KYC and deepfakes: what identity verification standards actually test

This page sits in the deepfake detection hub and is the applied companion to the page on how liveness and injection attacks are tested. That page explains the attack types; this one walks the KYC pipeline step by step and asks, for each, what a published number can and cannot say.

01What does a KYC face check consist of?

NIST SP 800-63A, the identity proofing volume of the United States digital identity guidelines (revision 4 series, text dated 26 August 2025), lists the expected outcomes of identity proofing: identity resolution, evidence validation, attribute validation, identity verification, enrollment and fraud mitigation. Identity verification is the step this site cares about: the guideline defines it as confirming "that the applicant is the genuine owner of the presented evidence and attributes" (NIST SP 800-63A). In practice a face-based KYC flow does that with four operations: a camera captures the applicant, a liveness check decides that the capture is a live person, a face matcher compares the capture with the portrait on the document, and a decision layer applies a threshold and routes doubtful cases to a person.

The guideline keeps these apart: its biometric pathway allows "automated means to compare a facial image represented on or stored in the identity evidence" to a live sample, and it treats presentation attack detection and injection prevention as separate requirements with separate test standards. A published figure for one step says nothing about the others.

02Which step has a public evaluation?

The matching step. NIST's Face Recognition Technology Evaluation (FRTE) 1:1 track has received 1,501 algorithms from 461 developers since 2017, updates its tables monthly, and defines its metric as "FNMR is the proportion of mated comparisons below a threshold set to achieve the false match rate (FMR) specified" (NIST FRTE 1:1). Rankings are computed at an FMR of one in a million on the VISABORDER set, every test image holds one face, and developers may submit no more than once every four calendar months. The NIST FRTE explainer describes the tracks and how to read a row.

That evaluation answers a narrow question: given two genuine images, how often does the algorithm fail to match them at a fixed impostor rate. It does not test whether the live image came from a camera or how a decision layer handles a borderline score. A product can embed an algorithm with a strong FRTE row and still accept an injected deepfake, because the deepfake is matched, not detected, by that algorithm.

03What does ISO/IEC 30107-3 test, and what does it leave out?

ISO/IEC 30107-3:2023 (edition 2, January 2023, 39 pages) gives "principles and methods for the performance assessment of presentation attack detection (PAD) mechanisms" and a classification of known attack types, and its scope states that "the attacks considered in this document take place at the biometric capture device during presentation" (ISO/IEC 30107-3:2023). Its error rates are the attack presentation classification error rate, the proportion of attacks accepted as bona fide, and the bona fide presentation classification error rate, the proportion of real users rejected; the passive versus active liveness page defines both and explains why they are reported per attack type.

Two things are absent. There is no public leaderboard: a laboratory test under the standard produces a report for the buyer, and no body publishes a ranked table the way NIST does for matching. And the standard's scope ends at the sensor. A deepfake fed into the application in place of the camera never makes a "presentation", so a 30107-3 result does not describe it. The ENISA report on remote identity proofing (January 2022, updated June 2022) put it directly: "video injection is the most promising attack method, according to market players. It is not a presentation attack instrument" (ENISA).

04What does NIST SP 800-63A require of a remote check?

Revision 4 of SP 800-63A turns the pipeline into numbers. The thresholds below are quoted from its requirements for the use of biometrics, for visual and automated document validation, and for digital injection prevention; the guideline is written for United States federal agencies and the credential service providers that serve them, but it is the most specific public statement of what each step must achieve.

The injection section is explicit about the limit of the liveness step: "A biometric comparison performed with a captured sample does not prevent these attacks," and presentation attack detection "provide[s] some protection" while "not sufficient to address all possible cases" (SP 800-63A, digital injection prevention). It also requires that automated forgery analysis be tested against attack artifacts and that the false negative rates be documented, which is the closest the guideline comes to a benchmark for deepfake detection inside KYC; the results go to relying parties, not to the public.

05Where do deepfakes enter, and who tests for that?

A face deepfake reaches a KYC system by one of two routes, in ENISA's words: "either by being presented to the camera or by being directly injected into the camera flow." The first is a presentation attack and falls under ISO/IEC 30107-3. The second bypasses the camera, and until recently had no test document at all. CEN/TS 18099:2024, "Biometric data injection attack detection", valid from 16 December 2024, defines the injection attack, lists injection attack instruments, and sets out "creation of test plan for the evaluation of Injection Attack Detection system" (CEN/TS 18099:2024). It states that presentation attack testing is out of its scope because ISO/IEC 30107 covers it. The page on virtual camera injection attacks covers the specification in detail.

CEN/TS 18099 is a technical specification with a test plan, not a benchmark with results. No laboratory publishes injection detection scores per product, and ENISA's 2022 finding still stands as written: "the industry lacks a clear framework for the type of testing needed to determine whether different approaches to injection attacks can be effectively deterred." So the deepfake-specific step of a KYC check is the one with the least public evidence.

06Why is the matching score not the KYC error rate?

The matcher's false match rate is measured on genuine photographs of two different people. In a KYC flow the dangerous input is a manipulated image of the right person, and the matcher is built to accept it. The NIST FRTE page adds a second caveat: false negatives "depend strongly on image quality", and poor photography can produce a demographic effect, so the FNMR a vendor quotes from a clean test set will not be the FNMR on phone selfies in bad light. The face verification metrics explainer shows how a single threshold moves both error rates at once.

The 25 percent demographic rule in SP 800-63A exists because NIST's demographic effects report found that across 189 algorithms, "false positives rates often vary by factors of 10 to beyond 100 times" (NISTIR 8280). A KYC error rate is therefore at least four numbers (FMR, FNMR, attack presentation and bona fide classification error rates), each on a stated population, plus an injection test result that today usually does not exist in public.

07What a KYC accuracy claim should state

A claim about a KYC face check is checkable when it names the step, the metric, the test set and the date. An FNMR at FMR 1 in 10,000 on a named NIST FRTE set is a claim about step three. An attack presentation classification error rate in a 30107-3 test of print and replay attacks is a claim about step two, and says nothing about deepfakes injected past the camera. A single accuracy figure with no step, no attack list and no test set is not a claim this site can place in any table.

No single benchmark score predicts how an identity check performs against a manipulation its test set did not contain, and for the injection route there is as yet no public benchmark score at all.