Liveness Detection: Preventing Identity Spoofing with Face Verification Technology in Canada

Liveness detection is the technology that determines whether a face presented to a camera is a real, live person or a spoofing artefact — a printed photo, a video replay, a 3D mask, or a deepfake injected into the data stream. For Canadian financial institutions subject to FINTRAC oversight and PCMLTFA obligations, liveness detection is not a technical preference — it is the practical foundation for remote identity verification compliance.

Biometric liveness transactions are projected to exceed 50 billion annually by 2027. Companies lost over $200 million to deepfake fraud in Q1 2025 alone, and injection attacks rose 40% year-on-year. Canada's financial sector has seen rapid adoption of digital onboarding, making robust liveness detection a competitive and regulatory necessity.

For broader context on automated identity verification, see our guide to automated document verification. For sector trends, see our analysis of digital identity trends 2026.

What is liveness detection?

Liveness detection is an anti-spoofing layer that confirms a live human face is present before any biometric comparison. Without it, any facial recognition system is vulnerable to a high-quality photograph.

Active liveness detection asks the user to perform a real-time action: blink, turn their head, say a word. Vulnerability: modern deepfake tools synthesise facial movements in real time. First-attempt rejection rates reach 35% in unguided flows, generating abandonment and support load.

Passive liveness detection requires no user action. The system silently analyses skin micro-texture, specular light reflections, 3D depth cues, and remote photoplethysmography (rPPG — detecting blood flow from subtle colour variations). Leading implementations operate in under 300 milliseconds.

Passive liveness is now the industry standard for high-volume consumer KYC. One enterprise implementation documented 80% reduction in onboarding time and 65% drop in fraud when switching from active to passive liveness.

The emerging best practice is a hybrid approach: passive screening for all users, active challenge only for elevated risk signals.

The attack landscape

Presentation attacks

Injection attacks — the critical blind spot

Injection attacks bypass the camera entirely. A deepfake is fed directly into the data pipeline via virtual camera software. A system can be fully ISO 30107-3 certified and remain 100% vulnerable to injection attacks — because PAD covers only the sensor. ROC.ai tracked 8,065 injection attempts against a single financial institution in 8 months (2025). Effective protection combines PAD at the sensor level with IAD at the pipeline level.

ISO 30107-3: the global benchmark

ISO/IEC 30107-3 is the international standard for Presentation Attack Detection (PAD), tested by iBeta Quality Assurance (NIST-accredited):

A BPCER of 0.8% = 8,000 legitimate users rejected per million verifications. In January 2026, Yoti became the first company to achieve iBeta L3 (Biometric Update, January 2026). Demand iBeta confirmation letters at ibeta.com.

Canadian regulatory requirements

FINTRAC, PCMLTFA and remote identity verification

FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) is Canada's financial intelligence unit, operating under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). FINTRAC's compliance guidance recognises several methods for remote identity verification by reporting entities, including:

• Credit file method: identity confirmed against a Canadian credit file with Equifax or TransUnion
• Dual-process method: two independent reliable sources confirming name + date of birth + address
• Government-issued photo ID + liveness check: for digital identity verification with biometric confirmation

FINTRAC's 2021 guidance on digital identity and liveness verification explicitly recognises biometric liveness-verified selfie combined with government-issued photo ID as a compliant method for the Identify the individual provision of the PCMLTFA regulations. For high-risk clients, enhanced due diligence may require additional verification steps.

OSFI (Office of the Superintendent of Financial Institutions) provides supplementary guidance for federally regulated financial institutions on technology risk, including guidance on AI-based identity verification systems that references ISO 30107-3 as a technical benchmark.

PIPEDA, provincial privacy laws and biometric data

Facial biometrics are sensitive personal information under PIPEDA (Personal Information Protection and Electronic Documents Act) and its provincial equivalents (PIPA in Alberta and BC, Act respecting the protection of personal information in the private sector in Quebec — "Loi 25").

