A fraudster shows the camera a photo, a screen with a video, a mask or a face replaced by a neural network in real time. NeuroVision checks live presence (Liveness), looks for signs of generation and face swapping on the selfie and for filming from a screen, and matches the face between the steps of a single session. The widget captures only with the camera — a ready-made file cannot be uploaded to it.
Face check within a single KYC session
The price follows the price matrix on the publication date. The time of a check with Liveness depends on how quickly the user completes the tasks
A presentation attack is shown to the camera: a photo, a screen, a mask. An injection bypasses the camera: a virtual camera or an emulator feeds the check a ready-made video. A deepfake is about the content of the frame: a face generated or replaced by a neural network. It can be shown from a screen or delivered by injection — which is why several layers work against it at once.
The cheapest attack: a printed photo, a picture from social media, a photograph on a second phone. They have no depth or live movement, and a printout shows signs of being a copy.
What covers it:
A recording of someone else's face is played on a tablet or monitor in front of the camera (replay), sometimes with blinking and head turns. Liveness does not accept a screen with a video, and the selfie check looks for signs of filming from a screen and from a mobile device.
What covers it:
Paper, cardboard and silicone masks, three-dimensional head models. This is more expensive and rarer, but these are designed to pass the face's "volume". According to the documentation, Liveness rejects an attempt to pass the check wearing a mask.
What covers it:
A program replaces the device's camera, and the check receives a pre-prepared or generated video. There may be nobody in front of the lens at all. The widget's restrictions and controls on your side (the block below) work against such attacks. More in the article «How the video stream is substituted in KYC».
What covers it:
The check is passed not on a real phone but in an emulator or on a device with a modified system — this way the attack can be repeated hundreds of times. The number of attempts and the session lifetime are limited, and the same face with different data is visible in the session history.
What covers it:
A neural network overlays someone else's face on the fraudster's face right in the video (face swap) or generates the entire face. Such a frame is checked by three layers at once: Liveness, the search for signs of generation and face swapping on the selfie, and face matching between the steps of the session.
What covers it:
Protection against face substitution is not a single model but several checks in one session. Each covers its own class of attacks, and passing one does not replace the others. The set of steps and checks is defined in the scenario without developers.
The user takes the check in the widget, and the system analyses a series of frames: movement, texture, artefacts. A photo, an on-screen recording and a mask are not accepted — the session receives the refusal "The image did not pass the Liveness check", and the user can try again.
A separate selfie check looks for signs that the face was created by a neural network or replaced with another. If it triggers, the step fails with the code "the face shows signs of generation or swapping", and this is visible in the session card in the personal account.
Selfie checks flag a picture taken from a monitor or phone screen, a photocopy and a cropped frame. Sessions where other faces appear in the selfie frame can additionally be blocked.
The faces from Liveness, the selfie and the photo in the document are compared in pairs. If the face in Liveness and on the selfie belong to different people, the session immediately receives the status "suspicious" and is closed — it is not possible to swap the person between steps.
Camera only, no file upload
In the widget it is not possible to pick a ready-made photo or video from the gallery: the selfie and Liveness are captured by the camera at the moment of the check. Ready-made images are accepted only by the REST API — your server sends them, and you control that channel yourself.
HTTPS and allowed domains only
The widget runs only on secure pages and only on the domains listed in the personal account. It is not possible to embed your check into a third-party intermediary site and push a prepared stream through it.
Short session lifetime and attempt limit
The session lifetime is set in the scenario — from 15 minutes to 6 hours — and the number of attempts is limited. A "working" deepfake cannot be found by trial and error within one session: once the attempts are used up, a new one is needed.
Recording of the Liveness check
In the scenario you can enable video recording of the Liveness check. A disputed or suspicious session is reviewed by the security team from the recording rather than from a single frame.
On your side: open the check in the system browser or in the WebView of your application, do not accept selfies from other channels, and compare the device and network with the user's usual behaviour.
How virtual cameras, emulators and camera call interception work — in the article «How the video stream is substituted in KYC».
