Passive liveness detection explained

Passive liveness detection confirms that a live person is in front of the camera by analysing a single captured frame for the artefacts that distinguish a genuine live capture from a spoof, without asking the user to perform any action. The user simply takes a selfie, and the system decides whether it is a real, present human or a representation of one, with no prompts, gestures, or challenges. From the customer's point of view there is no liveness step at all, which is exactly the point. Because it adds no steps for the genuine customer, passive liveness keeps onboarding fast and protects conversion while still defending the front door against spoofing. It is one layer of a broader defence, covered in our deepfake detection in KYC guide, and it is the one most directly responsible for keeping onboarding low friction rather than a sequence of hurdles.

Active liveness asks the user to do something, such as blink, smile, or turn their head, and infers that a live person is present from the response. Passive liveness analyses a single captured frame for the signs of a spoof without any user action at all. The action in an active check provides an explicit signal, but it also adds friction, can confuse or exclude some users, and gives a determined attacker a known script to prepare against. Passive liveness removes the prompt, so completion rates stay high and the attacker has less to rehearse, at the cost of doing more analytical work on a less explicit signal, which is why quality varies between vendors. In practice, strong stacks default to passive for the genuine-customer path and reserve active or step-up checks for sessions that already look risky, applying friction only where it is earned rather than to everyone.

Passive liveness targets the presentation attack: a fake shown to the camera. That includes a printed photograph, a photo or video replayed on a screen, a physical or digital mask, and a looped or pre-recorded video held up to the lens. In all of these the camera captures a real scene, but the contents of that scene are a representation rather than a live person, and passive liveness is the control trained to tell the difference. There is a second, distinct threat that liveness alone does not fully address: the injection attack, where a synthetic feed is fed directly into the capture pipeline, bypassing the physical camera. That is why a complete stack pairs passive liveness with dedicated injection-attack detection rather than relying on liveness in isolation. Passive liveness is the baseline control that confirms a real human is present before the identity behind that face is trusted at all.

Liveness and presentation-attack detection are evaluated against public frameworks, most notably the ISO/IEC 30107 standard, which defines how presentation-attack detection is tested and reported and is the common language for evaluating a liveness system. Face-matching performance, the adjacent capability that confirms the live face matches the identity document, is benchmarked separately through the NIST face recognition evaluation program. A word of caution applies here. These frameworks provide a way to assess a vendor, but a vendor mentioning a standard is not the same as a vendor having been independently tested against it. Ask exactly what testing has been performed, by whom, and with what result, and treat alignment with a benchmark as a claim to verify rather than a certification to assume. The honest framing from any vendor is alignment with a benchmark, not a certificate the firm does not actually hold or cannot evidence.

No, and that is its main advantage. Because the genuine customer only takes a selfie and is never asked to blink, turn, or perform any action, passive liveness keeps onboarding fast and reduces drop-off compared with active checks that add steps some users abandon. The friction that hurts conversion comes from asking people to do things, and passive liveness removes that ask entirely for the legitimate path. Risk-based step-up can then be reserved for the sessions that show warning signs, so the added scrutiny lands only where it is warranted rather than on every applicant. This is why strong stacks make passive liveness the default: it strengthens the front door without taxing the honest majority to catch the dishonest few. The same fast, low-friction pass also produces a logged decision for each customer, so protecting conversion and building the compliance record are not competing goals but the same one.

FINTRAC does not mandate liveness detection by name, but Bill C-12 requires every compliance program to be reasonably designed, risk-based, and effective, and that standard is where the expectation lands. For a firm that verifies identity remotely, liveness is a core part of showing that onboarding genuinely confirms a real, present person rather than a photo, a replay, or an injected feed. An examiner can reasonably ask how a remote-onboarding control performs against today's spoofing, and a program with no meaningful liveness defence is hard to describe as effective. So while liveness is not a named requirement, it directly supports the case that the program meets the effectiveness standard. Passive liveness is particularly well suited to this because it produces a recorded decision for each customer while keeping onboarding fast, so the same control that defends the door also contributes the examiner-ready evidence a Canadian reporting entity has to be able to show.