Screen Recapture Attacks: How to Detect Fake Documents

A screen recapture attack is a document-fraud technique in which a fraudster photographs or films a screen displaying a fraudulent or stolen identity document, instead of submitting the physical original, to slip past upload and liveness checks during remote onboarding. It is cheap, requires no editing skill at the point of submission, and works against any KYC flow that only checks whether an image looks like a document — not whether it was captured from a real, physical object.

Compliance teams hardened against Photoshop edits and printed forgeries are often unprepared for this vector, because the underlying document may itself be genuine. Manual review catches only 37% of fraud cases and takes an average of 87 days to detect them, according to the ACFE 2024 Report to the Nations — a gap recapture attacks are built to exploit, since they leave no visible sign for a human reviewer.

What Is a Screen Recapture Attack?

A screen recapture attack replaces the step where a customer photographs a physical ID with a photograph of that same document displayed on a monitor, tablet, or phone screen. The fraudster's own camera or webcam then captures the screen, and that second-generation image is submitted as if it were a direct photo of the original.

The technique serves two fraud goals: presenting a stolen or purchased document image — from a data breach, a marketplace, or a leaked ID — without possessing the physical item, or laundering an edited document, since screen glare, camera noise, and a second compression pass can partially mask the pixel-level editing traces a tool like Photoshop leaves behind.

Industry analysis of eKYC fraud groups screen recapture together with printouts under the umbrella of "recapture attacks," documenting that resizing, printing, screen display, and camera noise can each weaken the forensic signals a prior edit would otherwise leave behind (FacePP, "Screenshots, Printouts, and Recapture Attacks"). Recapture is therefore a separate attack surface from editing, not a subset of it.

Why Screen Recapture Attacks Bypass Basic Upload Checks

A recapture attack defeats checks that only ask "does this image look like a valid document," because a well-lit, high-resolution photo of a screen can pass that test cleanly. OCR extraction, field-format validation, and barcode or MRZ parsing operate on visual content — they have no reason to fail on a document that reads correctly, regardless of what physical surface the camera was pointed at.

The gap is structural: a pipeline built around content correctness answers a different question from one built around capture authenticity — was this image taken of a genuine physical object, in one step, by the presenting camera — a distinction now documented in recaptured-image research using vision transformers on screen-recapture datasets (arXiv, "Domain Generalized Recaptured Screen Image Identification"). Two attack modes compound the problem: recapturing a stolen but genuine document with no editing at all, or editing it first and recapturing it specifically to blur the artefacts a tool like error level analysis would otherwise flag.

Moiré Pattern Analysis: The Core Forensic Signal

Moiré pattern analysis is the primary forensic technique for detecting screen recapture, because interference between a digital screen's pixel grid and the capturing camera's sensor grid produces a visible wave-like distortion absent when photographing a physical, non-emissive surface. This interference pattern is documented well enough to train dedicated detection models — the "mID" research at USENIX Security 2021 traced screen photos specifically through their moiré signature (Cheng et al., USENIX Security 2021).

A screen renders an image as a fixed grid of self-illuminating pixels; a camera sensor samples that grid through its own array of photosites at a different pitch and, often, a different orientation. Where the two periodic structures overlap, the mismatch produces beat frequencies visible as faint wavy or crosshatched bands that shift with viewing angle, screen type, and camera resolution.

Moiré is the hardest recapture signal to eliminate at the point of attack: a fraudster can control lighting and framing, but eliminating moiré requires a screen-camera combination that happens to avoid the interference condition, or post-processing that itself introduces detectable smoothing artefacts.

Complementary Signals: Glare, Bezel Geometry, and Lighting Uniformity

A screen-emitted image differs from a physical document on reflection behaviour, edge geometry, and light source consistency — three signals that, combined with moiré, form the standard recapture-detection signal set (Mitek, "Document Liveness Detection").

• Screen glare and specular reflection: an LCD or OLED panel produces a sharp, often rectangular hotspot from ambient light, and its own backlight creates unnaturally even illumination — paper and plastic show more localised, textured reflections instead.
• Bezel and edge geometry: a visible screen edge, rounded device corner, taskbar, or cursor at the frame boundary is a direct tell, even with tight cropping; subtler cases show distortion consistent with photographing a flat emitter at an angle rather than a document on a surface.
• Lighting inconsistency: a mismatch between the light apparently illuminating the document — actually the screen's backlight — and the light in the surrounding capture environment at the frame edges. Genuine photos show one consistent light source; recaptures often show two.

No individual signal is reliable in isolation against an attacker who knows what reviewers check — combining them is what makes the detection hold up.

Presentation Attack Detection (PAD) vs Injection Attack Detection (IAD)

Screen recapture belongs to the Presentation Attack Detection family, not Injection Attack Detection — a distinction that determines which part of a pipeline must catch it. PAD covers physical attacks presented in front of a camera — printed photos, masks, screen recaptures — while IAD covers software attacks that bypass the camera and inject manipulated video into the data stream; national qualification frameworks such as France's ANSSI PVID scheme require both attack families to be tested (LSTI, PVID Certification).

A vendor holding ISO/IEC 30107-3 certification has demonstrated PAD resistance, the relevant standard for screen recapture, but that says nothing about IAD resistance and vice versa. Ask which family a stated certification actually covers. Our liveness detection guide covers the same PAD/IAD split for facial biometrics.

