Go back

Presentation Attack

An attempt to fool a biometric sensor with fake inputs. Includes printed photos, replay videos, 3D masks, and screen-displayed deepfakes. Targets the capture point. Defended by Presentation Attack Detection (PAD).

Presentation Attack

A presentation attack is any attempt to deceive a biometric capture device — camera, microphone, fingerprint reader — by presenting fabricated, altered, or replayed biometric data.

Why this matters

It is the original spoofing vector against biometric authentication and remains the baseline threat IDV systems must withstand.

Standardized under ISO/IEC 30107, presentation attacks are the reference category for biometric anti-spoofing benchmarks and certification.

Modern attackers combine presentation attacks with synthetic media, raising both the realism and the scale at which spoofing is possible.

Deepfake expansion

ISO/IEC 30107 distinguishes presentation attack instruments (PAIs) by type: artefacts (masks, photos), conformant impostors, and replays of captured biometrics.

Deepfake-rendered faces shown on phone or tablet screens have become a dominant high-quality PAI for face biometrics, replacing printed photos in sophisticated attacks.

For voice biometrics, replay attacks using high-fidelity speakers and cloned audio now compete with traditional impersonation as the primary spoofing method.

Control gaps

Biometric matching alone, without authenticity checks, accepts any input that resembles the enrolled subject — including spoofs.

Hardware-based PAD requires specific sensors (depth, NIR) that many remote IDV deployments do not have.

Software-only PAD trained on older PAI sets degrades against new deepfake-rendered or 3D-printed artefacts.

Mitigation

Deploy ISO/IEC 30107-3 compliant Presentation Attack Detection that covers current PAI categories, including deepfake screen-replays.

Layer active and passive liveness with deepfake detection on the captured pixel stream so spoof artefacts are caught even when liveness signals are weak.

Pair sensor-side PAD with injection-attack detection upstream so presentation defenses are not bypassed by camera-emulation attacks.

FAQ

Questions we get asked most

Are deepfakes illegal?

Deepfakes themselves are not inherently illegal, but their use can be. The legality depends on the context in which a deepfake is created and used. For instance, using deepfakes for defamation, fraud, harassment, or identity theft can result in criminal charges. Laws are evolving globally to address the ethical and legal challenges posed by deepfakes.

How do you use deepfake AI?

Deepfake AI technology is typically used to create realistic digital representations of people. However, at DuckDuckGoose, we focus on detecting these deepfakes to protect individuals and organizations from fraudulent activities. Our DeepDetector service is designed to analyze images and videos to identify whether they have been manipulated using AI.

What crime is associated with deepfake creation or usage?

The crimes associated with deepfakes can vary depending on their use. Potential crimes include identity theft, harassment, defamation, fraud, and non-consensual pornography. Creating or distributing deepfakes that harm individuals' reputations or privacy can lead to legal consequences.

Is there a free deepfake detection tool?

Yes, there are some free tools available online, but their accuracy may vary. At DuckDuckGoose, we offer advanced deepfake detection services through our DeepDetector API, providing reliable and accurate results. While our primary offering is a paid service, we also provide limited free trials so users can assess the technology.

Are deepfakes illegal in the EU?

The legality of deepfakes in the EU depends on their use. While deepfakes are not illegal per se, using them in a manner that violates privacy, defames someone, or leads to financial or reputational harm can result in legal action. The EU has stringent data protection laws that may apply to the misuse of deepfakes.

Can deepfakes be detected?

Yes, deepfakes can be detected, although the sophistication of detection tools varies. DuckDuckGoose’s DeepDetector leverages advanced algorithms to accurately identify deepfake content, helping to protect individuals and organizations from fraud and deception.

Can you sue someone for making a deepfake of you?

Yes, if a deepfake of you has caused harm, you may have grounds to sue for defamation, invasion of privacy, or emotional distress, among other claims. The ability to sue and the likelihood of success will depend on the laws in your jurisdiction and the specific circumstances.

Is it safe to use deepfake apps?

Using deepfake apps comes with risks, particularly regarding privacy and consent. Some apps may collect and misuse personal data, while others may allow users to create harmful or illegal content. It is important to use such technology responsibly and to be aware of the legal and ethical implications.

Your KYC was built for humans. Attackers stopped sending humans.

Synthetic faces. Cloned voices. Documents generated in the time it takes to read this sentence. DuckDuckGoose is the detection layer that catches what liveness can't — on every image, video, and audio your platform sees.