The mode is set in the scenario and changed without development. The choice is a trade-off between protection and how many users get to the end of the check.
The widget asks the user to turn their head, look at a point or perform a sequence of movements. The system checks that the commands were carried out by a live person at the moment of capture. A pre-recorded video has a harder time guessing the order of the tasks.
One or several frames are enough: the user simply looks at the camera, and the system looks for signs of live presence itself. Fewer refusals on weak devices and among those who find it hard to perform movements. How the modes work and what the standard says about them — in the article «Liveness Detection: what it is and how the liveness check works».
For issuing a loan, withdrawing money, restoring access and changing a phone number — active mode and face matching between steps. For sign-up with low limits you can start with passive and strengthen the check at the first signals.
A scenario can consist of documents only. In that case it is not confirmed that the document is presented by its owner, and there is no protection against deepfakes at all. This makes sense only at low risk.
A typical "document + selfie + Liveness" scenario. Steps can be reordered and disabled in the scenario editor. How the whole onboarding process works — on the page «Digital customer onboarding»
The user photographs a passport or another document with the camera. The system recognises the fields and checks for signs of forgery: a screen, a copy, editing, a pasted-in photo. The owner's photo from the document is saved for matching at the following steps.
The selfie is checked for signs of face generation and swapping, filming from a screen or phone, a photocopy and a cropped frame. This is where generated faces and photos of another person from a monitor are filtered out.
The user takes Liveness in the mode set in the scenario. A photo, a video from a screen and a mask are not accepted. Video recording of the check can be enabled on request.
The faces from Liveness, the selfie and the document are compared in pairs. Different people in Liveness and on the selfie — the status is "suspicious" and the session is closed. The result reaches your server by webhook and is visible in the personal account; the decision about the customer is made by your service.
ISO/IEC 30107-3 terms
The ISO/IEC 30107 series describes biometric presentation attack detection (PAD), and its part 3 describes how to test such systems and how to report the result. The tester prepares a set of attacks of varying complexity — from a printout to a mask — and counts two errors: how many attacks the system took for a live face and how many live people it rejected. In Russia the national version of part 3 is in force — GOST R 58624.3-2019.
ISO/IEC 30107-3 concerns attacks that are shown to the camera. Video stream injections are not part of it: Europe has adopted a separate specification for them, CEN/TS 18099, and the international standard ISO/IEC 25456 is under development. If a vendor refers to test results, find out the laboratory, the set of attacks, the date and the algorithm version — and remember that a laboratory result does not replace control over the real stream.
A fraudster needs face substitution where, after the check, access to money, an account or a job opens up. In these scenarios Liveness and the selfie check are placed at the step after which a mistake costs the most.
There is no separate law on deepfakes in Russia as of October 2026. For a face check, something else matters more: the rules for processing biometrics, the role of the Unified Biometric System and how fraud involving identity substitution is classified. Below is a guide for a conversation with a lawyer.
Does not identify in place of the Unified Biometric System
Liveness and the selfie check do not replace remote identification through the state services portal and the Unified Biometric System where the law requires it. NeuroVision helps to make sure that a live person is in front of the camera, while the decision about the customer remains yours.
Does not check voice and video calls
Voice deepfakes, "director" calls and video meetings with a substituted participant are a different channel. The check works in the widget or through the API, not inside a video call.
Does not promise a hundred per cent
Deepfake generators change faster than standards. Sessions with the status "suspicious" need to be reviewed manually, and the scenario revised based on the statistics of refusals and errors in the personal account.
Does not prove intent
A Liveness refusal or signs of substitution on the selfie are a reason for a repeat check or review, not proof of fraud. An honest user can also fail the check in poor light or with an old camera.
How a business can build protection against deepfakes beyond onboarding — in the article «What is a deepfake: how it works and how to protect yourself».
If a customer does not pass Liveness, advise them: good light, the whole face in the frame, no glasses with glare, tasks done as shown on the screen.
No subscription fee: you pay for the KYC sessions carried out. A selfie and Liveness cost the same in the package — the mode is selected in the scenario.
