Remote onboarding removes the physical counter at which a person once presented a document and a face. In its place, a camera and a verification pipeline must establish that the individual completing the process is a real human being, present at that moment, and the same person shown on the submitted identity document. Liveness verification addresses the first part of that question: is the face in front of the camera a living, present person, or a reproduction?
The distinction matters because document checks and face matching alone can be defeated by a convincing image. A printed photograph, a face shown on a second screen, a moulded mask or an artificially generated video can each carry the correct features. Without a liveness signal, a matching algorithm may confirm that two faces are the same while saying nothing about whether either belongs to a real applicant. Liveness verification is designed to close that gap.
This article explains, at a decision-making level, what liveness verification establishes, how active and passive approaches differ, the categories of attack it is expected to resist, and where the control sits within a broader KYC workflow. It is written for the teams that select and govern identity technology rather than for those implementing it, and it deliberately stops short of engineering detail.
What Liveness Verification Confirms
Liveness verification, sometimes described as presentation attack detection, is the process of establishing that a biometric sample originates from a real, living person who is physically present, rather than from an artefact or a manipulated media stream. It does not, on its own, establish identity. Its role is narrower and specific: to confirm the genuine presence of a human being so that the identity signals gathered around it can be trusted.
In a typical remote check, three questions are answered in sequence. The document is examined to confirm that it is authentic and unaltered. The face on the document is compared with the face captured live to confirm that they belong to the same person. Liveness verification confirms that the captured face is a present, living individual rather than a spoof. Each step depends on the others: a genuine document matched to a spoofed face, or a live face matched to a forged document, leaves the overall check unreliable.
Active Versus Passive Liveness
Two broad approaches are in common use, and the difference is chiefly one of what the applicant is asked to do. Active liveness requires a deliberate action during capture — following an on-screen prompt, turning the head, blinking or reading a phrase — and infers presence from the response. It provides a clear, observable signal, but it adds steps to the journey and can frustrate applicants who must repeat an action that was not understood.
Passive liveness analyses the captured image or a short sequence of frames without asking the applicant to perform any task. Presence is inferred from properties of the sample itself, such as texture, depth cues and the characteristics of the capture. Because the applicant simply presents a face, the experience is shorter and the method gives less away about how it works, which can make it harder to rehearse against. Many platforms combine the two, applying passive analysis by default and reserving an active challenge for higher-risk cases.
The choice is not purely technical. A longer active flow may be acceptable for a high-value account but costly at the top of a consumer funnel, where abandonment rises with every additional step. Selecting a liveness approach is therefore a decision about risk appetite and conversion as much as about detection.
| Dimension | Active liveness | Passive liveness |
|---|---|---|
| Applicant action | A prompted movement or response is required | No action beyond presenting a face |
| Experience | Longer, with a small risk of repeated attempts | Shorter and largely invisible to the applicant |
| Signal | Presence inferred from the response to a challenge | Presence inferred from properties of the sample |
| Typical use | Higher-risk or step-up checks | Default capture at scale |
Presentation and Injection Attacks
The threats that liveness verification is expected to resist fall into two families, and the distinction has become central to how the control is evaluated. Presentation attacks show something to the camera: a printed photograph, an image or video played on a screen, a cut-out, or a three-dimensional mask. These are attacks on the sensor, and detection relies on distinguishing a real face from a reproduction placed in front of the lens.
Injection attacks bypass the camera altogether. Instead of presenting an artefact to a lens, the attacker inserts synthetic imagery — increasingly, a generated or manipulated video — directly into the capture pipeline, so that the system receives data that never passed through a physical sensor. The spread of accessible face-swapping and video-generation tools has made this category more prominent, and a liveness control that only examines what a camera sees may not detect it. Evaluating a provider now means asking how both families are addressed, not presentation attacks alone.
Note: Resistance to attacks is a moving target rather than a fixed property. As generation tools improve, detection has to be maintained and retested over time. Claims of perfect or permanent protection should be treated with caution; what matters is a documented, repeatable testing approach and a route for updates.
Where Liveness Sits in the KYC Flow
Liveness verification is one component of identity verification, not a substitute for it. In a fully remote flow it typically runs alongside document authentication and face matching, and its result is combined with them to produce a single verification outcome. A strong liveness signal paired with a weak document check does not make a reliable decision, and neither does the reverse.
The output of the biometric stage also feeds the wider compliance picture. Confirming that a real, identified person has been onboarded is the foundation on which screening depends: sanctions, politically exposed person and adverse-media checks are only meaningful when attached to a genuine individual. Liveness verification therefore connects the biometric capture at the front of onboarding to the AML screening controls that follow it, which is why the two are often evaluated together rather than in isolation.
Where Legichain Fits
Within Grumpio's identity tooling, liveness verification is a capability of Legichain, the product used for KYC verification and AML checks. Legichain performs selfie capture, liveness detection and face matching as part of a fully automated verification result delivered through an API and an accompanying SDK, so that presence and document-to-face comparison are handled within a single flow rather than assembled from separate tools. Age estimation and document verification sit alongside the same capture.
The result returned is automated: the platform produces a decision signal rather than a manual opinion. Any review beyond that automated result — case handling, escalation, or a decision to onboard a borderline applicant — remains the regulated firm's own function. Coverage of document types and regions is treated as something to confirm against the specific markets a firm serves rather than assumed to be universal. Pricing and configuration detail are kept off the page; the current position is held on the Legichain product site.
Boundaries and Responsibilities
Liveness verification is a strong control with clear limits. It confirms presence; it does not by itself prove identity, and it is not a substitute for full know-your-business (KYB) verification of a corporate customer, which follows a different path. Its effectiveness depends on capture conditions and on being kept current against new attack methods, and it forms one input to a decision that still rests with the firm and its wider regulatory readiness.
Grumpio's role is to implement these controls, not to opine on their legal sufficiency. We do not provide legal opinions or guarantee authorisation. We implement regulatory and audit requirements across technology, infrastructure and operations. Understood this way, liveness verification becomes one dependable, testable element of a KYC design rather than a claim of completeness.
Summary and Next Steps
Liveness verification answers a narrow but essential question in remote onboarding: whether the face being captured belongs to a real, present person. Combined with document authentication and face matching, it turns a set of images into a trustworthy identity signal, and it underpins the screening and monitoring that follow. Choosing an approach means weighing detection against applicant experience, and evaluating a provider now means asking about resistance to both presentation and injection attacks, backed by repeatable testing rather than assurances.
For teams designing or reviewing a KYC flow, the practical starting point is to map where liveness sits relative to document checks, face matching and downstream AML screening, and to define the risk levels at which an active challenge is warranted.
Design liveness into a verification flow that fits your risk and conversion goals. Grumpio implements identity and AML controls as one engineered pipeline.