That "Quick Selfie" Verifying Your ID? It's Three Secret Tests, and Most Apps Skip One

Between January and August of 2025, researchers watched one single bank get hit with over eight thousand attempts to fool its selfie check. Not eight thousand attempts across the whole industry. Eight thousand and sixty-five, at one institution, all using AI-generated deepfakes.

If you've ever pointed your phone at your face to

If you've ever pointed your phone at your face to unlock a bank app or verify your ID, this is happening on your behalf, whether you knew it or not. And most of us assume that little selfie is one simple test. It isn't. That quick photo can trigger three separate security checks, and here's the unsettling part: a lot of apps only run two of them. So how does a single selfie become three hidden tests, and why does the missing one matter so much?

When an app verifies who you are, it's really asking three different questions. The first is about your document. Is this driver's license or passport genuine? That's the easy one. Scanners have been catching fake IDs for years.

The second question is about your face. Does the person in the selfie match the photo on the document? That's facial comparisonharder, but well understood.

The third question is the one people miss

The third question is the one people miss. Is there actually a living person here right now? That's called liveness detection. It checks that you're not holding up a printed photo or playing a recording to the camera.

Now, most people believe that if your ID is real and your face matches it, you're verified. And honestly, that made sense for years, faking an ID was expensive, and making a convincing fake video took a Hollywood budget. That world is gone. According to fraud researchers, AI-driven deepfake attempts jumped fourfold from 2023 to 2024. By 2024, deepfakes made up seven percent of all fraud. So document plus face match is still necessary, it's just no longer enough.

Here's the piece that stopped me cold. Liveness detection and deepfake detection are not the same thing. Liveness confirms a face is responding in real time. But it can't always tell whether that responsive face is actually real, or a synthetic one being injected straight into the camera feed. In one investigation at an Indonesian bank, over eleven hundred deepfake attempts slipped past the identity check. The estimated potential loss? Around a hundred and thirty-eight million dollars in three months. For a bank, that's a catastrophe. For you, it means a criminal could fuse a stranger's stolen face with their own movements and open an account in your name.