Document recognition and anti-fraud, selfie or Liveness, a selfie check for signs of deepfake and filming from a screen, face matching within the session. At 10 000 sessions a year — 33 ₽, and the price falls as volume grows.
on request
Everything from the "Document + liveness" package plus checks against Russian databases in one session. The composition and price are tailored to your volume.
Prices follow the price matrix on the publication date. Test access — 1 month.
The face check runs in the NeuroVision cloud or in your own perimeter. The scenario, the Liveness mode and the selfie checks are changed in the personal account without development.
1-month test, a personal manager, support under contract, payment per session.
Terms from standards, API documentation and scenario settings.
The project «Development of a multimodal system using artificial intelligence "Neuromed" for managing the diagnostic processes of a clinic on the basis of the "Neurovision" computer vision platform» is supported by the Innovation Promotion Foundation within the federal project «Domestic Solutions»
The Neurovision computer vision platform is registered with Rospatent (certificate No. 2023661508) and included in the Russian Software Registry (entry No. 19972 of 13.11.2023)
The right to use the Platform is granted under a licence agreement concluded by Neurovision with its customers
Tell us where you check faces and how many sessions you run per month — we will suggest the Liveness mode and selfie checks, and give you test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a callThe company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
How attacks on face checks work and how they are detected — in our blog
Put a multi-layer face check into the scenario: Liveness, a selfie check for signs of generation, face swapping and filming from a screen, and face matching between the session steps. Capture only with the camera through the widget, limit the session lifetime and review manually the sessions with the status "suspicious".
A photo or recording is shown to the camera as it is, and it has no live movement or depth. A deepfake is a face created or replaced by a neural network, sometimes in real time, so it can "blink" and turn its head. What a deepfake is and how it is made — in the blog article.
A separate check looks on the selfie for signs that the face was generated or replaced by a neural network. If it triggers, the step fails with the code "the face shows signs of generation or swapping", and the result is visible in the API and in the session card. Liveness and face matching between steps work alongside it.
Not completely: Liveness is built against attacks that are shown to the camera, while a virtual camera substitutes the stream itself. The widget's restrictions work against it — camera-only capture, HTTPS only and allowed domains, a short session lifetime — together with control on your side. Details of the attacks — in the article on video stream substitution.
For high-risk operations — active: a pre-prepared video has a harder time guessing the tasks. Passive is more convenient for the user and gives fewer refusals; it is used for sign-up with low limits. The mode is set in the scenario and changed without development.
No. In the widget the selfie and Liveness are captured by the camera at the moment of the check, and a file cannot be picked from the gallery. Ready-made images are accepted only by the REST API, and your server controls that channel.
The document, anti-fraud and selfie check take seconds. With Liveness — from a few seconds to a minute: the time depends on how quickly the user completes the tasks.
Review it manually. The status means, for example, that different people appear in Liveness and on the selfie; such a session is closed immediately. Look at the images and the recording of the check, if it is enabled, and decide according to your own rules. It is a signal, not proof of fraud.
Decide this with a lawyer before launch. Liveness and face comparison are the processing of a face image; 152‑FZ requires written consent to the processing of biometric data, and 572‑FZ restricts the processing of biometrics outside the Unified Biometric System for identification and authentication. The text of the consent is prepared by your company as the personal data operator.
No. Remote identification under 115‑FZ goes through the state services portal and the Unified Biometric System, and NeuroVision is not connected to it. Liveness and the selfie check help to make sure that the document is presented by a live person and not a forgery. How the Unified Biometric System works — in the article.
There is no separate law as of October 2026. Theft with the help of a deepfake is classified as fraud (Art. 159 of the Criminal Code of the Russian Federation and related articles), and the use of someone else's image without consent violates Art. 152.1 of the Civil Code of the Russian Federation. Draft laws on an aggravating circumstance and an aggravating feature have been submitted to the State Duma but not adopted.
The "Document + liveness" package — from 29 ₽ per KYC session, at 10 000 sessions a year — 33 ₽. There is no subscription fee, and a selfie and Liveness cost the same. The package with database checks — on request.
