Biometrics became popular because they solved a real problem: authentication was too painful for users and too weak against attackers.
Passwords can be forgotten, reused, phished, leaked, shared, or guessed. One-time codes can be intercepted. Security questions are often scraped from public information. A face scan, fingerprint, or voice check feels different. It is natural, fast, and tied to the person in a way that a password never is.
That usefulness has not disappeared, but deepfakes and generative AI have changed the threat model around biometric authentication. A remote system can no longer assume that a face, voice, or video feed is automatically proof of a live human being in control of the session. AI has made human likeness easier to synthesize, manipulate, and replay.
The lesson is not that biometrics are obsolete, but rather that naïve biometric-only trust is obsolete. The future of authentication is not fewer biometrics, but better biometrics: biometrics combined with cryptographic proof, device and capture-path integrity, trusted execution where appropriate, presentation attack detection, contextual risk, and privacy-preserving architecture.
Biometrics are still useful
It is easy to overcorrect when discussing deepfakes. Some commentary treats AI-generated media as if it makes all biometric authentication worthless. That is not true.
Biometrics remain one of the most important tools in modern authentication because they reduce friction. Most users do not want to manage long passwords, recovery codes, hardware tokens, and repeated verification steps for every interaction. When security becomes too cumbersome, people work around it. They reuse credentials, delegate accounts, disable protections, or abandon products entirely.
Well-designed biometric authentication improves both security and usability. It can make passkeys easier to use. It can reduce password dependence. It can make step-up verification tolerable for sensitive actions. It can also support accessibility when users cannot reliably type complex credentials or manage separate devices.
The key is architecture. Biometrics are strongest when they are used as one signal inside a broader authentication system, not when they are treated as standalone proof.
This is already reflected in standards and industry practice. NIST's Digital Identity Guidelines treat biometrics carefully: biometric systems need controls such as presentation attack detection, attempt limits, and additional authentication context. FIDO passkeys show another important pattern: the user may unlock a local credential with face or fingerprint, but the remote service receives a cryptographic authentication event, not the raw biometric.
Biometrics can make authentication human; cryptography makes it verifiable.
What deepfakes actually change
Traditional biometric fraud often involved physical presentation attacks: a printed photo, a replayed video, a silicone fingerprint, a mask, or a recorded voice. These attacks still matter, and standards such as ISO/IEC 30107 formalize presentation attack detection as a category of biometric security.
Deepfakes add a different kind of pressure. They make fake biometric signals easier to generate at scale and harder for humans to judge.
The most important shift is not only realism. It is accessibility and automation. Attackers no longer need expensive equipment or rare expertise to create convincing media. They can use commercial tools, leaked images, social media videos, and voice samples to produce synthetic identity signals.
For remote identity verification, the dangerous case today is not only someone holding a fake face in front of a phone. It is a virtual camera, emulator, compromised endpoint, or injection path feeding generated media directly into the verification flow. iProov's 2025 threat reporting highlights this shift, citing sharp growth in native virtual camera attacks and face swap deepfake attacks.
This changes what defenders need to prove. The question cannot be only:
"Does this face match the enrolled face?"
It has to become:
"Was this signal captured from a real person, through a trusted path, on a trusted device, in this session, for this action?"
That is a much harder question. It is also the right one.
The main risk areas
Deepfake risk naturally shows up most clearly in workflows where organizations already depend on remote trust.
In customer onboarding and KYC, attackers can use synthetic faces, manipulated documents, and replayed or injected video to create or take over accounts. In account recovery, they can exploit support teams that rely on visual or voice confirmation. In call centers, voice cloning can undermine weak voice-based verification. In enterprise environments, fake video or audio can be used to impersonate executives or employees.
The widely reported Hong Kong deepfake fraud case, where a finance worker was reportedly tricked into transferring about US$25 million after a video call with deepfake colleagues, was not a biometric login bypass. But it illustrates the broader trust problem. Human organizations still treat face and voice as proof. AI makes that assumption fragile.
