Screen Recapture Attacks: Detecting Fake Documents in Canada KYC

A screen recapture attack is a document-fraud technique in which a fraudster photographs or films a screen displaying a fraudulent or stolen identity document, instead of submitting the physical original, to slip past upload and liveness checks during remote onboarding. It is cheap, requires no editing skill at the point of submission, and works against any KYC flow that only checks whether an image looks like a document — not whether it was captured from a real, physical object.

Compliance teams hardened against Photoshop edits and printed forgeries are often unprepared for this vector, because the underlying document may itself be genuine. Manual review catches only 37% of fraud cases and takes an average of 87 days to detect them, according to the ACFE 2024 Report to the Nations — a gap recapture attacks are built to exploit, since they leave no visible sign for a human reviewer.

What Is a Screen Recapture Attack?

A screen recapture attack replaces the step where a customer photographs a physical ID with a photograph of that same document displayed on a monitor, tablet, or phone screen. The fraudster's own camera or webcam then captures the screen, and that second-generation image is submitted as if it were a direct photo of the original.

The technique serves two fraud goals: presenting a stolen or purchased document image — from a data breach, a marketplace, or a leaked ID — without possessing the physical item, or laundering an edited document, since screen glare, camera noise, and a second compression pass can partially mask the pixel-level editing traces a tool like Photoshop leaves behind.

Industry analysis of eKYC fraud groups screen recapture together with printouts under the umbrella of "recapture attacks," documenting that resizing, printing, screen display, and camera noise can each weaken the forensic signals a prior edit would otherwise leave behind (FacePP, "Screenshots, Printouts, and Recapture Attacks"). Recapture is therefore a separate attack surface from editing, not a subset of it.

Why Screen Recapture Attacks Bypass Basic Upload Checks

A recapture attack defeats checks that only ask "does this image look like a valid document," because a well-lit, high-resolution photo of a screen can pass that test cleanly. OCR extraction, field-format validation, and barcode or MRZ parsing operate on visual content — they have no reason to fail on a document that reads correctly, regardless of what physical surface the camera was pointed at.

The gap is structural: a pipeline built around content correctness answers a different question from one built around capture authenticity — was this image taken of a genuine physical object, in one step, by the presenting camera — a distinction now documented in recaptured-image research using vision transformers on screen-recapture datasets (arXiv, "Domain Generalized Recaptured Screen Image Identification"). Two attack modes compound the problem: recapturing a stolen but genuine document with no editing at all, or editing it first and recapturing it specifically to blur the artefacts a tool like error level analysis would otherwise flag.

This is precisely the gap FINTRAC has flagged for remote onboarding: simply viewing an identity document over a video call is not, on its own, sufficient — the information must be corroborated through an additional means, such as a live selfie or video stream matched against the document photo. Screen recapture defeats that corroboration step directly, since a selfie matched against a photograph of a screen is validating a forgery.

Moiré Pattern Analysis: The Core Forensic Signal

Moiré pattern analysis is the primary forensic technique for detecting screen recapture, because interference between a digital screen's pixel grid and the capturing camera's sensor grid produces a visible wave-like distortion absent when photographing a physical, non-emissive surface. This interference pattern is documented well enough to train dedicated detection models — the "mID" research at USENIX Security 2021 traced screen photos specifically through their moiré signature (Cheng et al., USENIX Security 2021).

A screen renders an image as a fixed grid of self-illuminating pixels; a camera sensor samples that grid through its own array of photosites at a different pitch and, often, a different orientation. Where the two periodic structures overlap, the mismatch produces beat frequencies visible as faint wavy or crosshatched bands that shift with viewing angle, screen type, and camera resolution.

Moiré is the hardest recapture signal to eliminate at the point of attack: a fraudster can control lighting and framing, but eliminating moiré requires a screen-camera combination that happens to avoid the interference condition, or post-processing that itself introduces detectable smoothing artefacts.

