Liveness and identity verification: preventing fraud in digital onboarding

As hiring, account opening and signatures move online, identity fraud is becoming more sophisticated: tampered documents, third-party photos and, more recently, images and videos generated by artificial intelligence. Knowing who is on the other side of the screen has become an essential part of risk management.

Why a signature alone is not enough

An electronic signature proves that someone with access to a given email or phone agreed to a document. In higher-risk operations — lending, high-value contracts, remote hiring — it is important to go further and confirm that this person is who they claim to be.

The layers of identity verification

• Document capture and analysis: reading an official ID with data extraction and consistency checks to detect signs of tampering.
• Facial biometrics: comparing the user’s selfie with the photo on the ID.
• Liveness detection: verifying that a real person is in front of the camera at the time of capture — not a photo, video, mask or synthetic image.
• Registry validation: checking the data provided against trusted sources, according to the legal basis and purpose of the use case.
• Access context: recording IP, device, date and time and, when authorized, geolocation.

Active and passive liveness

With active liveness, the user performs actions such as turning their head or blinking. With passive liveness, verification happens from a single capture, analyzing texture, depth and other signals — making the experience smoother. Many solutions combine both depending on the risk level.

From verification to evidence

Verifying identity is half the job. The other half is being able to prove it later. Each step should generate technical evidence — check results, hashes, trusted timestamps and events — consolidated in a report linked to the document or record. In a dispute, this evidence file is what demonstrates the company’s diligence.

Biometrics and the LGPD

Biometric data is sensitive personal data under Brazil’s LGPD. Processing it requires an appropriate legal basis (art. 11) — such as fraud prevention and the data subject’s security in identification and authentication processes in electronic systems — a specific purpose, transparency and reinforced security controls, including well-defined retention periods.

The best identity verification is the one legitimate customers barely notice — and fraudsters cannot get through.

Balancing security and experience

Requiring every layer in every situation creates friction and drop-offs. The recommendation is to calibrate by risk: simple flows for low-impact documents and reinforced verification for sensitive operations. Specialized human review for cases automated rules cannot resolve completes the strategy.

Conclusion

Identity, signature and evidence form a tripod. When they work together, they reduce fraud, cut disputes and give companies the confidence to take entire processes digital.