If you build or maintain a remote onboarding flow, here is the uncomfortable part: most liveness checks are trained to spot what is in front of the lens (printouts, screens, masks). An injection attack skips the lens entirely and hands your app a clean synthetic stream through a virtual camera, an emulator or a rooted phone. This post walks through the two attack classes, why an ISO/IEC 30107-3 PAD certificate covers only one of them, and what Kazakhstan's banking regulator now explicitly requires from biometric authentication software since 12 July 2026.

Key takeaways

  • Two different attacks: presentation attacks (a physical object shown to the camera) vs. injection attacks (a synthetic stream fed in, bypassing the camera). PAD under ISO/IEC 30107-3 covers only the first by definition.
  • Injections grow fastest: iProov reports +1,151% injection attacks on iOS in H2 2025 year on year; Entrust reports +40% year on year and a deepfake behind one in five biometric fraud attempts.
  • Detectors are weaker than assumed: on real social-media deepfakes the best academic and government detectors reached at most 74.78% AUC on images and 73.67% on video (Purdue, October 2025). The widely quoted "67% of verification systems are vulnerable" figure does not exist.
  • The regulator now asks for anti-injection controls: Kazakhstan's joint ARDFM/National Bank resolution No. 39186 (in force since 12 July 2026), paragraph 7: self-integrity control, emulator detection, protection against built-in camera substitution.
  • Practical checklist: eight questions to ask a verification vendor are at the end.

Context: in January 2025, at the Digital Almaty forum, the head of the National Bank's National Payment Corporation showed how to bypass biometric identification with a printed face or a mask. According to Kursiv Media's report, 80% of bank accounts in Kazakhstan are opened online. Printouts and masks are yesterday's attacks; today's target the same camera with a generated face that blinks, turns and follows commands.

What a deepfake is

Kazakhstan's legislation does not use the word "deepfake", but it describes the phenomenon precisely. The Law "On Artificial Intelligence" defines synthetic outputs of artificial intelligence systems as "images, video, audio, texts or combinations thereof, created or modified by an artificial intelligence system, imitating the appearance, voice or behaviour of a natural person, or events that did not actually take place."

Technically there are two approaches. An autoencoder breaks a face down into a set of features and reassembles it on another person. Generative adversarial networks work as a pair: one model produces the fake, the other tries to detect it, and they train each other until the result is indistinguishable from the real thing.

There are three modalities: video, still image and voice. For identity verification the first two are critical, because they are what the camera sees during onboarding. Voice deepfakes hit a different channel: the call centre and phone confirmation of transactions.

Two scenarios are constantly mixed up in publications.

The first is deceiving a person. In January 2024 the Hong Kong office of engineering firm Arup lost HK$200 million, about US$25.6 million. An employee in the finance team received an email from the "CFO", had doubts, joined a video call and saw familiar colleagues there. Every participant except him was a deepfake built from public appearances and corporate recordings. The money left in fifteen transactions in a single day. Hong Kong police reported the case in February; the company identified itself as the victim only in May.

The Arup case shows the quality of real-time generation. But it is social engineering against a human, not an attack on an automated system: Arup's internal systems were not breached.

The second scenario is deceiving a machine. On the other side is a liveness-check algorithm, and the rules change.

Kazakhstan's cases: so far they target the customer

In Kazakhstan, documented deepfake attacks mostly follow the first scenario, exploiting people's trust in a familiar face.

What Kazakhstan does not have yet: a publicly documented case in which a deepfake passed bank biometrics and ended in a conviction. There is the demonstration of methods at Digital Almaty, there are regulator warnings, and there are fraud statistics in general: KZT 16.4 billion in damage from cybercrime in 2025, according to Zhandos Suinbay, head of the Interior Ministry's cybercrime department. There is no separate "deepfake" line in the statistics of the Interior Ministry and the Prosecutor General's Office: such episodes are not counted separately.

The absence of a conviction does not mean the absence of attacks. It means we are not counting them.

What happens when the face is fake

A classic liveness check solves one task: making sure a live person is in front of the camera, not an image of them. The system looks at skin texture, micro-expressions, scene depth and changes in lighting. A framed photo does not provide these signals. A screen playing a video gives itself away with glare and moiré. A silicone mask, with unnatural dynamics.

A generative deepfake breaks this logic, because it is not an image of someone else's face but the synthesis of a new one. It blinks. Its lighting changes. It responds to a "turn your head" command if the attack runs in real time.

