Liveness Detection: 6 Seconds to a Stolen Google Account

Here's the thing nobody tells you about passkeys: the login can be mathematically unbreakable and your account can still get stolen in six seconds — because the danger moved to a completely different moment, one that has almost nothing to do with liveness detection or how strong your face or fingerprint scan actually is.

Picture this: someone logs into your Google account, waits six seconds, and registers a brand new device as trusted. From that point on, your password doesn't matter. Your face ID doesn't matter. Even if you change every password you own tonight, that attacker's device is still sitting inside your account like a spare key you don't know exists. That's not a hypothetical — it's a real attack pattern reported by Biometric Update, and it exposes something most of us never think about: passkeys were built to solve login security, not enrollment security. Those are two completely different problems, and only one of them got fixed.

What liveness detection actually protects (and what it doesn't)

Let's back up. Liveness detection, or "liveness," is the automated method your phone or a banking app uses to check that a real person is actually in front of the camera right now — not a photo, not a video replay, not a mask. It's the technology asking, essentially, "is this a live person or a trick?" Passive versions do this quietly in the background by analyzing light, texture, and tiny movements. Active versions make you blink, turn your head, or say a number out loud. Either way, liveness detection helps prevent biometric fraud by making sure the face or fingerprint being scanned belongs to a breathing, present human — not a printed photo or a deepfake video held up to a webcam.

Passkeys use a related idea but solve a different problem. Instead of a password you type (which can be stolen, guessed, or reused across ten different websites), a passkey is a pair of digital keys — one that lives only on your device, and one that the website keeps. When you log in, your device proves it holds the private key without ever sending it anywhere. There's nothing to steal in transit, which is why security experts call passkeys "phishing-resistant." No fake login page can trick you into handing over a key that never leaves your phone.

Here's where it gets interesting, though. That phishing-resistant login only covers one moment: signing in. It says nothing about the moment before that — the moment when a new device first gets permission to hold a key at all. That moment is called enrollment, and according to the researchers who documented this attack, it's treated as routine account housekeeping instead of a high-risk identity decision. This article is part of a series — start with How To Spot A Deepfake.

Google passkey attack shows why enrollment is the real target

How does a google passkey attack bypass the login?

The attacker never touches the cryptography. Instead, they trick you into approving a weaker fallback method — like an authenticator app code — during a phishing moment, then use that brief window to register their own device as a trusted passkey holder before you notice anything wrong.

Here's the sequence, based on the reporting: an attacker sets up a fake login page and gets the victim to authenticate using a one-time code from an authenticator app instead of a passkey. That's the crack in the door. Once the attacker has a live session, they immediately register a new passkey — binding their own phone or laptop to your account as a permanently trusted device. In the demonstrated attack, this whole enrollment step took about six seconds from the moment of login. Six seconds. That's less time than it takes to read this sentence out loud twice.

The FIDO Alliance, which sets the technical standards behind passkeys, has warned about exactly this kind of gap: offering passkeys alongside passwords and one-time codes doesn't prevent phishing if a user can still choose the weaker option. And people almost always will, because the weaker option is usually faster and more familiar. You've typed a six-digit code from an app a hundred times. Approving a "new passkey registered" notification? Most people don't even know what that screen means, so they tap through it without a second thought.

This is also why recovery and enrollment flows are so quietly dangerous. There's typically no loud alarm, no push notification screaming "a stranger just added a device to your account." As the researchers put it, biometric enrollments that don't alert the original device let account takeovers proceed unnoticed — the attack finishes before the real owner has any idea it started.

The attacks do not break the mathematical foundations of passkey cryptography. What they exploit is the operational layer where systems manage device trust, store credential metadata, and handle re-enrollment to the cloud. — Reporting on the Google passkey attack, Biometric Update

The misconception that makes this attack work so well

Most people hear "passwordless" and assume it means "unhackable." Honestly, it's a reasonable thing to assume — companies market passkeys as the end of phishing, and technically, they're not lying. The login really is dramatically harder to phish. But there's a difference between the strength of a single credential and the strength of everything surrounding it: the browser, the cloud sync service, the recovery process, the fallback options. Think of it like a house with a vault-grade steel door but a screen door on the back porch. The front door being unbreakable doesn't help if nobody's watching the back. Previously in this series: Take It Down Act Deepfakes.

People get this wrong for an understandable reason: security marketing talks about the credential, not the system around the credential. "Phishing-resistant login" sounds like a finished sentence. But account security isn't one moment — it's a lifecycle. There's enrollment (adding a device), authentication (logging in), and recovery (getting back in when you're locked out). Passkeys fixed the middle one. The other two are still wide open in a lot of systems, and attackers know it. As adoption scales — the FIDO Alliance reports 5 billion passkeys now in active use worldwide — the enrollment step becomes a bigger target simply because there's more of it happening, more often, across more accounts.

How identity verification connects to liveness detection and trust decisions

This is the part that connects to something CaraComp thinks about constantly with facial recognition: identity verification is never really about one clever piece of technology. It's about a chain of trust decisions, and every chain has a weakest link. In face-matching systems, that weak link is often the same kind of thing — not the matching algorithm itself, but the moment someone enrolls a new photo into the system, or the moment a presentation attack (holding up a photo, a mask, or a deepfake video) tries to fool a camera into thinking it's looking at a live person. Good liveness detection catches the fake at the door. But if the "add this face to our trusted database" step is sloppy, the strongest matching algorithm in the world won't save you, because it'll faithfully match against a face that was never supposed to be trusted in the first place.

What is presentation attack detection and why does it matter here?

Presentation attack detection, or PAD, is the specific job of catching spoofing attempts — photos, masks, screen replays, deepfakes — before a biometric system accepts them. It's tested under standards like ibeta and referenced in NIST guidance, and it matters because enrollment is exactly where a fake identity can slip in permanently if nobody checks.

Banks are already leaning into this lesson for financial fraud. Deepfake detection is expanding past the initial account signup and into what researchers call continuous financial trust — checking not just "is this a real person opening the account" but "is this still the same real person acting on it six months later." That's the same instinct passkey systems need: don't just verify once at the door and then trust forever. Verify again, harder, whenever something changes — a new device, a new phone number, a new recovery email.

Why "add new device" deserves bank-transfer-level caution

Because that request is functionally identical to handing a stranger a key to your house. Treat it with the same pause you'd give a wire transfer request: stop, verify it was really you, and check for a confirmation notification on your other devices before assuming it's fine. Up next: How To Spot A Deepfake 1 School Photo Is All It Takes.

So here's the question worth sitting with tonight: when your phone buzzes with "new device added to your account," do you actually read it — or do you tap "got it" the same way you click past a cookie banner? Because that tap is now the moment attackers are betting on. Not your password. Not your face scan. Just that half-second of not paying attention.

Frequently Asked Questions