Screen Recapture Attacks: Detecting Fake Documents in AU KYC

A screen recapture attack is a document-fraud technique in which a fraudster photographs or films a screen displaying a fraudulent or stolen identity document, instead of submitting the physical original, to slip past upload and liveness checks during remote onboarding. It is cheap, requires no editing skill at the point of submission, and works against any KYC flow that only checks whether an image looks like a document — not whether it was captured from a real, physical object.

Compliance teams hardened against Photoshop edits and printed forgeries are often unprepared for this vector, because the underlying document may itself be genuine. Manual review catches only 37% of fraud cases and takes an average of 87 days to detect them, according to the ACFE 2024 Report to the Nations — a gap recapture attacks are built to exploit, since they leave no visible sign for a human reviewer.

What Is a Screen Recapture Attack?

A screen recapture attack replaces the step where a customer photographs a physical ID with a photograph of that same document displayed on a monitor, tablet, or phone screen. The fraudster's own camera or webcam then captures the screen, and that second-generation image is submitted as if it were a direct photo of the original.

The technique serves two fraud goals: presenting a stolen or purchased document image — from a data breach, a marketplace, or a leaked ID — without possessing the physical item, or laundering an edited document, since screen glare, camera noise, and a second compression pass can partially mask the pixel-level editing traces a tool like Photoshop leaves behind.

Industry analysis of eKYC fraud groups screen recapture together with printouts under the umbrella of "recapture attacks," documenting that resizing, printing, screen display, and camera noise can each weaken the forensic signals a prior edit would otherwise leave behind (FacePP, "Screenshots, Printouts, and Recapture Attacks"). Recapture is therefore a separate attack surface from editing, not a subset of it.

Why Screen Recapture Attacks Bypass Basic Upload Checks

A recapture attack defeats checks that only ask "does this image look like a valid document," because a well-lit, high-resolution photo of a screen can pass that test cleanly. OCR extraction, field-format validation, and barcode or MRZ parsing operate on visual content — they have no reason to fail on a document that reads correctly, regardless of what physical surface the camera was pointed at.

The gap is structural: a pipeline built around content correctness answers a different question from one built around capture authenticity — was this image taken of a genuine physical object, in one step, by the presenting camera — a distinction now documented in recaptured-image research using vision transformers on screen-recapture datasets (arXiv, "Domain Generalized Recaptured Screen Image Identification"). Two attack modes compound the problem: recapturing a stolen but genuine document with no editing at all, or editing it first and recapturing it specifically to blur the artefacts a tool like error level analysis would otherwise flag.

Moiré Pattern Analysis: The Core Forensic Signal

Moiré pattern analysis is the primary forensic technique for detecting screen recapture, because interference between a digital screen's pixel grid and the capturing camera's sensor grid produces a visible wave-like distortion absent when photographing a physical, non-emissive surface. This interference pattern is documented well enough to train dedicated detection models — the "mID" research at USENIX Security 2021 traced screen photos specifically through their moiré signature (Cheng et al., USENIX Security 2021).

A screen renders an image as a fixed grid of self-illuminating pixels; a camera sensor samples that grid through its own array of photosites at a different pitch and, often, a different orientation. Where the two periodic structures overlap, the mismatch produces beat frequencies visible as faint wavy or crosshatched bands that shift with viewing angle, screen type, and camera resolution.

Moiré is the hardest recapture signal to eliminate at the point of attack: a fraudster can control lighting and framing, but eliminating moiré requires a screen-camera combination that happens to avoid the interference condition, or post-processing that itself introduces detectable smoothing artefacts.

Complementary Signals: Glare, Bezel Geometry, and Lighting Uniformity

A screen-emitted image differs from a physical document on reflection behaviour, edge geometry, and light source consistency — three signals that, combined with moiré, form the standard recapture-detection signal set (Mitek, "Document Liveness Detection").

• Screen glare and specular reflection: an LCD or OLED panel produces a sharp, often rectangular hotspot from ambient light, and its own backlight creates unnaturally even illumination — paper and plastic show more localised, textured reflections instead.
• Bezel and edge geometry: a visible screen edge, rounded device corner, taskbar, or cursor at the frame boundary is a direct tell, even with tight cropping; subtler cases show distortion consistent with photographing a flat emitter at an angle rather than a document on a surface.
• Lighting inconsistency: a mismatch between the light apparently illuminating the document — actually the screen's backlight — and the light in the surrounding capture environment at the frame edges. Genuine photos show one consistent light source; recaptures often show two.

No individual signal is reliable in isolation against an attacker who knows what reviewers check — combining them is what makes the detection hold up.

Presentation Attack Detection (PAD) vs Injection Attack Detection (IAD)

Screen recapture belongs to the Presentation Attack Detection family, not Injection Attack Detection — a distinction that determines which part of a pipeline must catch it. PAD covers physical attacks presented in front of a camera — printed photos, masks, screen recaptures — while IAD covers software attacks that bypass the camera and inject manipulated video into the data stream; national qualification frameworks such as France's ANSSI PVID scheme require both attack families to be tested (LSTI, PVID Certification).

A vendor holding ISO/IEC 30107-3 certification has demonstrated PAD resistance, the relevant standard for screen recapture, but that says nothing about IAD resistance and vice versa. Ask which family a stated certification actually covers. Our liveness detection guide covers the same PAD/IAD split for facial biometrics.

