Biometric spoofing no longer depends on a printed photo held up to the camera. In 2026, the fastest-growing attacks come through software: virtual cameras, emulators, AI-generated videos, stolen identity data and fraud-as-a-service tools.
For banks, fintechs and any company that verifies identities remotely, this changes the approach. Good liveness detection is still necessary. But it is no longer enough on its own.
In this article we review which attack techniques are growing, which countermeasures work and what evidence you should ask a vendor for before trusting its technology.
What is biometric spoofing?
Biometric spoofing is any attempt to impersonate a person in front of a biometric system. It is an umbrella term that covers two distinct families of attacks.
Presentation attacks fool the sensor. The attacker places a photo, a screen playing a video or a mask in front of the camera.
Injection attacks bypass the sensor. The attacker feeds manipulated images or videos directly into the data stream, without going through the real camera.
The difference matters because each family needs its own defence. We explain it in detail in presentation attack vs. injection attack. Here we focus on what has changed this year.
Why the risk is scaling up in 2027
Industry data points in the same direction: attacks are shifting from the sensor to the software.
Goode Intelligence and Biometric Update forecast that annual injection attack attempts will grow from 122 million in 2026 to more than 301 million in 2028.
At the same time, deepfakes have spread beyond identity verification. In a Gartner survey of 302 cybersecurity leaders, 62% of organisations had suffered at least one deepfake attack in the previous 12 months that involved social engineering or exploited automated processes. 43% experienced one on audio calls and 37% on video calls.
Gartner anticipated this back in 2024. According to its analysis, presentation was the most common attack vector, but injection attacks had increased 200% in 2023. It predicted that by 2026, 30% of enterprises would no longer consider face-based identity verification and authentication solutions reliable in isolation. Akif Khan, VP Analyst at Gartner, explained why: current presentation attack detection standards and testing processes
“do not cover digital injection attacks using the AI-generated deepfakes that can be created today.”
Akif Khan, VP Analyst at Gartner (Gartner, 2024)
New biometric spoofing techniques
Physical techniques have not disappeared, but the growth is in software. These are the ones most worth watching.
More sophisticated physical artefacts
Printed photos, videos replayed on screens and 2D and 3D masks are still in use. Presentation attack detection, however, has matured. According to Kévin Carta, director of the CLR Labs laboratory, current systems are very good at detecting screens. That is why well-resourced attackers look for another route.
Virtual cameras
A virtual camera is software that the device treats as if it were real hardware. It allows the verification process to be fed with manipulated or AI-generated images. It is the first step laboratories test when they assess resistance to injection.
Emulators, rooted devices and hooking
Instead of a real phone, the attacker runs the app on an emulator. Or they use a rooted or jailbroken device to intercept images from the legitimate camera and replace them before they reach the server.
Laboratories already use this scale to measure how difficult an attack is. At the basic levels, they test virtual cameras and Android emulators. Next come rooted devices and hooking. At the high level, modifications to camera drivers, browsers or the operating system (Biometric Update).
Injected deepfakes and face swaps
Injection is usually the way a deepfake gets into a verification process. A system can detect a deepfake shown on a screen and still fail if the same video arrives directly in the data stream. We look at how to identify them in deepfake detection.
Stolen data and fraud as a service
Fraud is becoming industrialised. According to Europol’s IOCTA 2025, crime-as-a-service platforms offer everything from stolen data to step-by-step fraud tutorials. The result is a higher volume of attacks and attackers who need less technical knowledge. We analyse this in our Fraud Intelligence Report 2025 and in fraud as a service.
This table summarises each technique and the defence that stops it:
| Technique | Family | What stops it |
|---|---|---|
| Photo, screen or mask | Presentation | Passive or active liveness detection (PAD) |
| Virtual camera | Injection | Virtual camera detection and capture integrity |
| Emulator, root, jailbreak or hooking | Injection | Emulator detection and device integrity |
| Channel interception (man-in-the-middle) | Injection | Encryption and protection of the communication channel |
| Injected deepfake or face swap | Injection | Injection attack detection (IAD) and forensic image analysis |
| Reused stolen identity | Mixed | Device signals, behavioural biometrics and continuous monitoring |
Advanced countermeasures: a layered defence
No single anti-spoofing technology covers every vector. Gartner recommends combining presentation attack detection, injection attack detection and image inspection, and adding signals such as device identification and behavioural analysis. We also cover this in security levels for fraud protection.
Liveness detection against presentation attacks
Liveness detection checks that a real person is in front of the camera at that moment. It can be passive, with no action from the user, or active, with a gesture. A combined approach uses passive liveness at onboarding and for routine access, and adds active liveness when there is a device change, an anomaly or a risk alert. More detail in our Liveness Detection solution and in what liveness is and how it works.
Injection attack detection (IAD)
IAD does not analyse whether the face is real. It checks whether the images come from a genuine sensor and have not been tampered with along the way. Common techniques include detecting virtual cameras, emulators and tampered devices, protecting the channel and forensic analysis of each sample. We explain each one in how to detect injection attacks.
Facephi Injection Attack Defence works on three levels, integrated into the Facephi Identity Platform. The first protects the channel and the device: it blocks virtual cameras and detects pre-recorded media files. The second verifies the origin of the capture using metadata and digital watermarks. The third applies AI-based forensic analysis to detect synthetic artefacts and patterns typical of deepfakes.
“We can tell genuine images, with natural reflections on the skin, apart from manipulated ones (deepfakes) that are visually convincing but contain imperceptible artefacts. However, only a multi-layered approach detects attacks using stolen, unmanipulated samples.”
