Step 1
Live camera only
The check opens in a widget on the website, via a KYC link or in an app. A ready-made photo or video cannot be picked from the gallery: Liveness is captured by the camera at the moment of the check.
Protection against masks, photo and video attacks (PAD)
Instead of the customer, the camera is shown a printout, a video on a tablet, a silicone mask or a 3D head. NeuroVision Liveness tells a live face from any physical fake and rejects attacks of all three iBeta PAD complexity levels — on an ordinary front camera of a phone or laptop.
Presentation attacks under control
Camera capture only Result in the API and dashboard Cloud or on-premises
Price — per the price matrix as of the publication date, at 100,000 checks a year. The list of attack types comes from the Liveness package
Spoofing in front of the camera: how a physical fake differs from a live face
A fake is held up to the camera
A presentation attack is an object in the frame, not a software substitution.
- 01
What a presentation attack is
A fraudster does not hack the app: they simply open the camera and show it someone else’s face — a printout, a photo on a second phone, a video on a tablet, a mask or a 3D model of a head. Protection against such attacks is called PAD (presentation attack detection); in the product it is performed by Liveness. If a fake is not caught, an account is opened in someone else’s name, a loan is issued or a car is handed over.
- 02
How it differs from a deepfake
A deepfake and video stream substitution work inside the device: the camera receives a generated frame or is replaced by software. Here everything is physical — paper, screen, silicone, plastic. Each material leaves its own traces, and Liveness looks for exactly those. For synthetic faces and injections, see the page on deepfake protection.
- 5 + 5 + 4 types of fakes at levels 1, 2 and 3
- up to 6 attempts per step, then the session is blocked
- 0 uploads of a ready-made file in the widget
Which photo, video and mask attacks Liveness rejects: three complexity levels
The levels follow the iBeta PAD classification: the higher the level, the more expensive and time-consuming the fake is to make. NeuroVision Liveness is designed for all three. Detecting a substituted photo is only the start of the list.
- A printed photo, including one bent to imitate volume
- A printout with eye cut-outs: a live person blinks behind it
- A photo on a phone or tablet screen, a low-resolution picture from social networks
- A video of a person’s face on a screen — static or with blinking and head turns
- A paper mask and a cardboard 3D mask
- A basic silicone mask
- A professional silicone mask made for a specific person
- A theatrical mask and film make-up
- A 3D-printed face and a full-size 3D head
- The result of the Liveness step: passed or not, with a code
[face] is not aliveon refusal - A hint for the user if the cause is the shooting conditions: low light, a covered face or one outside the frame
- The number of attempts and the video of the check — if recording is enabled in the scenario
- “Rejected” — the step is not passed, the session will not get the “success” status
- “Try again” — the user sees what to fix
- “Custom” — set in the scenario editor
- How these attacks work — in the article “How liveness checks are bypassed”
By which signs Liveness tells a printout, a screen and a mask apart
Liveness analyses a series of frames — texture, micro-movements, volume and material artefacts. The models work in 2D and 3D, so no special camera is needed.
Photo anti-spoofing: flat surface, paper and the edge of the sheet
A printout has no volume: when the phone moves, the face shifts as a whole, like a plane. The edges of the sheet, fingers on it, the print screen pattern and glare on gloss are visible. A bent sheet and eye cut-outs do not help: the eyes move, while the skin around them does not. This is protection against photo substitution during verification.
Video spoofing protection: pixels, moiré and the frame
A video on a tablet or a second phone blinks and turns but remains an image on a screen. It is given away by moiré, the pixel grid, reflections in the glass, the device frame and unnatural brightness. Separate selfie checks flag capture from a monitor or mobile device screen.
Skin, eyes and the mask edge
A mask repeats the shape of the face but not the skin: silicone and paper have a different texture, there is no fine facial expression, and the eyes in the cut-outs move separately from the eyelids. At the mask edge, along the hairline, ears and neck, a transition of material is visible.
Volume without life
A printed face and a full-size head pass a simple volume check. What sets them apart is different: a series of frames shows none of a live person’s micro-movements, and light reflects from plastic rather than skin. These are level 3 attacks, and the Liveness 3D model is built for them.
Medical mask, glasses, beard: where an attack ends
-
A medical mask is not a fake
A person in a medical mask is not posing as someone else: they have simply covered half of the face. The system detects a medical mask separately from an attack. What to do about it — ask to remove it or skip the step — is a rule of your scenario.
-
Glasses, headwear, beard
Accessories and a beard are facial features, not the material of a fake. Face analysis flags them, while liveness is determined by skin, movement and volume. Dark glasses that hide the eyes are better asked to be removed — the widget will show a hint.
-
Face covered or out of frame
A hand near the face, a hood, poor light, a head at the edge of the frame — these are not an attack but poor conditions. The user gets a hint and tries again rather than being rejected for fraud.
-
Strictness — by operation risk
For issuing a loan or renting a car it is reasonable to ask for a fully open face; for registration with low limits, glasses and a mask can be allowed. Frame requirements are set in the scenario and change without development.