ISO/IEC 30107-3 and Independent Testing

ISO/IEC 30107-3 is the international reference standard for testing anti-spoofing and presentation-attack-detection systems, defining the metrics vendors and auditors use to score PAD performance. Its three core metrics — APCER (rate at which attacks are wrongly classified as genuine), BPCER (rate at which genuine presentations are wrongly rejected), and IAPMR (rate at which an attack successfully matches an enrolled identity) — give compliance teams a common language for comparing vendor claims (ISO/IEC 30107-3).

Independent audit matters because self-reported PAD performance is not verifiable. iBeta Level 3 conformance under ISO/IEC 30107-3 is currently the highest independently audited liveness standard, and testing at that level now explicitly includes AI-generated face attacks alongside printed photos, masks, and screen replays (Entrust, eIDAS 2 resource). A vendor's ISO 30107-3 confirmation letter — not a marketing claim of "ISO compliance" — is the artefact worth requesting during procurement.

Document recapture detection is a related but distinct discipline from face-liveness PAD testing: ISO 30107-3 was written primarily for biometric presentation attacks, and document recapture detection borrows its metric framework without an equivalent document-specific ISO standard of its own.

Australian Regulatory Framework: the AML/CTF Act, AUSTRAC, and Tranche 2

Australian reporting entities verifying identity remotely under the AML/CTF Act 2006 must use reliable, independent data, per AUSTRAC's core guidance. That population grew sharply on 1 July 2026: Tranche 2 reforms brought lawyers, accountants, real estate agents, and precious-metals dealers into the regime, taking reporting entities from around 17,000 to roughly 90,000 within months — many onboarding remotely for the first time with no document-fraud tooling.

Non-face-to-face customers require additional verification to offset elevated identity-fraud risk; electronic checks against government records, or a myID credential under the Digital ID Act 2024, can satisfy this, but the file must record the method and why. That record is where recapture detection answers a question electronic verification cannot: matching a name against issuer records — the function of Australia's Document Verification Service and myID — says nothing about whether the image came from the document itself rather than a screen. A reporting entity that suspects a document is fraudulent or stolen — including one flagged by recapture forensics — must lodge a Suspicious Matter Report with AUSTRAC. Under the Privacy Act 1988 and the Australian Privacy Principles, onboarding images and biometric data remain personal — sensitive, where templates are involved — regardless of recapture status, so retention follows the same APP obligations as any other record.

International Comparison: eIDAS 2 and ETSI TS 119 461

The EU's eIDAS 2 framework and the European Digital Identity Wallet require identity-proofing services to bind biometric checks against both deepfakes and physical presentation attacks, with ETSI TS 119 461 emerging as the certification standard operationalising this, including explicit coverage of injection-attack protection alongside presentation-attack resistance (Entrust, eIDAS 2 resource). Australian firms are not bound by eIDAS 2, but any firm onboarding EU-resident customers should expect their EU counterparts' identity-proofing stack to test against recapture and injection attacks as a matter of certification, not vendor discretion — relying solely on AUSTRAC's electronic-verification requirements, without capture-authenticity checks, may fall short of what an EU-facing partner expects.

Building Recapture Detection into a KYC Pipeline

Recapture detection works best as one layer inside a broader document-verification stack, not a standalone gate, because no single forensic signal survives every evasion attempt on its own. CheckFile addresses recapture attempts through multi-layer analysis (structural, metadata, cross-document consistency), with an AI-generation signals layer deployed as an additional layer according to client configuration, and latency calibrated for interactive KYC workflows.

A submitted image passes through structural checks (moiré, glare, bezel geometry), metadata review — comparable to checks used against EXIF-manipulated document photos — and cross-document consistency scoring, before any OCR result is trusted, since a document can be both edited and recaptured. Banks and lenders running high-volume remote onboarding typically apply this layer within the workflows covered in our banking KYC and equipment financing and leasing solution pages — see security and pricing for details on hosting, certification, and cost.

No solution achieves 100% detection. CheckFile increases coverage by combining structural analysis, metadata review and AI-generation signals as a complement to your existing controls — see our approach to AI-generated and forged document detection for the full methodology, and our broader document verification guide for how recapture detection fits alongside the other checks in a complete onboarding flow.

Frequently Asked Questions

What is a screen recapture attack in KYC verification?

A fraudster photographs or films a screen displaying a document — genuine, stolen, or edited — instead of photographing the physical original, and submits that image during remote identity verification. It bypasses checks that only validate document content, because a recaptured image can read correctly while never having come from a real physical object.

How is a screen recapture attack different from a printed forgery?

A printed forgery involves editing a document, printing it, then photographing the printout; a screen recapture skips printing and photographs a digital display instead. Both are presentation attacks, but they leave different traces — printouts show paper texture and ink patterns, screen recaptures show moiré interference, backlight glare, and bezel artefacts.

Can moiré pattern analysis be fooled?

Reducing moiré is possible with certain high-resolution screens or precise viewing angles, but eliminating it entirely is difficult, and post-capture smoothing often introduces its own detectable artefact. This is why moiré analysis is deployed alongside glare detection, bezel checks, and lighting-consistency analysis rather than as a standalone check.

Does ISO 30107-3 certification mean a vendor detects screen recapture?

Certification demonstrates PAD resistance in general, and screen recapture is a PAD attack type, but it typically applies to facial biometric liveness testing rather than document-image recapture specifically. Ask any vendor for their confirmation letter and the exact attack species tested — document recapture is a related but separate discipline from face-liveness PAD.

Does using AUSTRAC's Document Verification Service or myID guarantee protection against recapture attacks?

No. They confirm a document's details match issuer records, or that a credential is government-verified — not that the image came from the physical document rather than a screen. Entities relying on electronic verification, especially for non-face-to-face customers, should pair it with recapture detection and record that choice.