Deepfake attack vectors: presentation, injection and social engineering, with the standards and cases for each

This page is part of the deepfake detection hub and sorts the attacks that the liveness and injection attacks page tests and the recorded deepfake scam cases page documents. The route decides which standard applies and which detection scores, if any, are relevant.

01What are the three deepfake attack vectors?

The routes are defined by where the fake meets the target, not by how it was made. The same swapped face, built with a method such as FaceShifter, can be held up to a phone camera on a screen, pushed into the camera feed by software, or played to a finance employee on a video call. ENISA's remote identity proofing report states the first two directly: "deepfake attacks have only two ways of getting into the system: either by being presented to the camera or by being directly injected into the camera flow" (ENISA, 2022). The third route is outside that report's scope, which excludes "generic social engineering attacks" unless they bear directly on identity proofing.

The split matters because each route has its own test, its own defence and its own record. The four kinds of face deepfake page describes the payloads; this page describes the delivery.

02What is a presentation attack?

ISO/IEC 30107-1 defines a presentation attack as a "presentation to the biometric capture subsystem with the goal of interfering with the operation of the biometric system", and a presentation attack instrument (PAI) as the "biometric characteristic or object used in a presentation attack" (wording as quoted in the SC 37 working group slides, since the standard's text is paid). ISO/IEC 30107-3:2023, the testing part, says the attacks it covers "take place at the biometric capture device during presentation" (ISO catalogue). The defining feature is physical: something is in front of the camera.

ENISA's survey of remote identity proofing found four classes of face presentation attack: "photo attack, video of user replay attack, 3D mask attack, deepfake attack". It separates digital instruments, displays used to replay a real or altered face, from physical ones such as silicone or printed masks that "can literally be touched by the human attacker". A deepfake shown on a screen is a digital PAI, and a liveness check is the PAD mechanism meant to catch it, scored by APCER and BPCER as the presentation attack detection page explains.

03What is an injection attack?

An injection attack never reaches the lens. ENISA reports that "video injection is the most promising attack method, according to market players. It is not a presentation attack instrument, as the video will be injected and not physically presented to the camera", and describes it as "a way to circumvent the cam of the device used to perform the remote identity proofing". Because nothing is presented, a PAD test under ISO/IEC 30107-3 does not measure it, and ENISA's expert workshop of 15 July 2021 treated "deepfake video injection" as a scenario of its own, alongside silicone masks and document manipulation.

The report also records the state of the defences in 2022: "the industry lacks a clear framework for the type of testing needed to determine whether different approaches to injection attacks can be effectively deterred", and a dedicated application can check the device "to make sure it is not an emulator, to prevent the injection of video and audio, and to measure the behaviour of the video feed". A European technical specification followed: CEN/TS 18099:2024, "Biometric data injection attack detection", valid from 16 December 2024, defines a biometric data injection attack, gives guidance on detection systems and a test plan for evaluating them, and places presentation attack testing out of scope because ISO/IEC 30107 covers it (EVS catalogue). The virtual camera injection attacks page covers the mechanism.

ENISA adds a detail that bears on every route: "Deepfake videos and interactive deepfake puppets can now be created in real-time", so an operator on a live call "will effectively talk with a real person" and challenge-response checks can be answered.

04What is a social engineering deepfake attack?

A social engineering attack has no biometric system in the path. The fake is played to a person, who then acts. The Hong Kong Government's written reply to the Legislative Council of 26 June 2024 is the clearest primary record (LCQ9). The Police "have maintained separate statistics on this type of fraud since 2023" and "Up to May 31, 2024, the Police have received three cases relating to deepfake technology, which occurred in August 2023, January 2024 and May 2024 respectively".

In the January 2024 case an employee received a phishing email impersonating the chief financial officer of the company's United Kingdom head office, joined a group video conference, authorised transfers to five local bank accounts and "suffered a loss of about HK$200 million". The Police believed "the pre-recorded video conference was generated using downloaded online public video clips and voices of the impersonated officer", and that "there was actually no interaction between the informant and the fraudster"; the payment instructions continued "using instant messaging software". On 20 May 2024 a staff member of a multinational trade company "took part in a video conference for nearly 30 minutes" with a "fake boss" who instructed a transfer of "nearly HK$4 million"; the Police believed altered public videos were played at the conference. Both cases were still under investigation at the date of the reply.

The August 2023 case is different in kind. A syndicate was suspected of "using an AI face-swapping programme to apply for loans online from finance companies between September 2022 and July 2023, involving money amounting to HK$200,000"; nine people were arrested. That is a face swap used against an onboarding check, a presentation or injection route, which the reply calls "the first detected case involving AI face-swapping".

05Which test covers which route?

A detector score answers one question: given this frame or clip, how well does the model separate real from manipulated on the set it was tested on. The in-dataset score of the UCF detector says nothing about whether a fake was injected or presented, and nothing about a conference call. For the third route the Hong Kong reply lists what the Police advise instead: ask the person "to make certain movements in front of the camera, such as turning their head up, down, left or right", and observe the image for abnormality. ENISA's real-time puppet warning applies to that advice too.

06Why the counts for each route differ

Public numbers exist for only part of the picture. The Hong Kong Police counted three deepfake fraud cases to 31 May 2024 and, separately, 21 online deepfake clips impersonating officials or celebrities between 1 November 2023 and 31 May 2024, all removed at the Police's request and with no report of anyone defrauded by them. Those are counts of reports under one jurisdiction's definitions, not of attacks. ENISA's injection finding is a market-player assessment, not a count. Presentation attack results come from laboratory sets such as those on the public dataset rows, each with its own attack species. A single "deepfake attacks" figure that combines the three routes has no primary source. The vocabulary for the first two routes, from presentation attack to PAI, is set out on the 25 face recognition terms page.