How do online services know I'm a real person and not just a recording?

When a verification flow looks at you through a front-facing camera and clears you in under a second, it is solving a deceptively hard problem: telling a living human apart from a high-resolution recording held up to the lens. For identity platform providers, the question of how to verify a real person online has moved from an academic curiosity to a frontline security requirement, because the same smartphone screen that captures a genuine selfie can just as easily display a stolen video. The methods that separate a live presence from replayed media are now the difference between a trustworthy onboarding pipeline and an open door for account takeover.

Injection attacks, in which fraudsters feed stolen or synthetic video directly into the verification pipeline rather than presenting it to a camera, rose sharply through 2024 and increasingly bypass legacy liveness checks built only for physical presentation, according to industry monitoring reported by Biometric Update (2024).

How to verify a real person online: the core signal problem

Every recording, no matter how sharp, is a flattened, re-encoded copy of reality. The discipline of telling live presence from playback is formally called Presentation Attack Detection (PAD), defined and benchmarked under the ISO/IEC 30107-3 standard, which specifies how vendors measure and report a system's ability to resist spoofs. A Presentation Attack Instrument (PAI) can be a printed photo, a paper mask, a silicone mask, or a video replayed on a phone or monitor. The LivDet-Face 2024 competition, documented in the NSF Public Access Repository, benchmarked detection systems against exactly this spectrum, with video replay among the headline attack types.

Knowing how to verify a real person online comes down to finding signals that a recording cannot fully reproduce. Those signals fall into three broad families:

• Behavioral signals: involuntary or prompted motion such as blinking, micro head movement, and gaze shifts.
• Physiological signals: evidence of blood flow, skin elasticity, and tissue depth that only living tissue produces.
• Artifact signals: moire patterns, screen bezels, compression noise, reflections, and color banding introduced by a display or printout.

A recording can satisfy one family while failing another. A replayed video may show a blink, but it will also carry the screen's reflection signature. A printed photo has flawless texture but no pulse. Robust systems fuse several signal families rather than betting on one.

Active versus passive approaches

The market splits along a single design axis: whether the user has to do anything. Active methods ask the person to perform a challenge such as blinking, smiling, or turning their head, then check whether the response matches the prompt. Passive methods analyze a single image or a short, normal-looking capture and reach a decision without instructions. Each carries different tradeoffs for security, accessibility, and abandonment.

Detection approach	What it measures	Strength against recordings	User friction	Notable weakness
Active challenge-response	Prompted blink, smile, head turn	Defeats static photos and old loops	High; explicit user action	Pre-recorded or deepfake video can mimic the prompt
Passive texture and artifact analysis	Moire, reflections, compression noise	Catches screen and print replays	None; single capture	Needs strong models for high-end displays
rPPG pulse detection	Blood-flow color change in skin	Recordings lack a live cardiac signal	None; passive	Sensitive to lighting and motion
3D depth and geometry	Facial volume and parallax	Flat screens and prints fail depth	Low to medium	Specialized hardware or motion needed
Injection-attack defenses	Camera integrity, device signals	Stops media bypassing the lens	None	Requires secure capture pipeline

The table makes the central lesson plain: no single method is sufficient. A system that relies only on a blink prompt is vulnerable to a deepfake that blinks on cue, while a system that relies only on texture can be fooled by a pristine 4K display. Layering is the design pattern that holds up.

Industry applications

eKYC and financial onboarding

Banks and fintech platforms run remote identity proofing at the moment of account opening, when fraud risk peaks. Here the priority is stopping a fraudster who holds a video of a victim's face up to the camera or injects that video into the data stream. Passive liveness detection is favored because it reduces drop-off during a high-stakes funnel while still binding the live person to a government ID. The Display Replay Attack Dataset published by Axon Labs, with more than 9,000 videos aligned to iBeta Level 1 testing, exists precisely to train models against monitor-based replays in these flows.

