Biometric Fraud Prevention for Banks in 2026: Check the Camera First

Biometric Fraud Prevention for Banks in 2026: Check the Camera First

Sub heading

What Banks Should Evaluate When Selecting a Biometric Fraud Prevention Platform

In 2023, I went to a bank in Lagos to deposit some money.

A man walked up to customer service to complain. His account had been blocked, he said, for no reason. The rep listened and asked him to sit down while they sorted it out.

He sat. About thirty minutes later, the police came in, and they came for him. He had been flagged for fraud.

He was scared. Confused. He kept arguing, and then he started crying.

I learned the rest by coincidence, when he posted about it on X. Someone else, he wrote, had committed the fraud. The account was his. So the arrest was his too.

He walked in thinking he had a banking problem. He actually had an identity problem.

Somewhere, a system had connected a crime to his account. It got the account right and the person wrong. And the cost of that mistake didn’t land on the bank. It landed on a man sitting in a banking hall, waiting for help that turned out to be the police.

When selecting a biometric fraud prevention platform, banks should look past face match and liveness to four things. First, whether the system detects injection attacks, where video is fed in through a virtual camera, emulator or tampered app. Second, whether deepfake detection is a separate layer that names the fake it finds. Third, the false rejection rate for the bank’s own customers. Fourth, whether every decision keeps evidence that staff can review when a customer says “it wasn’t me.”

I build identity infrastructure at Seamfix, and that scene is the one I’d put in front of any bank choosing a biometric fraud prevention platform.

Face match and liveness are not enough

When you’re choosing one, the first two questions feel obvious. Does the face match the ID? Is it a real, live person and not a photo?

Every serious vendor will answer both with confidence, and most will have numbers and certificates to back them up. Those answers matter. They’re just no longer enough, because the fraud has moved.

Check the camera before the face

A few years ago, fooling a selfie check meant holding something up to the camera: a printed photo, a video playing on another phone, a mask. Liveness detection, whether active liveness, which asks you to blink or turn your head, or passive liveness which analyses the capture in the background, was built to catch exactly that, and the good systems got very good at it. There’s an international standard for testing it, ISO/IEC 30107-3, which covers presentation attack detection (PAD). When a vendor shows you a liveness certificate, that’s usually what it refers to.

Now look at what that test assumes. It assumes the picture came through a real camera, and only asks whether the thing in front of the camera was real.

Fraudsters stopped going in front of the camera. They go around it. With a virtual camera, an emulator or a tampered app, they feed a prepared video straight into the verification flow, as if the phone had just recorded it. You’ve seen this in heist films. The thieves loop old footage into the CCTV while they empty the vault. The guard watches the screen carefully. The screen is lying.

A system can hold a liveness certificate and still approve that video, because nobody asked it where the video came from. This is called an injection attack. It has its own testing framework, CEN/TS 18099, a technical specification published by the European Committee for Standardization (CEN) in 2024.

So the first thing I’d evaluate isn’t the face. It’s the camera.

Ask the vendor what happens before liveness runs. How does the system know the frames came from the device’s own camera, live? Has that been tested independently, and against what? If the answer drifts back to the liveness certificate, you’ve learned something.

Treat deepfakes as a separate attack

Then there’s the face itself. Generating a convincing face, or swapping one face onto another in a video, used to take real skill. Now it takes a free face-swap app or an open-source model.. A deepfake isn’t a better mask. It’s a different kind of attack, and catching it takes a different kind of model.

Ask whether deepfake detection is its own layer or a feature folded into liveness. Ask whether it tells you what kind of fake it found. Your fraud team can act on “face swap.” It can’t do much with “failed.” And ask how quickly the models are updated when a new generation technique appears. The tools fraudsters use change faster than most procurement cycles. A deepfake model you never update is like antivirus software you never update. It protects you well against last year’s threats.

Measure false rejection on your customers

Third, look at who gets locked out. Here’s the part nobody puts on the slide: every time you make it harder for a fake to get in, you make it harder for some real people too.

Two numbers are worth knowing by name. The false acceptance rate measures how often a fake gets through. The false rejection rate measures how often a genuine customer is turned away. You can’t push both to zero. Turning one down turns the other up.

Vendors usually quote these numbers from lab conditions: good phones, good light, people who know how to hold still. Your customers include someone opening an account through an agent at a market stall, on a cheap phone, with the sun behind them.

So ask for the false rejection rate of your population, not theirs. Better still, run a pilot through your own channels and count how many genuine customers fail. Each one is a person who gives up, calls your contact centre, or walks into a branch to complain.

Ask to see a decision it got wrong

Which brings me back to that banking hall.

Every fraud system will be wrong sometimes. What matters is what happens next. When a customer sits across from your staff and says “it wasn’t me,” can anyone at your bank see what the system saw when it said yes? The face it captured. The scores. Whether the camera itself was checked. What it flagged and what it let pass.

If all the system kept was one word, “approved,” your staff have nothing to go on but the account. And the account will always point at the person whose name is on it.

So here’s the last thing I’d ask any vendor before signing. Don’t ask them to show you their best decision. Ask them to walk you through one they got wrong, and show you how you would have known.

The platforms worth buying are built so that a wrong decision can be found, explained and reversed before it reaches a customer in a banking hall. That is what trust infrastructure means in practice: evidence, not just a verdict.What that man needed, that day, was a system that could show its working before anyone called the police.