By Jennifer Kohlhepp, Managing Editor, ICMA

As physical and digital identity systems converge, producing a secure credential is only part of the challenge. Issuers and relying parties must also determine whether the person presenting that credential is its legitimate holder.

FaceTec, an ICMA Platinum Distinguished Partner, believes facial biometrics combined with real-time 3D Liveness detection can provide that connection. Founded in 2013, the company develops software for identity verification, account access, onboarding and age assurance. Its technology supports photo ID scanning, optical character recognition, barcode and NFC scanning, 3D face matching and user reverification. FaceTec reports that its software conducts more than 4.2 billion 3D Liveness checks annualized.

For card manufacturers and credential issuers, FaceTec’s work illustrates how physical credentials can remain relevant as identity becomes more connected and digitally enabled.

Testing Security in the Real World

FaceTec identifies the October 2019 launch of its Spoof Bounty Program as one of the most consequential milestones in its growth.

Although FaceTec participates in independent testing, the company determined that periodic laboratory evaluations alone could not keep pace with rapidly evolving attacks.

“Lab tests don’t simulate real-world bad actors sitting in a basement with deepfake puppets, high-end 3D silicone masks or custom virtual camera injection scripts,” said Geoff Slagle, EVP of Digital Identity at FaceTec. “The process of certification necessarily takes a very long time, moving far more slowly than attack vectors develop on the front lines.”

The continuously available program invites researchers and other participants to attempt to bypass FaceTec’s 3D Liveness software or tamper with its code. It offers a total potential payout of $600,000 and tests the technology against threats ranging from photographs, videos and masks to virtual cameras and hardware based video injection. FaceTec considers this real-world testing an important complement to controlled evaluations, particularly as generative artificial intelligence accelerates the development of new attack methods.

Creating a Living Connection to the Cardholder

Rather than viewing biometrics as a replacement for physical cards, FaceTec sees the technologies as complementary.

Driver’s licenses, passports, payment cards and other credentials contain trusted data and security features. However, even a genuine credential cannot independently confirm that the individual presenting it is the person to whom it was issued. It may have been lost, stolen, shared or presented by a lookalike.

FaceTec’s technology strengthens that connection by verifying that a live person is present and comparing the individual’s biometric information with the identity data associated with the credential.

“We don’t want to kill physical cards,” Slagle said. “We make them far more effective, giving them a digital anchor to an actual live human.”

The company believes this creates an opportunity for card manufacturers to evolve from producing physical products to helping establish trusted credential anchors. In this model, the credential securely carries identity data, while biometric verification provides the live key required to use it.

FaceTec’s patented FaceScan^® technology captures more than 100 video frames over approximately two to three seconds using a standard device camera. Its artificial intelligence analyzes the images to create a 3D FaceMap^® without requiring specialized camera hardware. During enrollment, the FaceMap can be matched against an identity document. In later interactions, a new liveness-proven FaceMap can confirm the returning user’s identity.

A New Type of Biometric Credential

One example of FaceTec’s approach is its development of UR^® Codes. These high density, cryptographically signed two-dimensional barcodes can contain a compressed FaceVector along with selected identity or age information.

When a person presents the code, a relying party conducts a brief 3D FaceScan and compares In-person or remotely, a relying party can conduct a verification using an image for 2D-to-2D matching, or video for a 3D-to-2D match, comparing the live user with the signed biometric information stored in the code. FaceTec says that this approach achieves up to a one-in-two million false accept rate.

Because verification can occur offline, UR Codes can reduce dependence on network connectivity and centralized database lookups. They can also allow users to prove a specific fact, such as meeting an age requirement, without presenting all the personal information contained on a government-issued credential.

Traditionally, someone verifying an identity online might upload a complete image of a driver’s license or passport, potentially exposing an address, identification number and full birthdate. A UR Code can instead carry the signed biometric data and identity claim needed for that interaction. FaceTec’s software matches the code to a live user at the point of verification, helping confirm the claim while limiting unnecessary disclosure.

The company believes this combination of privacy, accessibility and security will make digitally signed visual codes increasingly attractive to governments, financial institutions and credential issuers. A printed code can be inexpensive to issue, displayed on a physical card or digital screen and verified through commonly available devices.

Decentralizing Identity Verification

FaceTec expects demand for decentralized, offline-capable verification to influence credential design over the next three to five years. Centralized collections of photographs and biometric files can create attractive targets for attackers, while hardware-based credentials may present cost, compatibility and scanning challenges in some applications.

By placing signed face data directly on a physical or digital credential, issuers can enable verification without requiring every transaction to contact a central repository. This does not require abandoning secure chips or NFC. Issuers can combine technologies based on risk, cost, infrastructure and user needs.

FaceTec also emphasizes architectural privacy. Its software operates within customers’ servers or private cloud environments, behind their firewalls. According to the company, biometric and personally identifiable information is not sent to FaceTec, allowing issuing authorities and enterprises to retain control of their data.

Preparing for the Deepfake Era

Advances in synthetic imagery, document manipulation and deepfake technology continue to shape FaceTec’s innovation priorities. The company maintains that conventional selfie checks and flat image comparisons are no longer sufficient for high-value identity verification because personal photographs are widely available online and may be used in impersonation attempts.

“Biometrics are not secrets, and treating them like passwords is a fundamental design flaw,” Slagle said. “The only thing that makes facial biometrics secure is 3D Liveness detection performed at the exact moment of interaction.”

FaceTec plans to expand UR Code adoption across mobile driver’s licenses, electronic passports and enterprise identification programs while strengthening its neural networks and continuing its Spoof Bounty Program.

For card manufacturers, these developments point toward a future in which physical credentials remain valuable components of a broader identity system. By combining the security, familiarity and portability of a credential with technology that confirms a live, authorized user, the card can become an active anchor connecting people, credentials and devices.