Government identity and remote proofing

State agencies and identity platforms serving the public sector treat live-presence detection as a baseline for remote credentialing. Because these populations are broad and non-technical, challenge-response prompts can exclude users who struggle to follow instructions. Passive techniques that verify a real person online without asking them to blink or turn their head improve equitable access while preserving assurance, which aligns with the high-assurance identity proofing expectations that public-sector buyers increasingly cite.

High-risk authentication and recovery

Account recovery and step-up authentication are favorite targets because they grant access to existing, funded accounts. A recording of the legitimate user, scraped from social media, is the obvious attack tool. Pulse-based and depth-based signals are valuable here because they fail closed against any flat playback regardless of resolution.

Current research and evidence

The most active research frontier is remote photoplethysmography (rPPG), which measures the tiny color changes in skin caused by blood flowing beneath it. Because a recording on a screen carries no live cardiac signal, a verified pulse is strong evidence of a living subject. A foundational patent, "3D mask face anti-spoofing with remote photoplethysmography" (Google Patents, US10380444B2), established the principle that even a convincing silicone mask suppresses the rPPG signal a live face emits.

Recent work has pushed this further. The "Deep Guard" framework combines a Swin Transformer with rPPG signals to detect spoofing, and the "DepthPulse" passive liveness framework, presented at the BDRC Cybersecurity Conference, pairs depth estimation with pulse extraction to catch presentation attacks without user action. A broad review in Frontiers (2024) on deep learning and remote photoplethysmography documents rapid gains in extracting reliable pulse signals from ordinary webcams, while also flagging the open challenge: accuracy under varied lighting, motion, and skin tones. That robustness gap is the difference between a lab result and a production system.

The independent benchmarks matter as much as the algorithms. ISO/IEC 30107-3 provides the measurement language, and competitions like LivDet-Face 2024 provide adversarial pressure. Buyers should read claims of resistance to recordings only in the context of which PAIs were tested and at what scale.

The future of live-presence verification

Two forces are reshaping the field. The first is the rise of injection attacks, where synthetic or stolen video is fed straight into the application, bypassing the camera entirely. As reported by Biometric Update (2024), this shifts part of the defense burden from analyzing the face to verifying the integrity of the capture device and channel. The future of how to verify a real person online will treat the camera, the pipeline, and the biometric signal as one trust chain rather than three separate problems.

The second force is generative AI. Deepfakes can now produce video that blinks, smiles, and turns on command, which erodes the value of behavioral challenge-response on its own. The countermove is toward passive physiological signals that synthetic media still struggles to fabricate convincingly, such as a consistent pulse waveform and physically accurate depth. Expect production systems to converge on multi-signal fusion, continuous rather than one-shot checks, and tighter binding between the device and the verified human.

Frequently asked questions

Can a high-resolution video fool a liveness check? A sharp recording can defeat naive systems that only look for a single cue like a blink. Modern PAD layers texture analysis, screen-artifact detection, depth, and rPPG pulse signals, so a flat playback fails one or more checks even when it passes others. Resistance depends on which methods a system fuses, not on resolution alone.

What is the difference between active and passive liveness? Active liveness asks the user to perform an action, such as turning their head, and confirms the response. Passive liveness reaches a decision from a normal capture with no instructions. Passive approaches reduce abandonment and improve accessibility, while strong systems may combine both depending on risk level.

How does measuring a heartbeat help verify a real person online? Remote photoplethysmography detects subtle skin-color changes from blood flow. A recording or mask does not produce a live cardiac signal, so a detectable, consistent pulse is evidence of a living subject. Research frameworks like Deep Guard and DepthPulse use this signal as part of passive spoof detection.

What is an injection attack and why does it matter? An injection attack feeds stolen or synthetic video directly into the verification software, skipping the physical camera. It matters because liveness checks designed only for physical presentation may never see the spoof, so defenses now extend to camera integrity and pipeline verification.

Circadify is building toward this multi-signal future, with passive liveness that confirms a real human from a normal camera capture, no blink or head turn required. Identity platform teams evaluating how to strengthen anti-spoofing across replay and injection attacks can review the technical integration details in the fraud detection integration guide.