Loi 25 (Quebec's Law 25) — the Act to modernise legislative provisions as regards the protection of personal information, in force since September 2023 — imposes stricter requirements than PIPEDA for Quebec-based entities: mandatory privacy impact assessments (PIAs) for new technologies involving biometric data, explicit consent requirements, and the right to de-index personal information. Violations carry fines up to CAD $25 million or 4% of worldwide turnover.

The OPC (Office of the Privacy Commissioner of Canada) has published guidance on biometric data, noting that collecting facial biometrics requires a clear purpose and data minimisation — biometric templates should not be retained beyond the verification moment unless a documented legal basis exists.

eIDAS 2.0 cross-border context

Canadian companies operating in EU markets must understand eIDAS 2.0 liveness requirements. Technical standard ETSI TS 119 461 v2 (February 2025) governs EU identity proofing. A verification process conformant with ETSI TS 119 461 v2 simultaneously satisfies eIDAS 2.0, 6AMLD, and EU supervisory expectations — relevant for Canadian financial institutions with EU cross-border operations.

Key Canadian identity documents: Canadian passport, provincial driver's licence (issued by provincial DMVs), and the Permanent Resident Card (PR Card) for non-citizens. The Social Insurance Number (SIN) is the federal identifier for individuals, issued by ESDC — equivalent to the UK National Insurance number.

Common failure modes in Canadian deployments

Lighting remains the top cause of false rejections in home and office environments. A window behind the user creates back-light that overexposes the face and distorts texture analysis. Well-designed interfaces display a real-time lighting indicator.

Device variability affects users with budget Android devices disproportionately — a concern in Indigenous and remote communities with limited access to premium devices.

Active liveness confusion affects older users and non-native English/French speakers. First-attempt rejection rates reach 35% in unguided flows. Passive liveness eliminates this failure category.

Conversion impact is quantifiable: the biometric verification step causes 10–15% abandonment; complete KYC flow drop-off reaches 40–68% without optimisation.

Integrating liveness detection into a Canadian KYC process

A PCMLTFA-compliant remote onboarding flow combines three layers:

1. Document verification — OCR and validation of Canadian passport, provincial driver's licence, or PR Card
2. Liveness detection + facial matching — PAD + IAD at sensor and pipeline levels; facial comparison between document and live face
3. Regulatory screening — FINTRAC watchlists, OFAC SDN lists, UN sanctions, PEP screening, adverse media

Session binding is critical: systems must verify that liveness check and document capture belong to the same session, preventing split-session deepfake attacks.

CheckFile integrates all three layers in a single EU-hosted platform, ISO 27001 certified, with configurable PIPEDA/Loi 25 data handling. See our security page and pricing. For the broader automation framework, see our guide to automated verification.

Selecting a liveness detection solution for Canadian compliance

FAQ

What is liveness detection?

Liveness detection is an anti-spoofing technology that verifies a live human face is present during identity verification — not a photograph, video replay, mask, or injected deepfake. It operates before facial recognition comparison and is required for FINTRAC-compliant remote identity verification.

Does FINTRAC require liveness detection?

FINTRAC does not mandate a specific technology, but its guidance on digital identity explicitly recognises biometric liveness verification combined with government-issued photo ID as a compliant method for remote identity verification under PCMLTFA obligations.

Does liveness detection violate PIPEDA or Loi 25?

Not if implemented correctly. PIPEDA requires consent, purpose limitation, and data minimisation. Loi 25 additionally mandates privacy impact assessments for biometric data. Zero-retention of biometric templates after the verification moment significantly reduces privacy exposure. Document the legal basis for collection and the retention schedule in your privacy notice.

How does liveness detection handle French-language requirements in Quebec?

Quebec deployments must support French-language interfaces. All user-facing liveness instructions — whether active (blink, turn head) or passive (hold still) — must be available in French. This is both a legal requirement under the Charter of the French Language and a practical one for reducing active liveness rejection rates among French-speaking users.

What is the difference between active and passive liveness detection?

Active liveness asks the user to perform a real-time action (blink, turn head). Passive liveness analyses the face silently — no user action required. Passive is faster (under 300ms), causes significantly less abandonment, and is the industry standard for consumer-facing KYC in Canadian fintech deployments.