Complementary Signals: Glare, Bezel Geometry, and Lighting Uniformity

A screen-emitted image differs from a physical document on reflection behaviour, edge geometry, and light source consistency — three signals that, combined with moiré, form the standard recapture-detection signal set (Mitek, "Document Liveness Detection").

• Screen glare and specular reflection: an LCD or OLED panel produces a sharp, often rectangular hotspot from ambient light, and its own backlight creates unnaturally even illumination — paper and plastic show more localised, textured reflections instead.
• Bezel and edge geometry: a visible screen edge, rounded device corner, taskbar, or cursor at the frame boundary is a direct tell, even with tight cropping; subtler cases show distortion consistent with photographing a flat emitter at an angle rather than a document on a surface.
• Lighting inconsistency: a mismatch between the light apparently illuminating the document — actually the screen's backlight — and the light in the surrounding capture environment at the frame edges. Genuine photos show one consistent light source; recaptures often show two.

No individual signal is reliable in isolation against an attacker who knows what reviewers check — combining them is what makes the detection hold up.

Presentation Attack Detection (PAD) vs Injection Attack Detection (IAD)

Screen recapture belongs to the Presentation Attack Detection family, not Injection Attack Detection — a distinction that determines which part of a pipeline must catch it. PAD covers physical attacks presented in front of a camera — printed photos, masks, screen recaptures — while IAD covers software attacks that bypass the camera and inject manipulated video into the data stream; national qualification frameworks such as France's ANSSI PVID scheme require both attack families to be tested (LSTI, PVID Certification).

A vendor holding ISO/IEC 30107-3 certification has demonstrated PAD resistance, the relevant standard for screen recapture, but that says nothing about IAD resistance and vice versa. Ask which family a stated certification actually covers. Our liveness detection guide covers the same PAD/IAD split for facial biometrics.

ISO/IEC 30107-3 and Independent Testing

ISO/IEC 30107-3 is the international reference standard for testing anti-spoofing and presentation-attack-detection systems, defining the metrics vendors and auditors use to score PAD performance. Its three core metrics — APCER (rate at which attacks are wrongly classified as genuine), BPCER (rate at which genuine presentations are wrongly rejected), and IAPMR (rate at which an attack successfully matches an enrolled identity) — give compliance teams a common language for comparing vendor claims (ISO/IEC 30107-3).

Independent audit matters because self-reported PAD performance is not verifiable. iBeta Level 3 conformance under ISO/IEC 30107-3 is currently the highest independently audited liveness standard, and testing at that level now explicitly includes AI-generated face attacks alongside printed photos, masks, and screen replays (Entrust, eIDAS 2 resource). A vendor's ISO 30107-3 confirmation letter — not a marketing claim of "ISO compliance" — is the artefact worth requesting during procurement.

Document recapture detection is a related but distinct discipline from face-liveness PAD testing: ISO 30107-3 was written primarily for biometric presentation attacks, and document recapture detection borrows its metric framework without an equivalent document-specific ISO standard of its own.

Canadian Regulatory Framework: PCMLTFA, FINTRAC, and the Photo ID Method

Reporting entities conducting remote identity verification for AML purposes in Canada operate under the PCMLTFA and FINTRAC's identification requirements. FINTRAC authorizes five ways to verify identity — a government-issued photo ID, a credit file with three-plus years of history, a dual-process check across two independent sources, verification through an affiliate, or reliance on another entity's prior verification — and in digital onboarding, the photo ID method dominates: a customer scans a document such as a Canadian passport, provincial driver's licence, or Permanent Resident Card, the system authenticates it, and a live selfie is matched against the document photo. Screen recapture attacks exactly this step: a screen photograph accepted in place of the physical document means every check that follows — authentication, selfie match — is run against a forgery.

