Remote Identity Proofing: 3 Checks the Selfie Can't Do

When you upload a photo of your I.D. and then snap a quick selfie, you probably assume those two steps are doing the same job, checking that your face matches your document. They're not. They answer two completely different questions, and there's actually a third question that neither one can answer on its own.

If you've ever opened a bank account online, or

If you've ever opened a bank account online, or verified yourself for a new app, you've already been through this. It's called remote identity proofing, proving you are who you say you are, without ever standing in front of a human. And European regulators just decided the old way of doing it isn't good enough anymore. Today I want to walk you through the three separate checks hiding inside that "upload I.D. and take a selfie" moment, and why deepfakes are the reason the rules just changed. So how does a computer actually decide you're really you?

Let me give you the mental picture that makes this click. Imagine checking into a hotel. The front desk needs three assurances before handing you a key. First, is your passport genuine? They inspect the security features and check it against records. Second, does your face match the photo inside it? Third, are you actually standing there, right now, and not a photo someone's holding up? None of those three checks proves your identity alone. A real passport in an empty room proves nothing. A matching face could be someone holding your stolen I.D. Only all three together answer the full question.

That's exactly how remote proofing works, and it's why the selfie can't do everything. The document check confirms your I.D. is real and hasn't been forged. The face match confirms the person on camera resembles the photo on that document. And then there's the third layer, liveness detection. This is the one people misunderstand the most.

Liveness detection doesn't prove who you are

Liveness detection doesn't prove who you are. It only proves that a real, living person is present at the moment of capture, not a printed photo, not a mask, not a replayed video. And that distinction matters enormously. A live person can hold up somebody else's I.D. And a stolen photo can be replayed on a screen with no live person there at all. So the system needs both, one check watches the document, the other watches for a real human in real time.

Now, why did regulators suddenly raise the bar? One word, deepfakes. According to European security researchers, deepfake attacks and something called injection attacks are now the two hardest biometric threats to defend against. Here's the scary part. The A.I. models that generate fake faces, they're specifically built to mimic the signs of a live person. So they can slide right past older liveness checks that were never designed to catch synthetic media. For the rest of us, that means a fraudster no longer needs your face, they can manufacture one that moves and blinks convincingly.

That's why the European Union made this legally binding. On April eighth, 04/08/2026, the E.U. published a new regulation that sets one mandatory standard for verifying anyone onboarding to a digital identity wallet, across every member state. Layered checks aren't a nice-to-have anymore. They're the floor.