Safeguarding identification processes from deception: A manual for securing verification systems against presentation intrusions
In the digital age, where biometric and document verification systems are increasingly relied upon by financial institutions, presentation attacks have emerged as a significant threat to these systems. These attacks, also known as spoofing attacks, aim to deceive biometric or document capture systems during identity verification by using fake, altered, or manipulated input.
- Physical Presentation Attacks
Fraudsters often employ various methods to bypass biometric sensors. One such approach is physical spoofing, which involves presenting fake biometric traits directly to the sensor. Common techniques include the use of 2D/3D masks, printed photos or videos, and deepfake videos. For instance, a Brazilian thief recently gained unauthorized access to accounts using a mannequin with taped photos of faces, exploiting the "face ID" option and even applying for loans[4].
- Digital Manipulation and Injection Attacks
Beyond fooling sensors with physical or image-based spoofs, attackers may digitally inject malicious data into the biometric authentication pipeline to override genuine data. This form of attack often exploits flaws in software or APIs.
- System-Level Bypass Attacks
These attacks do not focus on fooling the biometric sensor itself; instead, they exploit vulnerabilities in the software stack managing biometric data authentication. Examples include malware that sends pre-recorded biometric data directly into the operating system, proxy applications tampering with API calls or editing/replacing biometric templates.
- Document Fraud and Forgery Detection
Attackers may try to manipulate or forge identity documents presented for verification. Adaptive Document Verification systems can detect subtle signs of document manipulation and forgery, adjusting for different document types.
- Real-World Incidents
The threat of presentation attacks is not hypothetical. In Germany, a fraud ring used scripted deepfake avatars to open hundreds of bank accounts[1]. Another high-profile attack involved hijacking a video call with deepfaked executives, resulting in a fraudulent $25 million transfer[2].
To counter these threats, financial institutions must adopt cutting-edge solutions capable of counteracting sophisticated presentation attacks and other forms of fraud. Companies like Mitek offer advanced tools for counteracting presentation attacks, including AI-powered liveness detection, deepfake analysis, and document authentication. By implementing a multi-layered security approach, adopting AI-powered solutions, and continuously adapting to emerging threats, businesses can prevent presentation attacks and fraud while maintaining a seamless customer experience.
[1] Data and Methodology: [https://docs.google.com/document/d/1a8bHl3BqVm3_kqZI3eQWcGdo1l7xjVLG6D-JX4gxQM0/edit] [2] The Verge: [https://www.theverge.com/2021/1/14/22228477/deepfake-video-call-fraud-arrested-swiss-banker] [3] Nametag: [https://www.nametag.ai/] [4] The Guardian: [https://www.theguardian.com/world/2021/jan/27/brazil-thief-used-mannequin-with-photos-to-access-accounts]
- As technology advances in the finance industry, cybersecurity measures for banking-and-insurance sectors need to address not only presentation attacks on biometric systems but also digital manipulation and injection attacks on these systems.
- In addition to securing biometric sensors, it's crucial for companies in the business sector to protect against system-level bypass attacks, which can exploit vulnerabilities in software or APIs.
- Financial institutions must remain vigilant against document fraud and forgery, using adaptive document verification systems to detect any possible manipulation or forgery attempts.
