How Does Face Swap Detection Work for KYC Selfie and ID Checks?

How a face swap is built and why it fools face matching

A face swap replaces the facial identity in a target video or image with someone else's, while keeping the target's head pose, expression and lighting. Most tools follow the same pipeline: detect and align the face in each frame, encode the identity of the source face, generate a new face that carries that identity with the target's expression, then blend the generated face back into the frame and smooth the edges. The foundations guide on face swaps explains the model families in more detail.

In KYC the attacker is the target and the victim is the source. The attacker sits in front of a camera, a swap tool replaces their face with the victim's in real time, and the output is fed to the verification app. The face matcher compares that output with the photo on the victim's stolen or forged ID and finds a match, because the identity was copied from the victim. The attacker's own movements drive the face, so head turns, blinks and spoken phrases come out on cue.

Fully synthetic faces work slightly differently. ProKYC, the tool Cato Networks researchers described in October 2024, generated a fake person, placed that face on a forged passport, and produced a deepfake video of the same person to feed in place of the live camera. Either way, the selfie and the ID agree with each other, and both are fake.

How are face swap attacks detected?

Face swap attacks are detected by models trained to recognise the statistical traces each stage of the swap pipeline leaves in the media. No single trace is reliable on its own, so detectors combine several.

Research has supported this approach for years. The FaceForensics++ benchmark built a database of over 1.8 million manipulated images from four methods (DeepFakes, Face2Face, FaceSwap and NeuralTextures) and showed that detectors using domain-specific knowledge reach high accuracy even under strong compression and clearly outperform human observers. Detection quality still depends on training data that reflects current generators, which is why models need regular retraining.

• Blending boundary: the generated face is pasted into the frame, which leaves a seam in texture, sharpness or noise along the jaw, hairline and ears.
• Lighting and colour: the inner face may carry slightly different illumination, skin tone or specular highlights from the neck and background.
• Geometry: teeth, glasses frames, earrings and hair crossing the face are hard to regenerate and often warp or blur.
• Temporal consistency: in video, the swapped region can flicker, drift or lag a frame behind head motion, especially during fast turns or occlusion by a hand.
• Generator fingerprints: upsampling layers and diffusion or GAN decoders leave periodic patterns that show up in frequency-domain analysis, even when the face looks clean to people.

Detecting face swaps in selfie checks versus ID document checks

In the selfie or video step, face swap detection should run on the same capture that liveness and face matching use, before the onboarding decision. Single images are scored on spatial traces. Video adds temporal evidence, so short clips with some head movement give the detector more to work with than one frame.

On the ID document, the face may have been replaced in the portrait area or the whole card generated. FinCEN's November 2024 alert reports criminals using generative AI to alter or create images for driver's licences and passport cards, and lists a photo that shows visual signs of alteration or does not fit the customer's stated age as a red flag. Document checks are a separate control; the guide to document deepfake detection for KYC covers them.

Cross-checks between the two help. If the selfie face and ID portrait match unusually closely in pose and lighting, or the same face appears across several applications with different names, those are signals for review even when each image scores clean on its own.

Evidence that face swaps target remote identity verification

iProov reported in February 2024 a 704% increase in face swap attacks against remote identity verification between the first and second halves of 2023, alongside a 353% rise in threat actors using emulators. It described face swaps fed into virtual cameras, with emulators used to hide those virtual cameras from detection.

Group-IB reported the same month on GoldPickaxe, an iOS trojan that collected face videos and ID card photos from victims in Thailand. Group-IB assessed that the operators used AI face-swapping services with the stolen material to impersonate victims at banks, while noting it had not documented that use in the wild.

Cato Networks' Etay Maor pointed out a real constraint for defenders when describing ProKYC: making biometric checks stricter raises false positives. That trade-off is why dedicated manipulation signals, which look for swap artifacts instead of tightening match thresholds, are useful.

How NeuroVerify detects face swaps in KYC flows

NeuroVerify takes the selfie image, video or audio from your flow and returns one unified risk score with signal-level evidence from six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. Face Manipulation Detection targets swaps and reenactment, AI Generative Model Analysis targets synthetic faces and generator traces, and AI Pixel-Level Manipulation targets local edits.

Eligible image requests return in under 200 ms p95 under defined test conditions, so detection can gate the onboarding decision instead of running after the account opens. Integration uses Android, iOS and Flutter SDKs, Python, TypeScript, Go and Java backend SDKs, or the REST API.

The detection models build on ARCAS 1B, Neural Defend's deepfake detection foundation model. On the public VendorBench-100 benchmark, whose 100 adversarial still images include face swaps, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. One VendorBench author also co-authored the ARCAS paper, the benchmark covers still images only, and its corpus and results are public.

Where face swap detection falls short

Detection is probabilistic. Heavy compression, very low resolution and generators the model has not seen raise miss rates, and some genuine selfies with filters or beauty modes raise false alarms. Thresholds should be set on your own traffic and reviewed as generators change.

Face swap detection also cannot judge the capture path or the document. Pair it with liveness detection, device attestation and virtual camera checks, and with a document control for the ID image. The comparison of deepfake detection vs liveness detection shows how those layers divide the work.