Deepfake detectors perform worse than commonly assumed. In October 2025 researchers at Purdue University published a benchmark on real deepfakes from social media rather than lab datasets. The best academic and government detectors reached at most 74.78% AUC on images and 73.67% on video. All tested systems generalised poorly to new data and were vulnerable to simple manipulations, especially on video.

Two caveats. The study tested synthetic-media detectors on political clips from social networks, not identity-verification systems at onboarding: a different domain. And paid commercial detectors did better than free ones in the same test, although they also failed to carry their results over to real-world clips.

A claim has spread on Russian-language sites that "a Purdue University study showed 67% of verification systems are vulnerable to synthetic faces". That number does not exist. The original source turned out to be a vendor's sponsored piece that does not contain it, and the study itself contains neither the claim nor even the subject: it is about deepfake detectors, not identity-verification systems.

Two different attacks that are constantly confused

Presentation attack. The attacker shows the camera a physical object: a printout, another device's screen, a silicone mask, a 3D head model. The camera works normally and honestly captures what is in front of it. Defence against these attacks is called PAD, presentation attack detection; colloquially, a liveness check.

Injection attack. The physical camera is not involved at all. A synthetic video stream is fed straight into the app via a virtual camera, a device emulator, API interception, a rooted smartphone or tampering in the channel. The system receives a perfect picture that never passed through a lens.

In the first case the system analyses what got into the frame. In the second there was no frame, and a detector trained to catch screen glare and silicone texture is useless: it has been handed a clean signal.

Injections are growing fastest:

  • According to the iProov 2026 report, injection attacks on iOS grew by 1,151% in the second half of 2025 year on year, with annual growth of 741%. In the first half of 2025 growth was only 14%.
  • Entrust, in its 2026 report, its seventh annual one: injection attacks rose 40% year on year, and a deepfake is behind one in five biometric fraud attempts. Deepfake selfies grew 58% in 2025. The company does not disclose the sample period; it describes its coverage as more than a billion verifications in 195 countries and more than thirty industries.
  • Gartner surveyed 302 security leaders from March to May 2025: 62% of organisations had faced a deepfake attack within twelve months involving social engineering or exploitation of automated processes. The main channel is the call: voice more often, video slightly less often.

Why a PAD certificate covers only half the question

The industry standard for anti-spoofing testing is ISO/IEC 30107-3, current edition 2023. It describes how to test PAD mechanisms and report the results, and introduces the APCER (share of missed attacks) and BPCER (share of genuine customers falsely rejected) metrics.

The standard's scope is explicitly limited to attacks that happen at the biometric capture device at the moment of presentation. Injection attacks are outside it by definition.

PAD Level 1, 2 and 3 are not ISO levels but lab testing levels based on the standard's methodology. The artefact budget is set by the lab: at iBeta, a Level 1 artefact costs no more than $30 (printouts, photos, video on a screen), a Level 2 artefact no more than $300 (silicone masks and custom-made items).

All of this is about presentation to the camera. A solution with a PAD Level 2 certificate and no injection detection covers half of the attack surface, and the half that is growing more slowly. The question to ask a vendor is different: what happens to a stream that never went through the camera?

What Kazakhstan's regulator already requires

The joint resolution of the Board of the Agency for Regulation and Development of the Financial Market (ARDFM) No. 99 of 26 June 2026 and the Board of the National Bank No. 72 of 29 June 2026, registered with the Ministry of Justice on 2 July 2026 under No. 39186, has been in force since 12 July 2026. It sets the rules of biometric authentication for financial and payment organisations.

Paragraph 7 requires the software to implement "at a minimum the following protective measures: self-integrity control, a check for running in an emulated environment, protection against substitution of the device's or computer's built-in camera". The regulator does not use the word "injection", but it describes protection against exactly that: the emulator and camera substitution are the two main vectors.

What else the resolution sets out:

  • A legal definition of Liveness Detection (paragraph 2): a technology confirming the presence of a live natural person by analysing dynamic, volumetric, lighting and other characteristics of the image in real time.
  • Authentication is performed using a face image (paragraph 5). Several outlets wrote about palm biometrics as an adopted norm, but the palm is not in the registered version; it was in the April draft.
  • At least three signals or commands aimed at producing visual changes in the frame, followed by analysis of the video stream for inconsistencies. A mismatch restarts the procedure, and "three unsuccessful repetitions mean a negative result" (paragraph 8).
  • A 95% threshold of reliability and match to the reference for an image to enter the national biometric authentication system (paragraph 23).
  • Video recordings kept for at least five years from the end of the business relationship (paragraph 21).
  • The result is certified by the electronic digital signature of the biometric authentication provider.

