and helps organisations make informed decisions about the security of their identity verification systems. As attack methods continue to evolve, the question is no longer whether biometric systems should be tested. It is whether they are being tested against the threats they are most likely to face.
About Ingenium
Ingenium is an independent ISO/IEC 17025-accredited biometrics and identity testing laboratory. We evaluate Presentation Attack Detection (PAD) and Injection Attack Detection (IAD) using internationally recognised methodologies and independently developed attack instruments, helping organisations understand how their biometric systems perform against current and emerging threats.
