Liveness Detection for Philippine Apps: SDK Guide

Liveness detection checks that a selfie comes from a real, present person rather than a photo, a screen replay, a mask, or injected video. Philippine apps add it through an SDK that runs during selfie capture, either passively from a single frame or actively with prompts such as turning the head. Choose passive for low friction, add active steps for high-risk moments, and tune capture for the entry-level Android phones many Filipino users carry.

What Liveness Detection Does in eKYC

Face matching asks whether two faces look alike. Liveness, by contrast, asks whether the selfie was taken from a breathing person just now. Without that step, anyone holding a stolen card plus a picture of its owner can slip through face matching.

That is why, in a Philippine eKYC flow, liveness sits between ID capture and face comparison.

1. ID capture and record check. First, the app reads the ID and confirms its details with official sources.
2. Liveness. Next, the SDK rules out photos, replays, and masks during capture.
3. Face comparison. Then the backend scores the verified selfie against the card photo.

The same check also protects later moments, such as a new device login or a large transfer. For the threat side, meanwhile, read how deepfake attacks target local apps.

Passive vs Active Liveness

Liveness comes in two styles. In fact, most mature apps use both, picking one or the other by risk.

Aspect	Passive liveness	Active liveness
User action	None beyond taking a selfie	Follow prompts, such as turning the head or opening the mouth
Time	About as fast as a normal photo	A few extra seconds
Drop-off	Lowest	Higher, especially for older users
Strength	Strong against photos and many replays	Adds resistance to pre-recorded video
Best use	Standard onboarding, routine step-up	High-value accounts, repeated failures, suspicious sessions

A practical pattern is to start passive for everyone, then trigger an active check when risk rises. For example, ask for a head turn after a failed passive attempt, or before a transfer to a new recipient. Verihubs supports both: a passive liveness API that works from one image, and a web SDK that adds active prompts.

Spoofing Attacks It Stops: Photos, Replays, Masks, Deepfakes

Attackers escalate as defenses improve. So here is what a liveness check should catch.

Attack	How it works	What catches it
Printed photo	A paper copy of the victim’s face held to the camera	Texture, depth, and reflection cues
Screen replay	A photo or video of the victim played on another device	Moire patterns, screen edges, and glare
Mask	A 2D cut-out or 3D mask of the victim’s face	Depth and skin cues, plus active prompts
Injected video	A deepfake fed straight into the camera stream by malware or an emulator	Device integrity signals and injection detection

Injection attacks deserve special attention, since they bypass the camera entirely. So a liveness SDK should also check the device itself. Verihubs’ VeriSecure SDK, for instance, pairs liveness and deepfake checks with detection of emulators, rooted devices, hooking tools, and traffic interception. Standards such as ISO/IEC 30107-3 describe how presentation attack detection is tested, which helps when comparing vendor claims.

SDK Integration for Android and iOS

Integrating a liveness SDK follows a similar path on every platform. First, confirm which native and web SDKs your provider offers, then plan these steps.

1. Add the SDK. First, include the library in your Android or iOS project, or load the web SDK in your onboarding page.
2. Request camera permission. Next, explain why you need the camera before the system prompt appears; otherwise many users tap “deny.”
3. Launch the capture flow. Then start the SDK’s selfie screen, with on-screen guidance in English and Filipino.
4. Receive the result. After capture, the SDK returns a result or a token for your backend.
5. Verify on the server. Then your backend confirms the liveness result with the provider, never trusting the app’s word alone.
6. Chain face matching. Finally, the backend compares the verified selfie with the ID portrait.

Server-side confirmation matters because a tampered app can fake a “pass” message. So treat the client result as a claim and the server check as the decision. When you are ready to evaluate a provider, Verihubs liveness and face recognition can be tested on your own app flow.

Tuning for Low-End Phones and Poor Lighting

Many Filipino users onboard with entry-level Android devices, often in dim rooms or bright sun. Therefore, tuning for real conditions matters more than lab accuracy.

Condition	Problem	Fix
Low-resolution front camera	Fewer detail cues for the model	Capture at the highest available resolution; avoid digital zoom
Dim indoor light	Noise and blur	Detect low light and ask users to face a window or lamp
Strong backlight	Face appears dark	Prompt users to turn so light falls on their face
Weak connection	Uploads time out	Compress carefully, retry automatically, and resume sessions
Older OS versions	SDK features unavailable	Check minimum versions and provide a web fallback

Also measure failure rates by device model and region. If one popular handset fails far more often, adjust guidance or thresholds for it rather than for everyone. Also give users one guided retry before routing them to review, since a single failed selfie is usually a lighting problem, not fraud.

Measuring Liveness Performance

Two error rates matter, and, unfortunately, they pull in opposite directions.

• Attack acceptance: the share of spoof attempts that pass. Here, lower is safer.
• Genuine rejection: the share of real users who fail. Likewise, lower means better conversion.

Tightening the check reduces attacks but rejects more real users, and loosening it does the opposite. So track both every week, alongside completion rate and time to complete. For background on independent face technology testing, see our article on NIST benchmarks.

Where to Use Liveness Beyond Onboarding

Many apps run liveness only at sign-up. However, fraud often arrives later, after an account already looks trusted. So consider these extra checkpoints.

Moment	Why it is risky	Suggested check
New device login	Scammers often take over accounts from their own phones	Passive liveness plus face match to the enrolled face
Phone number or email change	The first step of many takeovers	Active liveness
Large or first-time transfer	The moment money actually leaves	Passive liveness, with active as a fallback
Dormant account reactivation	Sold or rented accounts often wake up suddenly	Active liveness and a fresh record check
Account recovery	Social engineering targets recovery flows	Liveness plus face match before access is restored

These checks take seconds, yet they block scammers who obtained a customer’s login details, because the scammer cannot supply the customer’s live face. Our guide to account takeover describes how such attacks unfold, while our overview of biometric verification covers the wider toolkit.

Frequently Asked Questions

What is liveness detection?

In short, it proves that a real human took the selfie at that moment, rather than a photo, screen, mask, or injected video standing in for one.

How do passive and active liveness differ?

Passive liveness works from a normal selfie with no extra action. By contrast, the active style has users follow prompts, such as turning their head, which adds friction but also resistance to some attacks.

Do I need a native SDK, or is a web SDK enough?

A web SDK suits browser-based onboarding and quick launches. However, native SDKs usually give better camera control and device integrity checks inside mobile apps. Many teams use both.

Can liveness detection stop deepfakes?

It stops many, especially when combined with device integrity and injection detection. Deepfakes fed directly into the camera stream are the main reason those device checks matter.

Why might a real customer fail the check?

Typically, the causes are poor lighting, low-quality cameras, and unclear guidance. Better capture prompts and one guided retry fix most cases.

Prove Presence, Then Compare Faces

Liveness detection is what turns a selfie into evidence. For Philippine apps, start with passive checks for everyone, add active prompts and device integrity signals when risk rises, verify every result on your server, and tune for the phones your users actually own. Then face matching can do its job on a selfie you know is real.

Adding liveness to your onboarding or step-up flow? Test the Verihubs liveness SDK on real devices.