Know the human behind the agent: liveness checks in the age of deepfake onboarding
October 2, 2026 · 6 min read
By Alexandra Pugach, KYCAID · September 2026
In short: AI agents can now take paid work and move money, but responsibility for each agent still sits with the human who owns it. A liveness check, also called liveness detection, confirms that this human is real and physically present at onboarding, not a photo, replay, mask or deepfake. Selfie-only checks no longer stop injection attacks, which feed synthetic video straight into the data stream. Platforms that pay AI agent operators should combine passive and active liveness checks with injection detection before the first payout.
In January 2024, a finance employee at the Hong Kong office of Arup, a British engineering firm, received an email from someone posing as the company's UK-based CFO and asking for confidential transactions. He suspected phishing. A video call with people who looked and sounded like the CFO and several colleagues put him at ease.
He then made 15 transfers to five bank accounts, HK$200 million in total, or about $25.6 million. Every participant on the call except him was an AI-generated deepfake. The Arup case broke a rule most businesses still rely on: seeing a face and hearing a voice tells you who you're dealing with. AI agents are about to test that rule at scale.
What is Know Your Agent (KYA)?
Know Your Agent (KYA) is the practice of verifying an AI agent before it can transact: who operates it, what it is allowed to do and who is accountable for it. The agent can be registered and cryptographically signed. Accountability still ends with a person, so any serious KYA setup includes KYC or KYB on the agent's owner.
Card networks are building the agent side of KYA. Mastercard launched Agent Pay on April 29, 2025, and the program requires trusted AI agents to be registered and verified before they can pay on behalf of their users. Visa's Trusted Agent Protocol lets merchants identify a registered agent, tell whether it wants to browse or pay, and link it to a consumer identity.
Mastercard's chief digital officer Pablo Fourez described the merchant's dilemma as three questions: is this a legitimate agent or a malicious bot, did the consumer authorize it, and did it follow the instructions correctly.
Agent protocols verify the software. They say much less about the owner, and you can't sanction software, sue it or ask it for proof of source of funds. In September 2026, Mastercard's Sherri Haymond told American Banker that "there needs to be transparency about who owns that agent".
What is a liveness check?
A liveness check, also called liveness detection, confirms that a real person is physically present in front of the camera during identity verification, not a spoof such as a photo, a video replay, a mask or a 3D model. Liveness engines look for texture cues, motion parallax, responses to challenge prompts and sensor telemetry.
A liveness check runs before the face match that compares the selfie with the ID photo. Without the liveness step, a good enough deepfake of the document holder can pass the face match.
What does NIST SP 800-63-4 require for liveness?
NIST SP 800-63-4, the US digital identity guidelines finalized in 2025, makes presentation attack detection (PAD) mandatory whenever biometrics are collected and compared remotely. The guidelines set an impostor attack presentation accept rate (IAPAR) below 0.07 and require PAD testing to conform to ISO/IEC 30107-3:2023.
NIST SP 800-63A also treats injection attacks as a separate threat. According to NIST, live capture and PAD make injection harder but don't cover every case.
Why can deepfakes beat a selfie check?
A basic selfie check verifies an image, and generative AI now produces convincing images and video of real people. Fraudsters use face-swap apps and synthetic video to open accounts in other people's names and to take over existing ones.
Entrust's 2025 Identity Fraud Report recorded a deepfake attempt every five minutes in 2024. The report also found that digital forgeries overtook physical counterfeits for the first time, making up 57% of document fraud.
According to Entrust's data, deepfakes accounted for 24% of fraudulent attempts against motion-based liveness checks, but only 5% of attempts against basic selfie checks. My reading is that fraudsters bring out expensive tooling once the cheap tricks stop working, so attackers will follow a platform up the ladder of checks.
What is an injection attack?
An injection attack inserts forged or modified media between the point of capture, such as a user's phone, and the system that compares the biometrics. A presentation attack holds a fake up to a real camera. An injection attack skips the camera entirely and feeds a fake stream through a virtual camera, an emulator or a tampered app.
