That "Quick Selfie" Verifying Your ID? It's Three Secret Tests — and Most Apps Skip One

Here's something that will reframe every "please verify your identity" screen you've ever seen: that process isn't one check. It's three completely separate questions, each of which can pass or fail on its own — and most platforms don't bother with all three.

Between January and August of 2025 alone, researchers caught 8,065 attempts to sneak past a single financial institution's identity checks using AI-generated fake videos. Not 8,065 attempts across the whole internet. One bank. Eight months. That's not a hacking problem — that's an industrial operation. And the weapon of choice wasn't a stolen ID card. It was a deepfake (an AI-created video that makes one person look and sound like someone else) dropped into the verification process at exactly the right moment.

So if you've ever uploaded your driver's license and taken a quick selfie and thought "okay, I'm verified" — you're not wrong. But you might be missing most of the story.

---

The Three Questions Every Serious Platform Needs to Answer

Think of identity verification like airport security — but not the "wave your boarding pass and walk through" version. Think of it like the checkpoint where everything about you is actually examined. Your document gets scanned, your face gets compared to it in real time, and you're asked to do something to prove you're a living person and not a recording. Each checkpoint is answering a different question. Miss one, and you've got a gap a fraud operation can walk right through.

The three questions are:

1. Is this document real? Software checks the ID for physical security features — holograms, microprint, the exact font spacing that governments use. It's looking for signs of tampering or forgery. A good document check cross-references the data against known ID templates from different countries and states. This step is actually the most mature technology of the three. It's also, on its own, deeply insufficient.

2. Does the face on the document match the face in front of the camera? This is biometric comparison — "biometric" just means measurements of your body that are unique to you, like your face structure, your fingerprints, your voice. The software maps specific points on your face (the distance between your eyes, the shape of your jawline, how your nose bridge sits relative to your cheekbones) and compares that geometry to the photo on the ID. According to Dock Labs, this process has evolved from manual human review into a layered technical system — and the face-match step alone is not enough to stop modern fraud. This article is part of a series — start with Your Rewards Points Just Became A Bribe For Your Face.

3. Is this happening right now, with a real live human? This is the part most people don't know exists. It's called liveness detection, and it's the newest and most debated piece of the puzzle.

---

Liveness Detection: The Step That's Harder Than It Sounds

Liveness detection is the system's attempt to confirm that a real, living person is sitting in front of the camera at this exact moment — not a photograph, not a pre-recorded video, not a deepfake looped into the system. And here's where it gets genuinely fascinating.

There are two ways platforms do this, and they each make a different trade-off.

Active liveness detection asks you to do something — blink, turn your head left, smile. The logic is simple: a photograph can't blink on command. A static deepfake played on a phone screen can't track your instructions in real time. According to research cited by OLOID, active liveness checks have been shown to reduce fraud by up to 91%. The catch? It adds friction. It takes a few extra seconds. And for many platforms, especially ones competing on speed and convenience, even a few seconds feels like too much to ask of users.

Passive liveness detection runs invisibly in the background while you hold your phone normally. It analyzes tiny involuntary movements — the micro-vibrations from your breathing, the way light reflects slightly differently off skin than a screen, subtle shifts in facial texture. You don't do anything extra. The system just... watches. As Sumsub describes it, this approach is frictionless for the user but creates a real design tension for the platform: less effort for you means a narrower margin between real and fake.

That tension — security versus convenience — is exactly what fraudsters are betting on.

---

The Misconception That's Getting People Hurt

Here's what most people believe, and it's totally understandable why: if you upload a real ID and your face matches it, you're verified. Document plus face equals done.

That used to be enough. Ten years ago, faking someone's ID photo required actual graphic design skills and physical materials. Creating a believable video of someone's face required a film studio. The math worked. Two checks were sufficient because the bar to fool those two checks was genuinely high. Previously in this series: Fake People Walked Right Through The Governments Id Check An.

That bar is gone now.

"AI-driven fraud and deepfake usage surged fourfold from 2023 to 2024, driven by rapid AI advancements; deepfakes accounted for 7% of all fraud in 2024." — Sumsub

Fraudsters today can take a stolen identity — say, your name, your ID number, someone's old photo — and feed it through AI tools that generate a realistic video of that person's face doing whatever the liveness check requests. Not a video of a human. A synthetic video. One that passes the document check (because the ID details are real) and the face-match check (because the AI was trained on the real person's face) and might even pass a weak liveness check if the system isn't detailed enough to tell the difference.

According to DuckDuckGoose AI, one operation in Indonesia targeting financial institutions racked up an estimated $138.5 million in potential losses over just three months using exactly this approach. Three months. And the kicker? Liveness detection was in place. The deepfakes beat it anyway — because there's a critical difference between liveness detection and deepfake detection that most people, and even some platforms, don't fully grasp.

Liveness detection answers: Is there a responsive face here?

Deepfake detection answers: Is that face synthetically generated?

They are not the same question. A deepfake video of someone blinking and turning their head can pass a liveness check — because yes, technically something is responding. Catching it requires a separate system that looks for the tiny artifacts AI generation leaves behind: unnatural skin texture at the hairline, lighting that doesn't quite match the background, pixel-level inconsistencies that the human eye can't see but algorithms can.

This is the gap. Platforms that built good liveness systems five years ago didn't necessarily build deepfake detection into them. The threat evolved faster than the infrastructure.

---

What to Actually Pay Attention to Before You Hand Over Your Data

Look, nobody's saying you should refuse every identity check. Some of these systems are genuinely well-built. But understanding what's happening behind that "upload your license" button makes you a smarter participant in the process. At CaraComp, where we work with facial recognition systems daily, the question we always ask is: which of the three layers is this actually covering? A platform that asks for your ID and a selfie but nothing more may be running a two-layer check — and leaving the third gate open. Up next: That Quick Selfie Verifying Your Id Its Three Secret Tests A.

A few things worth noticing next time you go through one of these flows:

Does the system ask you to move or react? If it just takes a static selfie, there's no active liveness check. That's not automatically bad — passive liveness exists — but it's worth knowing.

Does it tell you what it keeps? The biometric data (your face measurements, not just your photo) collected during verification can be stored long after the check is complete. Some jurisdictions, like Illinois under its Biometric Information Privacy Act, require companies to disclose this. Many don't have such rules. Worth reading the fine print, especially for apps that have no obvious reason to need your ID in the first place.

Is the platform the kind that needs this level of verification? A financial app, a government portal, a healthcare platform — yes. A random service offering a minor perk? Be more skeptical about what you're exchanging for it.

Here's the thing that should stick with you: the same AI technology making deepfakes easier to create is also making them easier to detect — if platforms invest in the right layer. The arms race is real, and TechJury reports the industry is projected to nearly triple by the mid-2030s as a direct result. Platforms are being forced to catch up. The question is whether the ones handling your most sensitive information have already done it — or whether they're still running a two-question check in a three-question world.

Next time an app asks for your ID and a selfie, you'll know exactly what they should be doing with it. And you'll have a pretty good sense of whether they actually are.