What are presentation attacks?

Presentation attacks are attempts by malicious actors to deceive biometric systems by presenting fake biometric data, such as a photo, video, mask, or synthetic voice, to impersonate a legitimate user. These attacks are designed to bypass security controls during digital identity verification or authentication. In the context of EU regulations like eIDAS and AML5, detecting and preventing presentation attacks is essential to maintain the integrity of remote identification and trust services. 

How presentation attacks work

Presentation attacks, also known as spoofing attacks, target biometric systems by exploiting the input phase, i.e. when the system collects data from the user. For example, an attacker might try to access a service by showing a printed photo to a facial recognition system or using a voice recording to mimic someone’s speech. These attacks are particularly dangerous in remote onboarding or electronic signature scenarios, where high assurance of identity is required. 

To counter these threats, liveness detection and presentation attack detection (PAD) technologies are employed. These tools analyze real-time biometric cues (like blinking, skin texture, or micro-movements) to verify that the input is coming from a live human, not a reproduction.  

In line with eIDAS and AML5 guidelines, qualified trust service providers must implement strong anti-spoofing measures to ensure secure and compliant digital identification processes. Preventing presentation attacks protects users and service providers from identity fraud, unauthorized access, and legal risk.   

^{Key characteristics} 

• Aim to bypass biometric security using fake or manipulated input 
• Often involve photos, videos, masks, or audio recordings 
• Target the data capture stage of biometric systems 
• Mitigated using liveness checks and presentation attack detection (PAD) 
• Considered a key threat in remote identification and onboarding workflows 
• Must be addressed to comply with eIDAS, GDPR, and AML5 
• Require ongoing testing and calibration of biometric systems to remain effective  

^Examples  

• An attacker attempts to open a bank account using a printed photo of someone else’s face during remote verification 
• A fraudster replays a voice recording to trick a voice-based authentication system on a call center line 
• A user tries to bypass a facial recognition step with a video loop on a smartphone during a QES issuance 
• A deepfake video is used to impersonate a corporate executive during a high-value contract signing       

^{Related terms} 

• Liveness check 
• Biometric identification 
• Electronic identification 
• Qualified electronic signature (QES) 
• Identity fraud prevention 
• eIDAS    

^References 

European Union Agency for Cybersecurity (ENISA) – Biometric Spoofing and PAD 

EDPB – Guidelines on biometric data under GDPR