Facial Biometrics vs Deepfakes: The Technology Arms Race Reshaping European Business Security

A finance executive at a Munich-based firm received a video call from someone who looked and sounded exactly like their CFO. The caller requested an urgent wire transfer to close a deal before the end of the quarter. The CFO’s face, voice, and mannerisms were indistinguishable from the real thing. The executive complied. The money moved. The CFO had never made the call.

That incident isn’t isolated. It’s a preview of what happens when deepfake technology meets standard business verification processes designed for a world where a face and voice were reliable identity signals. For European organizations deploying biometric systems, the threat model has shifted fundamentally.

Where Facial Recognition Technology Stands Today

Facial recognition technology is now widely deployed in KYC processes across European financial institutions, telecom providers, and government services. The core workflow is conceptually simple: compare the face captured during onboarding or authentication to a reference image on a government-issued ID document, then confirm that a live person, rather than a photo or pre-recorded video, is presenting that face.

Liveness detection handles the second part. Passive liveness systems analyze subtle signals in the video stream: micro-movements consistent with breathing, skin texture variations, light reflection patterns across different facial planes, and motion consistency that distinguishes a genuine face from a presented image or replay attack. Active liveness systems ask the user to perform a specific action, blink on cue, rotate the head, follow a moving target, to confirm presence and responsiveness.

Facial biometrics combined with liveness detection performs extremely well against the fraud techniques that were standard three years ago: printed photos, face masks, and pre-recorded video replays. The evolving challenge is the emergence of real-time deepfake systems that can now pass some of these tests by generating synthetic faces in the moment, not in advance.

That’s the arms race. Verification technology improves; attack methods adapt. Deepfake generation quality improves; detection methods follow. Neither side is standing still, and the gap between attack and defense capability shifts in both directions over time.

How Modern Deepfakes Attack Biometric Verification

Current-generation deepfake tools can generate real-time video that substitutes a synthetic face onto a live camera feed. When someone opens a video verification session, the liveness detection system sees what appears to be a genuine face making genuine micro-movements, because the deepfake is generated in real time, adapting the synthetic face to the underlying live video feed captured by the attacker’s own camera.

Biometric verification systems in production today are responding with detection methods that probe for signals that generated video hasn’t yet learned to replicate consistently: specific patterns of subcutaneous blood flow detectable under certain light spectrums, the precise relationship between hair movement and head acceleration during rapid motion, and geometric consistency at the face boundary during lateral head rotation. These signals are detectable in controlled conditions with calibrated cameras and lighting. Detecting them reliably at the speed and volume of mass-market consumer verification is harder.

European companies handling high-value transactions or sensitive data need to think carefully about their specific threat model. A retail bank onboarding consumer accounts at scale faces a different risk profile than a private wealth platform handling high-net-worth clients. The cost of generating a convincing deepfake is dropping. The potential return from attacking high-value targets is rising. That math changes the threat level for certain use cases significantly.

What GDPR and the EU AI Act Add

Biometric data is special category data under GDPR. Processing it requires a valid legal basis, usually explicit consent or a statutory legal obligation, and carries elevated obligations around storage, processing period, and data subject rights. European businesses can’t simply adopt the most technically aggressive biometric verification approach available without working through the compliance implications specific to their context and customer relationship.

The EU AI Act, which began its phased application in 2024, adds another layer. Certain applications of facial recognition in real-time contexts carry heightened requirements or restrictions. The definitions matter enormously, and organizations deploying biometric verification for customer onboarding, employee authentication, or physical access control need legal analysis specific to their use case and jurisdiction, not generic guidance.

What Resilient Organizations Are Doing Differently

The organizations handling this well aren’t betting on any single technology. Biometric verification with liveness detection handles identity confirmation at the point of onboarding. Transaction-time signals, device fingerprinting, behavioral analytics, and anomaly detection in real time create additional friction for attackers who’ve somehow passed the initial identity check. Periodic re-verification requirements mean that a compromised account can’t be exploited indefinitely.

Vendor selection matters more than most buyers realize. The quality of liveness detection varies significantly between providers, and the gap between “certified to ISO 30107-3 Presentation Attack Detection Level 1” and “certified to Level 2” represents a meaningful difference in resistance to sophisticated real-time attacks. Asking vendors in particular what adversarial testing they’ve done against current-generation deepfake tools is a reasonable baseline request before signing a contract.

Internal fraud awareness training is underused. The Munich CFO scenario didn’t fail because the verification technology was inadequate. It failed because the executive didn’t have a mental model for the existence of the attack. Video calls can be faked. The procedure for large payment authorizations should include an out-of-band confirmation step by phone to a known number, regardless of how convincing the video looks.

Procurement processes for biometric verification systems should require vendors to disclose their adversarial testing methodology and results, not just their certification status. Certifications reflect performance at a point in time against defined test sets. What matters operationally is how quickly the vendor updates their detection capabilities as attack methods evolve, and whether that update cycle is faster than the attackers.

Further Reading

• ENISA Biometrics Security and Privacy Report (enisa.europa.eu)
• ISO/IEC 30107-3 Presentation Attack Detection (iso.org)

The technology available to attackers is moving faster than the security awareness of most organizations that deploy biometric systems. That gap doesn’t close on its own. It closes when organizations treat the threat model as dynamic and update their verification posture accordingly.