A person is not obliged to provide a face image: keep a path without the face step (Art. 11, Part 3 of 152‑FZ). Why honest users sometimes fail Liveness — on the page on passive Liveness.
An attempt with a mask: what the user sees and what you get
The “document + Liveness” scenario, using an attempt to pass the check in a silicone mask as an example. The steps and the Liveness mode are set in the scenario editor. How to embed the check into a website and an app — on the page on verification on a website and in an app.
Step 2
A series of frames instead of a single shot
The user moves their face into the oval, and the system analyses several frames: texture, volume, micro-movements. A mask repeats the shape of the face but not the skin or expressions.
Step 3
Rejection and attempt limit
The step fails with the code “The image did not pass the Liveness check”. Up to 6 attempts are given per step, after which the session is blocked — masks and lighting cannot be tried one after another within a single session.
Step 4
The result in the dashboard and on your server
The session gets the result “not passed”, and your server learns about it via a webhook. The dashboard shows the attempts and, if recording is enabled, the video of the check — the security team reviews the case from the recording.
How to test mask protection in your own pilot
A vendor’s claims — including ours — are worth trusting after your own test. Below is a procedure that repeats the laboratory methodology and fits into a test month. How the ISO/IEC 30107-3 standard works and what APCER and BPCER mean — on the page on deepfake protection.
-
Collect fakes by level
For level 1 — printouts of a volunteer employee and their photo on a second phone; for level 2 — a video on a tablet and a ready-made silicone mask. Laboratories allow up to 8 hours to make one type of level 1 fake, and up to 24 for level 2.
-
Count attacks and genuine attempts
For each type of fake, an iBeta tester makes 150 attacks and 50 genuine presentations, alternating them. Count two rates: how many attacks got through (APCER) and how many live people were rejected (BPCER). The second matters just as much — it is your conversion.
-
Test on your customers’ phones
The result depends on the camera and browser. Take inexpensive Android smartphones, old iPhones and laptops, and shoot in daylight and evening light. Since 1 January 2026, Russia has had a separate standard, GOST R 58624.4-2025, on the test profile for mobile devices.
-
Check against the vendor’s report
In a laboratory letter, look for the laboratory name, the level, the standard (ISO/IEC 30107-3 or GOST R 58624.3-2019), the date, the product version and the device. A laboratory result does not replace monitoring on a real flow: watch the rejections in the dashboard after launch.
Where printouts and masks hit the wallet: loans, rentals, couriers, crypto services
A physical fake is chosen where one pass is paid for in money or property.
-
MFIs and online loans
- A stolen passport and a printed photo of the owner — the cheapest way to take a loan in someone else’s name.
- Liveness after the document filters out a printout and a screen. Solutions for microfinance organisations
-
Banks
- Remote account opening and issuing a card for a money mule: at stake is not a loan amount but access to transfers.
- Against level 2–3 masks — active mode and recording of the check. Solutions for banks
-
Car sharing and rental
- Renting with someone else’s licence and the owner’s photo on a phone: the fake costs pennies, the car costs millions.
- Liveness at registration and before the first trip. Car sharing and rental
-
Marketplaces and contractor platforms
- A seller or courier is registered with someone else’s documents, while another person works.
- Live presence at onboarding and at the start of work. Seller checks
-
Crypto exchanges and exchange offices
- A verified account is sold whole — the fake is needed once, while the account is used for a long time.
- A repeat “document + Liveness” check before withdrawing funds. Solutions for crypto services
-
Remote hiring
- One person goes through the interview and hiring, while another comes to work.
- Liveness and a match with the document in the same session at hiring. Remote employees
What is allowed without the Unified Biometric System: Liveness, a one-off match and a repeat check
Mask protection answers the question “is a live person in front of the camera”, not “who are they”. This determines which rules of 152‑FZ and 572‑FZ apply to it. The summary of the rules as of October 2026 is a guideline, not legal advice.
-
Liveness — allowed
A live presence check does not establish identity and does not compare the face with a database. It can be placed at any step: registration, issuing, start of a shift.
-
A match with the document in the same session — allowed
A one-off match of a selfie or a Liveness frame with the photo in the document the person has just shown. This is biometric processing: written consent is required (Art. 11, Part 1 of 152‑FZ); details are on the page on face comparison.
-
A repeat check — allowed
The customer has come back and you have doubts? Send a new link: document and Liveness again. This is a new check, not a search for a person among old images. How it works — on the page on access recovery.
-
Recognition by stored faces — two ways
A company can automatically recognise “the same person” from stored templates only through the Unified Biometric System (Art. 15, Part 1, Cl. 2 of 572‑FZ, Unified Biometric System integration). The second way is a decision by an employee who compares the frames themselves (Art. 1, Part 2, Cl. 2): manual review.
How much a liveness check with mask protection costs
Protection against all three attack levels is part of Liveness — there is no separate “mask protection” line in the price matrix. You pay for a check or for a KYC session with all scenario steps.
- Connect: Liveness check
Liveness check
from 13 ₽ per check
Liveness without a document: sign-in, start of a shift, a repeat check. RUB 15 at 10,000 checks a year, RUB 14 at 50,000, RUB 13 at 100,000.