Paragraph 24 lists five cases in which a bank must go through the National Bank's Identification Data Exchange Centre (TsOID): remote account opening; creating an e-signature and issuing a certificate; exceeding a bank-loan amount; first-time registration in the bank's mobile app or website; and other cases under the AML/CFT internal-control requirements. For microfinance organisations a similar requirement applies when a microloan exceeds a set size (paragraph 29), and for payment organisations, to e-money system operators (paragraph 30).

The obligation to verify a customer remotely with biometrics also exists in the AML/CFT internal-control rules: ARDFM resolution No. 18 of 22 March 2020 requires two-factor identification with biometric authentication via TsOID when establishing business relationships remotely, and storage of the session recording for at least five years.

Along the way the regulator changed its terminology: ARDFM resolution No. 54 of 3 April 2026, which repealed the previous 2024 rules, now speaks of biometric authentication rather than identification, that is, confirming the identity of a known customer rather than establishing the identity of an unknown one.

The AI law: labelling and fines

Kazakhstan's Law "On Artificial Intelligence" No. 230-VIII of 17 November 2025 came into force on 18 January 2026. Article 21 allows synthetic outputs to be distributed only if they are labelled in machine-readable form and accompanied by a visual or other warning that the user can perceive without special effort. Responsibility for informing users lies with the owners and holders of AI systems.

The sanction is in the new Article 641-1 of the Code of Administrative Offences: for failing to inform users about synthetic outputs, 15 MCI for individuals, 20 for small businesses and non-profits, 30 for medium and 100 for large businesses. A repeat violation within a year: 30, 50, 70 and 200 MCI respectively, with suspension or prohibition of the AI system's operation.

With the 2026 monthly calculation index (MCI) at KZT 4,325, that is from KZT 64,875 for an individual to KZT 432,500 for a large business, and up to KZT 865,000 for a repeat violation. The amounts are small; the real sanction is suspending the system.

There is no separate offence in the Criminal Code for creating a deepfake: the words "deepfake", "synthetic" and "artificial intelligence" do not appear in the code at all. Mazhilis deputy Yekaterina Smyshlyayeva said criminal liability could be introduced as part of the AI bill, but it did not make it into the adopted text. Fraud using a deepfake is prosecuted under existing offences.

What to ask a verification vendor

Eight questions worth asking a vendor before signing a contract:

  1. Do you detect video-stream injection separately from the liveness check? If the answer boils down to "we have strong liveness", that is not an answer.
  2. How do you detect a virtual camera and an emulator? The requirement of paragraph 7 of resolution No. 39186 is not a wish; it is in force.
  3. Is there app-integrity control on the customer's device? A rooted or compromised smartphone is a working injection vector.
  4. What are your stated accuracy percentages based on? Internal testing, an independent lab and a public benchmark are three different things. Ask for the methodology and sample size.
  5. Which metrics do you disclose? APCER and BPCER say more than a single "accuracy" figure, which hides the balance between missed attacks and rejected genuine customers.
  6. How are the three commands and the three-failed-attempts rule implemented? A direct requirement of paragraph 8.
  7. What goes into the log, and how is it stored for five years? Paragraph 21 requires storing video recordings, not just the result.
  8. What happens with coerced verification? The customer is real, alive and in the frame, but acting under pressure.

The last point often drops out of the discussion, although for retail lending it matters more than many technical details.

What to do now

Resolution No. 39186 has been in force since 12 July 2026. If your remote authentication flow was built before that date, check three things: is running in an emulated environment blocked, is substitution of the built-in camera detected, and are three commands with video-stream analysis implemented?

If even one of these has no answer, that is not a reason to switch vendors tomorrow. It is a reason to ask them the eight questions above and see what they say about injections.

This material is for information only and is not legal advice. Legal requirements change: consult a lawyer before making decisions.

Written by the Biometric.Vision team (biometric verification). This is an English adaptation of a Russian-language article on our blog, without the product section. Originally published at biometric.vision.