In February 2024, Gartner reported that injection attacks grew 200% in 2023, although presentation attacks remained the most common vector. Gartner predicted that by 2026, deepfakes would lead 30% of enterprises to stop treating face-based identity verification as reliable in isolation.
Gartner analyst Akif Khan explained why: the standards used to test presentation attack detection don't cover digital injection of modern deepfakes. Gartner's advice is to pair PAD with injection attack detection and image inspection, then add device identification and behavioral analytics.
Passive vs active liveness: what is the difference?
Passive liveness analyzes the selfie capture and asks nothing of the user. Active liveness adds a challenge, such as turning the head or following a prompt. The table below compares passive liveness, active liveness and injection attack detection, the three layers of a deepfake-resistant liveness check.
| Passive liveness | Active liveness | Injection attack detection | |
|---|---|---|---|
| What it checks | Spoof signs in the capture: texture, depth, synthetic artifacts | The user's response to a random prompt | Whether the stream came from a genuine camera on a genuine device |
| User effort | Just a selfie | A few seconds of movement | None |
| Stops | Printed photos, screen replays, many masks | Pre-recorded clips and replays | Virtual cameras, emulators, tampered apps |
| Weak spot | Injected streams | Injected streams, real-time face swaps | Doesn't judge the face itself |
Why do AI agent marketplaces need liveness checks?
Picture a marketplace where operators connect an AI agent, the agent completes paid tasks and the operator gets paid in stablecoins after review. Seen from a fraud analyst's desk, this model is a payout rail with a thin identity layer on top.
The likely attacks don't need a malicious agent, only a fake human layer: one person registering fifty operator accounts to farm bounties, a sanctioned individual collecting payouts through a synthetic identity, a stolen identity verified with a face swap. The same pattern applies to AI agents in wallets, betting platforms that already fight multi-accounting, crypto services with AML obligations and remote hiring.
Liveness checklist for platforms that pay AI agent operators
- Verify the operator, not just the agent. Tie every agent credential to a verified person, or to a verified company through KYB, before the first payout.
- Run passive liveness at onboarding and again whenever money is about to leave: the first withdrawal, a change of payout wallet, account recovery. KYCAID, an identity verification provider, quotes an average check time of 11 seconds and charges per completed verification, with no subscription or minimum spend.
- Run liveness before comparing the selfie with the ID photo, and fail fast on obvious spoofs.
- Step up to active liveness when risk signals appear, such as a new device or an unusual payout pattern. Rotate the prompts so a pre-rendered clip can't anticipate them.
- Ask your identity verification vendor two questions: has its PAD been tested against ISO/IEC 30107-3, and how does it detect virtual cameras and emulators?
- Look for the same face across different accounts, one of the cheapest multi-accounting signals.
- Tune liveness thresholds by risk and log the quality scores for audits.
FAQ: liveness checks and AI agents
Can a deepfake pass a liveness check?
A deepfake can beat a weak liveness check, especially a selfie-only check with no injection detection. A deepfake is far less likely to pass a check that combines presentation attack detection tested to ISO/IEC 30107-3 with injection attack detection and device signals.
Is a liveness check the same as face recognition?
No. Face recognition compares two faces and answers whether they belong to the same person. A liveness check answers whether a real, physically present person is in front of the camera at all. Identity verification needs both, and the liveness check runs first.
How do you perform a liveness check?
The user takes a selfie or a short video inside the verification flow. A passive liveness check analyzes that capture automatically, and an active check also asks the user to follow a random prompt. The system scores the result, then passes the session to a face match against the ID document.
When should a platform re-run a liveness check?
A platform should run a liveness check at onboarding and repeat it at high-risk moments: the first withdrawal, a change of payout details, account recovery, or a login from a new device. For AI agent marketplaces, the first payout to an agent operator is the most important checkpoint.
The Arup employee did the right thing: he doubted the email and asked to see faces. Platforms that let AI agents earn and spend money should assume a face on camera can be generated, and verify that a live person is in front of a real camera, and that it is the same person who will collect the money.