Why liveness alone is not enough
Liveness detection is important. Presentation attack detection is important. They should be part of any serious biometric authentication system, but they are not a complete strategy. Static liveness checks become training targets. If a system always asks a user to blink, turn their head, smile, or read a phrase, attackers can learn to satisfy the pattern. More advanced systems use passive signals, environmental checks, randomized prompts, and other techniques, but the broader point remains: any single defense can become brittle when attackers can test and adapt.
Also, most liveness detection assumes the biometric capture path can be trusted. If an attacker can inject media after the camera layer, bypassing the sensor entirely, then the system needs defenses beyond "does this video look live?" That is why modern biometric security has to include session integrity, device integrity, capture-path trust, on-device liveness checks, trusted execution environments where appropriate, anomaly detection, and risk-based step-up. The biometric signal matters, but it should not carry the whole burden.
The better model: composable authentication
The better direction is composable authentication.
Instead of asking one factor to prove everything, a system combines several signals:
- Something the user is: face, fingerprint, voice, behavior, palm, or another biometric.
- Something the user has: a trusted device, passkey, FIDO2 hardware key, secure enclave, or device-bound credential.
- Something the user knows or remembers: not weak security questions, but higher-quality knowledge or memory factors that are hard to scrape or socially engineer.
- Something about the session: device posture, app integrity, network risk, behavioral consistency, transaction context, and whether the user is approving the action intentionally.
The usability challenge is deciding when to ask for which proof. The goal should be adaptive friction. Low-risk authentication should feel smooth. High-risk actions, unusual devices, account recovery, large transfers, and administrative changes should require stronger assurance.
This is where systems like AuthenSee are naturally aligned with where the market is heading.
The important idea is not "replace biometrics" or "trust one new factor." It is to combine multiple authentication factors into a proof or attestation that a policy was satisfied. In practice, that can mean using zero-knowledge proofs where they fit, and using on-device ML or TEE-backed liveness where the model itself is not practical to prove in zero knowledge.
In a privacy-preserving design, the verifier should not need to receive raw biometric data, secret answers, or every underlying signal. The verifier should learn that the required authentication policy was satisfied, with each factor checked in the right trust boundary. Nothing more than necessary. That is a better security and privacy model.
Conclusion
Deepfakes do not make biometrics useless, but they expose the limits of biometric-only trust. Biometrics remain important because they make security usable. The next generation of authentication should preserve that usability while strengthening the architecture around it. That means composable systems with a policy-based approach, where different signals can be checked in different trust boundaries.
The winning model will not ask users to choose between convenience and security. It will use biometrics where they are strongest, combine them with other independent factors, and reveal as little as possible to the verifier. Ultimately, ideal authentication should be strong, easy to use, and as transparent as possible for the user.
Sources and further reading
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
- ISO/IEC 30107-1, Biometric presentation attack detection framework: https://webstore.iec.ch/en/publication/24051
- iProov 2025 Identity Fraud Threat Intelligence trends: https://www.iproov.com/infosheets/threat-intelligence-one-pager-key-trends-2025/
- CISA / NSA / FBI guidance on deepfake threats to organizations: https://www.cisa.gov/news-events/alerts/2023/09/12/nsa-fbi-and-cisa-release-cybersecurity-information-sheet-deepfake-threats
- FIDO Alliance privacy principles for authentication and local biometrics: https://fidoalliance.org/fido-authentication-2/privacy-principles/
- Ars Technica coverage of the Hong Kong deepfake fraud case: https://arstechnica.com/information-technology/2024/02/deepfake-scammer-walks-off-with-25-million-in-first-of-its-kind-ai-heist/
Valentin Quelquejay
Valentin is co-founder of Rebellion Systems, where he works on authentication and, more generally, trust in the AI age.
More from Valentin