Passive liveness detection explained

Passive liveness detection is the control that confirms a live human is present at onboarding without asking the user to do anything. It is one layer of a broader defence covered in our deepfake detection in KYC guide, and it is the one most directly responsible for keeping onboarding fast. This explainer defines it, contrasts it with active liveness, sets out what it defends against, and explains how it is measured.

What is passive liveness detection?

Liveness detection answers a single question: is the face in front of the camera a real, live person, or a representation of one? Passive liveness answers it from a captured frame alone. The user takes a selfie, and the system analyses that image for the artefacts that distinguish a genuine live capture from a spoof, with no prompts, gestures, or challenges. From the customer's point of view there is no liveness step at all, which is exactly the point.

Passive vs active liveness

Active liveness asks the user to perform an action and infers liveness from the response. Common prompts include blinking, smiling, turning the head, or following a moving target. The action provides a signal, but it also adds friction, can confuse or exclude some users, and gives a determined attacker a known script to prepare against.

Passive liveness removes the prompt. Because there is nothing for the user to do, completion rates stay high, and because there is no scripted challenge, the attacker has less to rehearse. The trade-off is that passive detection has to do more analytical work on less explicit signal, which is why quality varies between vendors. In practice, strong stacks default to passive for the genuine-customer path and reserve active or step-up checks for sessions that already look risky, applying friction only where it is earned.

What passive liveness defends against

The primary target is the presentation attack: a fake shown to the camera. That includes a printed photograph, a photo or video replayed on a screen, a physical or digital mask, and a looped or pre-recorded video held up to the lens. In all of these the camera captures a real scene, but the contents of that scene are a representation rather than a live person, and passive liveness is the control trained to tell the difference.

There is a second, distinct threat that liveness alone does not fully address: the injection attack, where a synthetic feed is fed directly into the capture pipeline, bypassing the physical camera. Defending against injection requires checking the integrity of the capture itself, which is why a complete stack pairs passive liveness with dedicated injection-attack detection rather than relying on liveness in isolation. The distinction between presentation and injection is the single most important idea in this space, and we cover it in full in the deepfake detection guide.

How liveness detection is measured

Buyers should not take liveness quality on faith. Two public references matter. The ISO/IEC 30107 standard defines how presentation-attack detection is tested and reported, and is the common language for evaluating a liveness system. The NIST face recognition evaluation program benchmarks face-matching performance, which is the adjacent capability that confirms the live face matches the identity document.

A word of caution applies here. These frameworks provide a way to assess a vendor, but a vendor mentioning a standard is not the same as a vendor having been independently tested against it. Ask exactly what testing has been performed, by whom, and with what result, and treat alignment with a benchmark as a claim to verify rather than a certification to assume. BriteBase describes its face matching as engineered against these public benchmarks for this reason: the honest framing is alignment, not a certificate the firm does not hold.

Where passive liveness fits in the onboarding flow

Passive liveness sits at the very front of identity verification, at the moment of capture. The flow is straightforward: the customer takes a selfie, passive liveness confirms a live person, deepfake and injection detection screen out synthetic and injected media, document verification reads and cross-checks the identity document against the selfie, and screening clears the verified identity. Liveness is the first gate, and because it is passive, the genuine customer never feels it. The full picture of how these layers combine into a verification stack is on the identity verification software page.

FAQ