How to Fight AI Fraud and Deepfakes in Biometrics

A video call showing the face of the CFO, a voice identical to that of a relative, a selfie that passes verification without the real person, a recorded interview.  Deepfakes have left the labs and entered the daily routine of fraudsters. Combating this type of attack requires greater complexity, with security layers that complement each other, and none of them works alone. In this article, you’ll see how deepfakes work, how deepfake detection operates internally, where liveness fails, and how fingerprint biometrics on mobile devices strengthen defenses.

Deepfake Meaning: What Are Deepfakes?

The term deepfake combines deep learning with fake. It refers to any image, video, or audio that an artificial intelligence (AI) model generates or alters to imitate a real person with a high degree of realism. With millions of photos available on social media, fraudsters have an easier job. The technology swaps faces, synchronizes lips with invented speech, clones voices, and, in its latest versions, creates entire people who never existed.

Fraud becomes a concern when synthetic content stops fooling only the human eye and begins to fool automated security systems, such as an app’s identity verification.

How Does a Deepfake Maker or Deepfake Creator Work?

A deepfake maker or deepfake creator brings together, in a simple interface, fraud‑generation models that previously required research teams. Autoencoders learn to encode a face and reconstruct it with another person’s expressions. Generative networks put a generator against a discriminator until the result fools the evaluator — meaning the image is so well‑made that it will likely pass as real in a security system. Diffusion models refine noise into coherent images and videos, and voice models copy timbre and intonation from just a few seconds of audio.

The critical point for security is access. Commercial apps and open‑source tools reduce the technical barrier, and real‑time versions swap faces during a video call. Therefore, defense starts from the premise that attackers have strong fraud tools.

What Types of Fraud Do Deepfakes Enable?

Criminals use deepfakes in four main areas:

• Account opening: presenting a synthetic or swapped face to pass remote verification.
• CEO fraud: imitating a boss’s voice or video to order urgent transfers.
• Relationship scams: cloning the victim’s relative or friend.
• Injection attacks: sending synthetic video directly to the app through a virtual camera, without ever filming a screen or photo.

How Does Deepfake Detection Work?

Deepfake detection systems look for traces left by the generation process.

• Spatial domain: analyzing facial edges, skin texture, and eye reflections.
• Frequency domain: identifying periodic patterns produced by generator upsampling layers.
• Temporal domain: measuring coherence between frames, blinking, micro‑expressions, and head movement.

Some detectors also check lip‑to‑phoneme synchronization to catch fraudulent videos.

These detectors have known limits: a model trained on one generator usually performs worse against a new generator, and each improvement in generation reduces the traces they look for. Treat results as a risk score, not a verdict, and retrain models continuously with recent samples.

Why Liveness Alone Is Not Enough Against Deepfakes

Traditional liveness (facial liveness) works well against presentation attacks, where the fraudster shows a photo, screen, or mask to the camera. ISO/IEC 30107‑3 defines how to test this defense and which metrics to use, including attack acceptance rate and legitimate user rejection rate.

Injection attacks bypass this layer because synthetic video enters the digital flow before any physical sensor. The CEN/TS 18099 technical specification addresses detection of this attack type. In practice, the capture SDK must verify app integrity, detect virtual cameras, emulators, and rooted devices, and use active‑lighting challenges, where the screen projects a color pattern onto the face and the system checks the expected reflection. A prerecorded or generated video that doesn’t know the challenge cannot reproduce the reflection.

How Fingerprint Biometrics on Mobile Devices Help Fight Deepfakes

Fingerprint biometrics change the game because they no longer depend on images exposed on social media. Fingerprints are rarely accessible to fraudsters,  no one posts their fingerprints online. The user captures the fingerprint with the phone camera, and secure software (a biometric engine) compares the reading with the model stored locally. A video or voice clip cannot pass this software, and even if a fraudster injects a fingerprint through a virtual camera, it won’t match the real person’s.

Digital biometrics serve as both a possession factor and a presence factor: the person must physically be using the device. This closes a gap left open by remote facial verification.

Learn about our biometric solutions to protect your APP, visit our home page or contact us through WhatsApp (link below).

How to Integrate Mobile Fingerprint Biometrics Without Exposing the Fingerprint

Use native system interfaces, which keep the biometric model inside secure hardware and deliver only the result to the app.

• On Android, BiometricPrompt with strong authenticators and a CryptoObject ties authentication to a Keystore key.
• On iOS, the Secure Enclave stores the key, and access policy requires biometric authentication at the moment of use.

In both cases, the server receives a cryptographic signature, not a simple success response that an attacker could forge.

The FIDO2 standard with passkeys organizes this flow. The device generates a key pair during enrollment, the server stores the public key, and each sensitive operation requires a signature that only the owner’s fingerprint unlocks. If the company registers the key right after facial verification with liveness, it links the verified identity to the device.

Fingerprints can be captured with the phone camera, just like liveness, so they can be authenticated against public and private databases.

How to Build a Layered Defense Against Deepfakes

Combine factors that an attacker is unlikely to fake simultaneously. At onboarding, use facial verification with active and passive liveness, document validation, and injection protection. Then bind the device with a passkey and require local fingerprint biometrics for routine access. In parallel, analyze risk signals such as location, typing speed, device history, and transaction value, and request an extra step when the combination looks unusual.

For human processes, define rules that do not depend on recognizing a face or voice. Confirm payment requests through a second known channel, adopt a security word between executives and finance teams, and forbid changes to banking data via video call or audio. When available, use content provenance credentials, such as the C2PA standard, which record the origin and edits of media.

How to Measure and Test Effectiveness Against Deepfakes

Measure attack acceptance rate and legitimate user rejection rate by device model, system version, and region, because camera and lighting conditions affect results. Conduct periodic intrusion tests with new deepfakes and injection attacks, and record what gets through. Adjust thresholds with a small portion of traffic before rolling out to everyone.

Where Should Your Team Start?

Start with the highest‑impact risk. Map the flows where a false identity causes the greatest damage, such as account opening, device replacement, and high‑value payments. Then add injection detection and active liveness at onboarding, and passkeys with fingerprint biometrics for subsequent access. Measure for thirty days, adjust, and only then expand defense to other flows.

Want to reade another article on biometrics ? What are Deepfakes and How they Affect Your Biometrics