Why Liveness Detection Matters
Video KYC has fundamentally changed how Indian financial institutions verify customer identities. Instead of requiring a physical branch visit, banks and NBFCs can now onboard customers through a live video interaction with a trained agent. But this convenience introduces a critical vulnerability: how do you confirm that the person on the other side of the camera is a real, physically present human being and not a photograph, a pre-recorded video, or a sophisticated deepfake?
This is the problem that liveness detection solves. Liveness detection is a set of technologies and techniques designed to verify that the biometric sample being captured -- in this case, a face on a video feed -- belongs to a live person who is physically present at the time of verification. Without robust liveness detection, a Video KYC system is vulnerable to presentation attacks where fraudsters use printed photos, screen replays, 3D masks, or AI-generated deepfakes to impersonate someone else.
The Reserve Bank of India recognized this risk early. In its V-CIP (Video-based Customer Identification Process) guidelines, the RBI mandates that regulated entities must implement adequate measures to ensure the person being verified is physically present and not using any form of spoofing. Liveness detection is not optional -- it is a regulatory requirement for any institution conducting Video KYC in India.
Active vs Passive Liveness Detection
Liveness detection broadly falls into two categories: active and passive. Each approach has distinct advantages and trade-offs, and the most effective Video KYC systems use both in combination.
Active Liveness Detection
Active liveness requires the user to perform specific actions in response to on-screen prompts. Common challenges include asking the user to blink, smile, turn their head left or right, nod up and down, or read a randomly generated number aloud. The system verifies that the user's response matches the expected action in real time. Because the prompts are randomized, a pre-recorded video or static photograph cannot respond correctly. Active liveness is highly effective against basic presentation attacks and is straightforward for users to understand. However, it can create friction in the user experience, especially for elderly or less tech-savvy customers. It also adds time to the verification session -- typically 15 to 30 seconds per challenge.
Passive Liveness Detection
Passive liveness operates silently in the background without requiring any user interaction. The system analyzes the video feed for natural biological signals that are impossible to fake with a static image or simple video replay. These include subtle skin color fluctuations caused by blood flow beneath the skin (a technique called remote photoplethysmography or rPPG), natural micro-movements of the face and eyes, the way light reflects off real skin versus a flat surface, and depth cues that differentiate a three-dimensional face from a two-dimensional screen or printout.
Passive liveness offers a seamless user experience since the customer does not need to perform any special actions. It runs continuously throughout the video session, providing ongoing verification rather than a single point-in-time check. The downside is that passive systems require more sophisticated algorithms and higher computational resources, and they may be less effective in poor lighting conditions or with low-quality cameras.
How Deepfakes Threaten Video KYC
While printed photos and screen replays are relatively easy to detect, deepfake technology represents a far more sophisticated threat. Deepfakes use generative AI models to create realistic synthetic video in real time, allowing a fraudster to appear as someone else during a live video call. The fraudster feeds a target person's photographs into a face-swapping model, which then maps the target's facial features onto the fraudster's face in real time via the webcam feed.
Modern deepfakes can respond to active liveness challenges -- the fraudster can blink, smile, and turn their head while the AI maps the target's face onto these movements. This makes traditional active liveness checks alone insufficient against advanced attacks. The threat is not theoretical: industry reports indicate that deepfake-based identity fraud attempts targeting financial services in India grew by over 300% between 2024 and 2025, driven by freely available open-source tools that require minimal technical expertise.
Combating deepfakes requires a new generation of liveness detection that goes beyond simple challenge-response checks. Systems must analyze the video feed at a pixel level for artifacts that are invisible to the human eye but detectable by specialized AI models.
3D Depth Analysis and Challenge-Response
One of the most effective techniques for defeating both traditional presentation attacks and deepfakes is 3D depth analysis. Using monocular depth estimation algorithms, the system can infer the three-dimensional structure of a face from a standard 2D camera feed. A real face has natural depth contours -- the nose protrudes, the eye sockets are recessed, the cheeks curve outward. A photograph or screen replay appears completely flat, and even high-quality deepfakes often fail to accurately reproduce natural depth relationships.
Advanced systems combine 3D depth analysis with dynamic challenge-response to create an extremely robust verification layer. For example, when the user is asked to turn their head to the right, the system not only checks that the head turned but also verifies that the depth map changed in a manner consistent with a real 3D head rotation. A deepfake overlay on a flat screen will produce depth anomalies during movement that a real face would not.
Some systems also use structured light or infrared illumination to enhance depth sensing, though this requires specialized hardware. For Video KYC applications where customers use their own smartphones or laptops, software-based monocular depth estimation is the more practical approach. With recent advances in neural network architectures, software-based depth estimation has achieved accuracy levels comparable to dedicated depth sensors, making it viable for production Video KYC deployments.
RBI Requirements for Liveness in V-CIP
The RBI's V-CIP framework does not prescribe specific liveness detection technologies, but it sets clear expectations for outcomes. Regulated entities must ensure that the person appearing in the video is physically present and is the same person whose identity documents are being verified. The guidelines require that the video interaction be conducted in real time with no pre-recorded segments, that the customer's live photograph be captured and matched against the photo on their identity document, and that the entire session be recorded with an auditable trail.
The RBI's Master Direction on KYC (updated 2025) further specifies that institutions must have "robust technology infrastructure" to prevent fraud during digital verification. While the regulation does not name specific technologies like passive liveness or 3D depth analysis, the intent is clear: any Video KYC system must be able to detect and prevent spoofing attempts. Institutions that fail to implement adequate anti-spoofing measures risk regulatory penalties and, more critically, exposure to identity fraud.
In practice, most RBI auditors now expect to see documented evidence of liveness detection capabilities during compliance reviews. This includes details of the specific techniques used, accuracy metrics from testing, and incident logs showing how spoofing attempts were detected and handled. Financial institutions should treat liveness detection not as a technical checkbox but as a core component of their fraud prevention strategy.
How BASEKYC Implements Multi-Layer Liveness
BASEKYC takes a defense-in-depth approach to liveness detection, combining multiple independent verification layers that run simultaneously during every Video KYC session. The first layer is passive liveness, which continuously monitors the video feed for biological signals including rPPG-based pulse detection, natural micro-expression patterns, and skin texture analysis. This layer runs silently and produces a continuous liveness confidence score without any customer interaction.
The second layer is intelligent active challenges. Rather than using a fixed set of prompts, BASEKYC's system dynamically selects challenges based on the risk profile of the session and the results of the passive analysis. If the passive layer detects any anomaly, additional active challenges are triggered automatically. The system tracks not just whether the user completed the challenge, but how they completed it -- analyzing response timing, movement naturalness, and depth consistency.
The third layer is AI-powered deepfake detection, which analyzes the video stream for GAN artifacts, face boundary inconsistencies, and audio-visual synchronization mismatches. This layer uses models trained on the latest deepfake generation techniques and is retrained regularly to stay ahead of evolving threats.
All three layers feed into a unified fraud risk score that is displayed to the verification agent in real time. The agent can see at a glance whether the system has detected any liveness concerns, and the system can be configured to automatically terminate sessions that exceed a risk threshold. After each session, a detailed liveness analysis report is generated for audit and compliance purposes, documenting every check that was performed and its result. This multi-layer approach ensures that BASEKYC catches spoofing attempts that single-technique systems miss, while maintaining a smooth experience for legitimate customers.