Passive vs active liveness detection: how they differ and why ISO/IEC 30107-3 matters

Passive liveness detection confirms that a real, present person is in front of the camera from a single selfie, with no action required from the user. Active liveness detection asks the user to perform a small gesture — blink, turn their head, smile or follow a prompt — and checks that the response is genuine. Both aim to answer the same question: is this a live human, or a spoof?

What is liveness detection?

Liveness detection is a biometric check that confirms a camera is seeing a real, live person rather than a photo, a video replay, a mask or an injected deepfake. It is the safeguard that stops someone passing a face check with an image of somebody else. It is normally paired with face recognition: liveness proves the person is present, and 1:1 matching proves they are the right person.

Passive liveness

Passive liveness runs in the background. The user simply looks at the screen, and the system analyses natural signals — texture, depth cues, reflection, micro-movement and how the face responds to the environment — to decide whether it is a genuine live capture. Because there is nothing to perform, it is fast and low-friction, which matters for onboarding conversion.

• Pros: minimal friction, faster completion, harder for an attacker to rehearse because there is no scripted challenge.
• Cons: quality depends heavily on the model and the capture conditions; it is less visibly "explainable" to end users.

Active liveness

Active liveness issues a challenge — a blink, a head turn, a smile, or following an on-screen prompt — and verifies the response in real time. The challenge makes the check feel deliberate and can help in difficult lighting, but it adds a step, and scripted challenges can, in principle, be anticipated.

• Pros: intuitive for users, an explicit signal of effort, useful as a visible deterrent.
• Cons: more friction and drop-off; a fixed set of challenges is a target attackers can prepare for.

Passive vs active liveness at a glance

 PassiveActive User actionNoneGesture / prompt FrictionLowHigher SpeedFastestSlower Best forHigh-volume onboarding, step-up checksContexts where a visible challenge is preferred

Presentation attacks vs injection attacks

Spoofs fall into two families, and a strong check must handle both:

• Presentation attacks are shown to the camera — a printed photo, a screen replay, or a mask.
• Injection attacks bypass the camera entirely — pre-recorded or synthetic (deepfake) video pushed through a virtual camera or intercepted stream.

Passive and active techniques both target presentation attacks. Injection and deepfake attacks need additional defences at the capture and transport layer, which is why modern liveness detection is designed against both families rather than gestures alone.

Where ISO/IEC 30107-3 fits

ISO/IEC 30107-3 is the international standard for presentation attack detection (PAD). It defines how a liveness system is tested against known attack types and how results are reported, so a claim of "spoof resistance" can be measured rather than asserted. When you evaluate a vendor, ask whether their detection has been tested against ISO/IEC 30107-3 and by whom — an independent test is far more meaningful than a marketing number. Smart Solutions frames its liveness on this standard rather than on unverifiable accuracy claims.

How to choose

• Favour passive when conversion matters and volumes are high; add a step-up check for high-risk actions.
• Require coverage of both presentation and injection/deepfake attacks — not just a blink test.
• Insist on a tunable confidence score so you can set thresholds per flow (onboarding, payments, recovery).
• Prefer detection tested against ISO/IEC 30107-3, and pair liveness with 1:1 face matching so presence and identity are both proven.

Frequently asked questions

Is passive or active liveness more secure?

Neither is inherently more secure — security depends on the underlying model and whether it is tested against a recognised standard. Passive removes the scripted challenge an attacker could rehearse; active adds a visible signal of effort. The strongest deployments use robust passive detection with a step-up option.

Does liveness stop deepfakes?

Good liveness targets deepfake and injection attacks specifically, because those bypass the camera. A simple blink challenge alone does not — defeating deepfakes requires checks at the capture and transport layer. See deepfakes vs liveness detection.

Do I still need face recognition if I have liveness?

Yes. Liveness proves a real person is present; it does not prove who they are. Pair it with 1:1 face recognition to match the live selfie to the portrait on the credential.

What standard should I ask a vendor about?

ISO/IEC 30107-3 for presentation attack detection, ideally with independent testing. For a plain-language definition, see the glossary.