ISO/IEC 30107-3 and Independent Testing

ISO/IEC 30107-3 is the international reference standard for testing anti-spoofing and presentation-attack-detection systems, defining the metrics vendors and auditors use to score PAD performance. Its three core metrics — APCER (rate at which attacks are wrongly classified as genuine), BPCER (rate at which genuine presentations are wrongly rejected), and IAPMR (rate at which an attack successfully matches an enrolled identity) — give compliance teams a common language for comparing vendor claims (ISO/IEC 30107-3).

Independent audit matters because self-reported PAD performance is not verifiable. iBeta Level 3 conformance under ISO/IEC 30107-3 is currently the highest independently audited liveness standard, and testing at that level now explicitly includes AI-generated face attacks alongside printed photos, masks, and screen replays (Entrust, eIDAS 2 resource). A vendor's ISO 30107-3 confirmation letter — not a marketing claim of "ISO compliance" — is the artefact worth requesting during procurement.

Document recapture detection is a related but distinct discipline from face-liveness PAD testing: ISO 30107-3 was written primarily for biometric presentation attacks, and document recapture detection borrows its metric framework without an equivalent document-specific ISO standard of its own.

UK Regulatory Framework: MLR 2017, the FCA, and the DVS Register

UK firms conducting remote identity verification for AML purposes must satisfy Regulation 28 of the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, which since HM Treasury and DSIT's February 2026 guidance can be met using a provider certified against the UK digital identity trust framework and listed on the GOV.UK Digital Verification Services (DVS) Register. Firms should confirm not just DVS Register listing, but what specific attack types — including screen recapture — a provider's certification scope actually covers, since listing alone does not specify PAD sub-category coverage.

The FCA's published findings on customer due diligence processes and controls recognise document-based and electronic verification, including conditional video identification, as acceptable CDD methods — but that recognition assumes the underlying capture is genuine. A firm relying on upload or video ID without a recapture-detection layer has a gap between what its process assumes and what its technology verifies. Under UK GDPR, images and any embedded biometric data captured during onboarding remain personal data regardless of whether the capture is later flagged as a recapture attempt, so retention should follow the same lawful-basis obligations set out in ICO guidance as any other onboarding image.

EU Comparison: eIDAS 2 and ETSI TS 119 461

The EU's eIDAS 2 framework and the European Digital Identity Wallet require identity-proofing services to bind biometric checks against both deepfakes and physical presentation attacks, with ETSI TS 119 461 emerging as the certification standard operationalising this requirement, including explicit coverage of injection-attack protection alongside presentation-attack resistance (Entrust, eIDAS 2 resource). UK firms are not bound by eIDAS 2, but any firm onboarding EU-resident customers should expect their EU counterparts' identity-proofing stack to test against recapture and injection attacks as a matter of certification, not vendor discretion — a UK firm relying solely on DVS Register listing may find its standard falls short of what an EU-facing partner expects.

Building Recapture Detection into a KYC Pipeline

Recapture detection works best as one layer inside a broader document-verification stack, not a standalone gate, because no single forensic signal survives every evasion attempt on its own. CheckFile addresses recapture attempts through multi-layer analysis (structural, metadata, cross-document consistency), with an AI-generation signals layer deployed as an additional layer according to client configuration, and latency calibrated for interactive KYC workflows.

A submitted image passes through structural checks (moiré, glare, bezel geometry), metadata review — comparable to the checks used against EXIF-manipulated document photos — and cross-document consistency scoring, before any OCR result is trusted, since a document can be both edited and recaptured. Banks and lenders running high-volume remote onboarding typically apply this layer within the workflows covered in our banking KYC and equipment financing and leasing solution pages — see security and pricing for details on hosting, certification, and cost.

No solution achieves 100% detection. CheckFile increases coverage by combining structural analysis, metadata review and AI-generation signals as a complement to your existing controls — see our approach to AI-generated and forged document detection for the full methodology, and our broader document verification guide for how recapture detection fits alongside the other checks in a complete onboarding flow.

Frequently Asked Questions

What is a screen recapture attack in KYC verification?

A fraudster photographs or films a screen displaying a document — genuine, stolen, or edited — instead of photographing the physical original, and submits that image during remote identity verification. It bypasses checks that only validate document content, because a recaptured image can read correctly while never having come from a real physical object.

How is a screen recapture attack different from a printed forgery?

A printed forgery involves editing a document, printing it, then photographing the printout; a screen recapture skips printing and photographs a digital display instead. Both are presentation attacks, but they leave different traces — printouts show paper texture and ink patterns, screen recaptures show moiré interference, backlight glare, and bezel artefacts.

Can moiré pattern analysis be fooled?

Reducing moiré is possible with certain high-resolution screens or precise viewing angles, but eliminating it entirely is difficult, and post-capture smoothing often introduces its own detectable artefact. This is why moiré analysis is deployed alongside glare detection, bezel checks, and lighting-consistency analysis rather than as a standalone check.

Does ISO 30107-3 certification mean a vendor detects screen recapture?

Certification demonstrates PAD resistance in general, and screen recapture is a PAD attack type, but it typically applies to facial biometric liveness testing rather than document-image recapture specifically. Ask any vendor for their confirmation letter and the exact attack species tested — document recapture is a related but separate discipline from face-liveness PAD.

Does being listed on the GOV.UK DVS Register guarantee protection against recapture attacks?

No. DVS Register listing confirms a provider meets the UK digital identity trust framework's general certification requirements, but it does not specify which presentation-attack sub-categories, including screen recapture, are covered. Firms relying on Regulation 28 of MLR 2017 should request the specific PAD test scope from any registered provider.