Deepfakes and identity verification

"Deepfake" covers a family of techniques — face swapping, face reenactment, full-face synthesis, voice cloning — that share one output: media in which a person appears to do or say something they did not. For identity verification, the relevant question is narrow and practical: can synthetic media pass the checks a verification flow performs? The honest answer is that against naive flows, yes, easily — and against well-designed flows, the attacker's job becomes very much harder in identifiable, testable ways.

This article walks through the attack surface as a verification engineer sees it, because the defences only make sense once the attacks are concrete.

• Replay: presenting prepared media to a genuine camera — a screen showing a synthesised video held up to the phone. Cheapest attack; defeated by the physics of re-photographing screens (moiré, reflectance, depth cues) plus challenge unpredictability.
• Injection: bypassing the camera entirely and feeding synthetic frames into the capture pipeline — via a virtual camera, instrumented app or emulator. Defeats naive apps completely, which is why device and app integrity matter more than image analysis.
• Real-time puppeting: driving a synthetic face live, so it can respond to challenges. The most capable attack — and the one that raises the attacker's cost from "run a script" to "defeat hardware attestation while rendering a challenge-consistent face with correct 3D geometry in real time".

Active liveness converts capture from a recording into a conversation. The app asks for actions — blink, turn your head, smile — chosen and ordered unpredictably, and verifies the response arrives with human timing and geometric consistency. Head rotation is particularly hostile to synthesis: a real head turning exposes changing 3D structure, lighting interaction and occlusion that 2D reenactment models struggle to hold consistent frame-to-frame.

The wallet capture app implements exactly this challenge set in its selfie stage. Liveness does not need to be perfect to be effective; it needs to force the attacker out of the replay category into real-time puppeting, where the remaining defences apply.

Injection attacks succeed when the verifier trusts frames without trusting their origin. The counter is attestation: the app proves it is the genuine, unmodified app running on an untampered operating system, using platform attestation APIs — Google Play Integrity on Android, App Attest on iOS. An attestation-gated capture session on a device with a hardware root of trust closes the virtual-camera route; the attacker now needs a compromised physical device, not a software trick.

At the Trusted level, the wallet adds hardware biometric capture — fingerprint or iris read inside the secure enclave. No amount of rendering reaches a sensor that measures a physical finger. This layering is deliberate: each level of assurance corresponds to attacks it rules out, which is also why higher-risk actions on the network require higher tiers.

The final defence is architectural. Once verification has happened under all the protections above, its output should be a cryptographic credential, not media. Services relying on the result verify a signature or a zero-knowledge proof — checks that deepfakes cannot touch, because no imagery is being judged. The worst pattern in industry is re-performing visual verification at every service; every repetition is another camera session an attacker can target, and another pile of stored selfies to breach.

Verify once, under hard conditions; reuse the result cryptographically everywhere else. That is the wallet's model — services receive answers, never images — and it means the deepfake battle is fought only at the strongest point in the system rather than at every weak one.

No verification system should claim deepfake immunity, and this one does not. Synthesis quality improves; attestation has had bypasses; sensors have been spoofed in laboratories. What a layered design claims is different and defensible: each attack class has a specific, testable counter; the layers multiply the attacker's cost; the system's outputs are auditable; and — because the code is open source — the defences can be inspected rather than taken on faith.