A selfie check can be used as a form of step-up authentication. Plaid analyzes fraud risk of a selfie in a few different ways:
Liveness
Users can easily take a selfie video as a part of the identity verification process without disrupting the workflow. Unlike other vendors, users don’t need to do gimmicky head turns with our selfie checks. This helps avoid any poor customer experiences.
Taking a selfie photo is a fallback option for sessions where video permissions were not granted, and selfie photos tend to fail at a significantly higher rate than videos. In a selfie video, multiple frames of the user's image are sampled when determining a fraud risk score. Significantly less data (i.e. a single frame) is available from a selfie photo, so the fraud scoring tends to be more aggressive.
Tamper detection
We’ve bolstered protection against client-side spoofing techniques by identifying indicators of tampered environments. These include jailbroken or headless devices, developer tools inspection, forged user agents, and anomalous browser signatures — tactics frequently employed to emulate trusted environments or automate fraudulent replay attacks.
Facial duplicate detection
Synthetic portraits are increasingly used in ID documents and liveness checks, often superimposed on attackers' faces to bypass verification. While many AI-generated images fail liveness checks, those that succeed are frequently reused across multiple fraud attempts.
To mitigate this, we've introduced facial duplicate detection as a built-in safeguard for all Plaid clients. Each face captured, whether via document upload or liveness session, is cataloged and compared against previously submitted faces (in a privacy-preserving, client-specific silo). This significantly raises the cost and complexity of scaling successful generative AI-based identity fraud.
Age estimation
We've deployed age estimation as another defense layer. By estimating the apparent age of individuals from both ID portraits and liveness sessions, we can validate consistency against declared age data from 1) their government-issued ID and 2) authoritative sources. This further challenges the use of fabricated identities, particularly those relying on generative models to spoof realistic yet mismatched facial features.