-
Document recognition and anti-fraud plus Liveness or a selfie and a match of the face with the photo in the document in one session.
- Calculate: Extended
Extended
on request
Everything from “Document + Liveness” and database checks: 16 checks against Russian databases and international sanctions and PEP screening.
Test — 1 month, pay only for the checks performed. Prices — per the price matrix as of the publication date.
How to enable mask protection: widget, KYC link, app or your own environment
Protection works the same way in any channel: there is no need to enable it separately, a Liveness step in the scenario is enough.
- Camera capture only in the widget
- Result in the webhook and the API
- Scenario in the personal account
- Session recording — an option
Terms of connection
1 month test, a personal manager, support under contract, payment for checks.
PAD glossary: artefact, attack level, APCER and BPCER
Terms found in laboratory reports and procurement specifications.
- PAD
- Detection of biometric presentation attacks: methods that tell a live face from a fake in front of the camera. In the product it is the job of Liveness. More in the article “Liveness Detection: what it is and how it works”
- Presentation Attack Detection
- Presentation attack
- An attempt to pass the check by showing the camera an artefact instead of one’s own face
- Presentation attack, spoofing
- Artefact
- An object used in place of the face: a printout, a screen, a mask, a 3D model
- Presentation Attack Instrument, PAI
- Artefact type
- A group of identical fakes in testing, for example “silicone mask”. For each type the laboratory makes a series of attacks
- Species
- Attack level
- The complexity of making the fake: 1 — simple publicly available methods, 2 — medium, 3 — made for a specific person
- iBeta PAD Level 1–3
- APCER
- The share of attacks that the system took for a live face
- Attack Presentation Classification Error Rate
- BPCER
- The share of genuine users that the system rejected as an attack
- Bona Fide Presentation Classification Error Rate
- Replay attack
- Showing the camera a recorded video of a person’s face, including with blinking and turns
- Replay attack
- Moiré
- A pattern of interference fringes that appears when a screen is filmed — one of the signs of a replay
- Moiré
- GOST R 58624
- A series of national standards on detecting biometric presentation attacks: part 3 — testing and protocols (based on ISO/IEC 30107-3), part 4 — the test profile for mobile devices
- ISO/IEC 30107
We will test mask protection on your scenarios
Tell us where your customers go through the check and which fakes you have already seen. We will choose the Liveness mode and help plan the pilot.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
Read also
Materials on liveness, attacks on face checks and protecting biometric data — in our blog.
462 20
Anti-Fraud, Liveness and Deepfake Protection
How Liveness Detection Is Bypassed: Presentation Attacks, Replay, and Virtual Cameras
170 25
KYC, AML and Digital Identification
Liveness Detection: What It Is, How Liveness Checks Work, and Where Businesses Need It
458 13
KYC, AML and Digital Identification
Deepfakes in KYC: Detecting Face Spoofing and Protecting Video Verification
396 16
KYC, AML and Digital Identification
How to ensure the protection of personal and biometric data in KYC processes
Frequently asked questions about mask and photo-attack protection
A mask, a printout and a screen are physical objects in front of the camera; they are given away by the material, the flat surface and the absence of live micro-movements. A deepfake and video stream substitution are created by software, and other checks work against them. Both topics are covered by a single Liveness step with selfie checks; for synthetic faces, see the page on deepfake protection.
No. Silicone masks — both basic and made for a specific person — are level 2 and level 3 iBeta PAD attacks, and NeuroVision Liveness is designed for both. A mask is given away by the material texture, the edge at the hairline and neck, and the absence of fine facial expression.
A medical mask is not a fake; the system detects it separately from an attack. Whether to ask to remove the mask is your decision in the scenario settings: for a loan or a rental it is reasonable to require an open face, while for registration with a low limit it can be allowed.
No. A photo on a screen and a picture from social networks are level 1 attacks. Liveness tells a flat image from a live face, and selfie checks flag capture from a monitor or mobile device screen. A ready-made photo cannot be uploaded to the widget — only camera capture works.
No. Liveness uses 2D and 3D models and works on an ordinary front camera of a smartphone or laptop. The system assesses facial volume and micro-movements from a series of frames.
The Liveness algorithms have been tested for resistance to presentation attacks under ISO 30107-3 and the iBeta PAD classification; the list of attacks at three levels is in the block above. We will provide the test documents on request during the pilot.
Make level 1 and level 2 fakes using volunteer employees, run a series of attacks and genuine attempts for each type, and count how many attacks got through and how many genuine attempts were rejected. Test on your audience’s phones. Test access — 1 month.
Up to 6 attempts per step. After that the session is blocked, and a new check needs a new session — a working fake cannot be found by trial and error within a single session.
An organisation can automatically recognise people from stored face images only through the Unified Biometric System (572‑FZ). Without it there are two ways: a repeat “document + Liveness” check, or a decision by an employee who compares session frames themselves — 572‑FZ does not apply to such a comparison.
It is not charged separately — it is part of Liveness. A liveness check without a document — from RUB 13, a “Document + Liveness” KYC session — from RUB 29. The exact price depends on volume — per the price matrix.