FINTRAC's guidance on non-face-to-face client identification recognizes document-based verification as acceptable when properly corroborated — but that assumes the underlying capture is genuine, and firms should confirm what attack types, including screen recapture, a vendor's checks actually cover. Under PIPEDA, images and any embedded biometric data captured during onboarding remain sensitive personal information regardless of whether the capture is later flagged, so retention should follow the safeguard obligations set out in OPC guidance on processing biometrics. In Quebec, Loi 25 imposes stricter biometric-data requirements than PIPEDA alone, including a documented privacy impact assessment before deployment.

International Comparison: eIDAS 2 and ETSI TS 119 461

The EU's eIDAS 2 framework and the European Digital Identity Wallet require identity-proofing services to bind biometric checks against both deepfakes and physical presentation attacks, with ETSI TS 119 461 emerging as the certification standard operationalising this requirement, including explicit coverage of injection-attack protection alongside presentation-attack resistance (Entrust, eIDAS 2 resource). Canadian reporting entities are not bound by eIDAS 2, but any organization onboarding EU-resident customers should expect their EU counterparts' identity-proofing stack to test against recapture and injection attacks as a matter of certification, not vendor discretion — a Canadian firm relying solely on FINTRAC's non-face-to-face guidance for its domestic flow may find that standard falls short of what an EU-facing partner expects.

Building Recapture Detection into a KYC Pipeline

Recapture detection works best as one layer inside a broader document-verification stack, not a standalone gate, because no single forensic signal survives every evasion attempt on its own. CheckFile addresses recapture attempts through multi-layer analysis (structural, metadata, cross-document consistency), with an AI-generation signals layer deployed as an additional layer according to client configuration, and latency calibrated for interactive KYC workflows.

A submitted image passes through structural checks (moiré, glare, bezel geometry), metadata review — comparable to the checks used against EXIF-manipulated document photos — and cross-document consistency scoring, before any OCR result is trusted, since a document can be both edited and recaptured. Banks and lenders running high-volume remote onboarding typically apply this layer within the workflows covered in our banking KYC and equipment financing and leasing solution pages — see security and pricing for details on hosting, certification, and cost.

No solution achieves 100% detection. CheckFile increases coverage by combining structural analysis, metadata review and AI-generation signals as a complement to your existing controls — see our approach to AI-generated and forged document detection for the full methodology, and our broader document verification guide for how recapture detection fits alongside the other checks in a complete onboarding flow.

Frequently Asked Questions

What is a screen recapture attack in KYC verification?

A fraudster photographs or films a screen displaying a document — genuine, stolen, or edited — instead of photographing the physical original, and submits that image during remote identity verification. It bypasses checks that only validate document content, because a recaptured image can read correctly while never having come from a real physical object.

How is a screen recapture attack different from a printed forgery?

A printed forgery involves editing a document, printing it, then photographing the printout; a screen recapture skips printing and photographs a digital display instead. Both are presentation attacks, but they leave different traces — printouts show paper texture and ink patterns, screen recaptures show moiré interference, backlight glare, and bezel artefacts.

Can moiré pattern analysis be fooled?

Reducing moiré is possible with certain high-resolution screens or precise viewing angles, but eliminating it entirely is difficult, and post-capture smoothing often introduces its own detectable artefact. This is why moiré analysis is deployed alongside glare detection, bezel checks, and lighting-consistency analysis rather than as a standalone check.

Does ISO 30107-3 certification mean a vendor detects screen recapture?

Certification demonstrates PAD resistance in general, and screen recapture is a PAD attack type, but it typically applies to facial biometric liveness testing rather than document-image recapture specifically. Ask any vendor for their confirmation letter and the exact attack species tested — document recapture is a related but separate discipline from face-liveness PAD.

Does FINTRAC's photo ID method guarantee protection against recapture attacks?

No. The photo ID method sets requirements for which documents are acceptable and how the image must be authenticated and matched to a selfie, but it does not specify which presentation-attack sub-categories, including screen recapture, a given vendor's technology covers. Reporting entities should request the specific PAD test scope from any vendor before deployment.