Javier Barrachina, R&D Director at Facephi
Device and behavioural signals
Some attacks leave no trace in the image. A remotely controlled session or an account opened with stolen data needs other signals. Behavioural biometrics analyses how a person types, taps the screen or moves the mouse, and compares it in real time with legitimate patterns.
Continuous identity
Spoofing does not end at onboarding. The same attacks target authentication, account recovery and device changes. That is why we verify at every risk point in the customer lifecycle, not just on day one.
Defences also need maintenance. As Kévin Carta points out, a new AI model appears every week, and attackers have access to the same advances.
How to evaluate an anti-spoofing solution
Before choosing a vendor, ask for independent evidence for each attack family, not just a general certification.
Ask for separate evidence for presentation and injection
ISO/IEC 30107-3 evaluates presentation attack detection. Laboratories such as iBeta apply it by difficulty level. But that certification says nothing about resistance to injection.
Injection has its own technical specification, CEN/TS 18099, approved by CEN in October 2024. Several laboratories already test against it. iBeta, one of the best known in PAD, began offering this testing in June 2026.
Alan Goode, CEO and chief analyst at Goode Intelligence, puts it this way: organisations are realising that
“traditional presentation attack detection alone is not sufficient against software-based attacks.”
Alan Goode, Goode Intelligence (Biometric Update, 2026)
If you operate in Europe, look to eIDAS
The eIDAS revision tightens remote identity verification. Commission Implementing Regulation (EU) 2025/1566 sets ETSI TS 119 461 V2.1.1 as the reference standard for verifying identity before issuing qualified certificates. It will apply from 19 August 2027.
The specification requires independent testing on three fronts:
| What is tested | What question it answers | Reference |
|---|---|---|
| Presentation attack detection | Can an attacker fool the camera? | PAD evaluation by an accredited laboratory |
| Injection attack detection | Can the camera be bypassed and manipulated data injected? | CEN/TS 18099 |
| Comparator performance | Does it compare faces accurately enough? | ISO/IEC 19795-1 |
For injection attack detection, testing by an accredited laboratory must be completed by the end of 2026, according to CLR Labs. Certification is also not a permanent seal: the full evaluation is repeated every two years.
Look at public evaluations
Evaluations by public bodies compare vendors using the same protocol. Two references are the NIST face presentation attack detection evaluation and the US Department of Homeland Security (DHS) RIVTD face liveness detection test.
Questions for the vendor
| Question | Why it matters |
|---|---|
| What PAD certification does it hold, with which laboratory and at what level? | The level shows how difficult the attacks it has passed were. |
| Has its IAD been evaluated against CEN/TS 18099? | Presentation certification does not cover injection. |
| How does it detect virtual cameras, emulators and tampered devices? | They are the fastest-growing injection routes. |
| How often does it update its models and repeat testing? | Attack tools change every week. |
| What signals does it use beyond the image? | Some fraud leaves no visual trace. |
| What is its rejection rate for legitimate users (BPCER)? | Security should not drive up friction. |
Our results in independent evaluations
Our liveness detection is certified by iBeta at levels 1 and 2 of ISO/IEC 30107-3.
In the NIST evaluation of 81 passive face presentation attack detection algorithms, we ranked first for printed photo and replay attacks, with an error rate for genuine users below 0.2%. In the DHS RIVTD test, our technology achieved a BPCER below 0.2%.
On injection, the 2026 Goode Intelligence and Biometric Update report places us in two categories: injection attack detection integrated into identity verification, and a standalone modular offering.
In summary
Biometric spoofing in 2026 is played out mainly in software. Liveness detection is still the foundation, but it needs injection attack detection, device and behavioural signals and constant review against new techniques.
If you are reviewing your verification process, talk to our team.
Frequently asked questions about biometric spoofing
What is biometric spoofing?
It is any attempt to impersonate a person in front of a biometric system. It includes presentation attacks, which fool the sensor with photos, screens or masks, and injection attacks, which feed manipulated images directly into the data stream.
What is the difference between a presentation attack and an injection attack?
A presentation attack places an artefact in front of the camera. An injection attack bypasses the camera and sends fake images or videos to the system through virtual cameras, emulators or interception. Each needs a different defence: liveness detection for the first and injection attack detection for the second.
Is liveness detection enough to stop biometric spoofing?
No. Liveness detection stops presentation attacks, but on its own it does not detect a video injected through a virtual camera. That is why it is combined with injection attack detection, device signals and behavioural biometrics.
What does ISO/IEC 30107-3 certify?
It evaluates presentation attack detection. Laboratories such as iBeta apply it by difficulty level. It does not cover injection attacks.
What is CEN/TS 18099?
It is the European technical specification for biometric data injection attack detection. CEN approved it in October 2024 and several laboratories already test against it. iBeta joined them in June 2026.
What does eIDAS require against biometric spoofing?
Commission Implementing Regulation (EU) 2025/1566 sets ETSI TS 119 461 V2.1.1 as the reference for identity verification by qualified trust service providers, applicable from 19 August 2027. The specification requires independent testing of presentation attack detection, injection attack detection and comparator performance.
Which biometric spoofing techniques are growing most in 2026?
Software-based ones: virtual cameras, emulators, devices tampered with through hooking, injected deepfakes and face swaps, and stolen identity data. Goode Intelligence forecasts that injection attempts will grow from 122 million in 2026 to more than 301 million in 2028.
How does Facephi protect against biometric spoofing?
With several layers: liveness detection certified by iBeta at levels 1 and 2, Facephi Injection Attack Defence to detect injection in real time, behavioural biometrics and continuous verification throughout the customer lifecycle.
