Since financial institutions moved their services online, traditional authentication methods such as passwords and other knowledge-based methods have been the go-to. But in the age of sophisticated fraud techniques, these methods no longer stand up to scrutiny.  

Financial services have thus been moving to biometrics as the primary identity verification method during KYC. Rather than relying on something you know, such as a password or a puzzle, biometrics rely primarily on something you are — from your facial features or fingerprint to your unique behavioural patterns. Biometric verification occurs during onboarding to ensure the authentic identity of the customer. Then, biometric authentication confirms that this same person returns over time.  

This article covers why biometric authentication is becoming the standard for financial services, what the technology actually involves, and what institutions should look for in a solution. 

Why traditional authentication is no longer enough 

Traditionally, customers could reliably log in to banks or other institutions by simply entering a unique password or PIN. However, as fraud techniques have improved (and attempts have increased), knowledge-based authentication methods are increasingly vulnerable.   

If a customer is a victim of a phishing, credential stuffing, social engineering, or deepfake attack, passwords and PINs give criminals unfettered access to their accounts. And unlike in other industries, authentication failures in financial services carry direct financial loss, as well as regulatory liability and reputational damage.  

What institutions need is an authentication method that is both harder to spoof and frictionless for legitimate users. Biometric authentication addresses both. 

To learn more about biometrics, read our guide here.  

What is biometric authentication? 

Biometric authentication verifies a customer’s identity by comparing a live biometric capture (typically a selfie photo and video) against a saved biometric from a previous verified session.  

To understand biometric authentication, it helps to first distinguish it from biometric verification. Verification happens at onboarding: a customer's live biometric capture is compared against their identity document to confirm they are who they claim to be. Authentication happens after onboarding. Each time a customer returns, their biometrics are compared against the reference established at onboarding to confirm that they are the correct person. In effect, verification establishes the customer’s identity once, and authentication confirms it with each new log in. 

How biometric authentication works 

Biometric authentication is initiated when a customer initiates an action, such as logging in, authorising a large transfer, or updating their account details.  When this happens, they are immediately prompted to take a selfie before the action can move forward.  

Behind the scenes, that selfie goes through several checks in sequence. First, liveness detection analyses the image for signs of spoofing, such as a printed photo, a video replay, or a deepfake. A capture that fails liveness is rejected immediately. 

If it passes, 1:1 matching compares the selfie against the facial reference captured at onboarding: a direct comparison between the live capture and a single stored reference. The system generates a match confidence score, and if it meets the required threshold, the action proceeds. (1:N matching goes even further, as explained below.) 

Throughout this process, device and location signals, such as geolocation and device fingerprint, run at the same time. An exact facial match from a recognised device in an expected location carries more weight than the same match from an unrecognised device in an unusual geography, all without adding an additional step for the customer. 

Why liveness detection is the critical differentiator 

As you can see, liveness detection is a critical part of the authentication process. But not all liveness detection systems are created equal. 

Liveness detection works by requiring the subject to perform a real-time action, such as turning their head or blinking. This confirms a live, physically present person is in front of the camera. For a deep dive on liveness detection, head here.  

But fraud techniques are growing more sophisticated, leading to more sophisticated attacks. For example, a liveness system that stops a printed photo may not stop a high-quality video replay. One that stops a video replay may not stop an AI-generated deepfake injected directly into the video stream. All this means that rigorous testing is needed to ensure that liveness detection is actually spotting the right inconsistencies. 

The technical standard for that evaluation is called presentation attack detection (PAD), assessed under ISO/IEC 30107-3. PAD defines the methodology for testing a liveness system's resistance to spoofing attacks, and is the framework against which independent certifications are given. 

The most rigorous of those certifications is iBeta Level 2. Whereas Level 1 tests resistance to basic attacks such as printed photos and simple video replays, Level 2 exposes the system to a much broader and more sophisticated range of threats, including 3D masks and advanced synthetic media. For institutions evaluating providers, iBeta Level 2 certification is the most reliable independent indicator that a liveness system will hold up against attacks. 

Liveness accuracy is typically measured using two metrics:  False Acceptance Rate (FAR) and False Rejection Rate (FRR). These capture the rate at which a system incorrectly accepts a criminal, and incorrectly rejects a genuine user.  

Biometric authentication throughout the customer lifecycle 

Most discussions of biometric authentication focus on onboarding. Yet onboarding is a single event, and the customer relationship that follows it can span years. Every sensitive interaction within that relationship represents a potential fraud exposure point. 

The most immediate application beyond onboarding is login and step-up authentication. Rather than relying on passwords for routine account access, institutions can require a biometric match. For higher-risk actions, such as large transfers or account updates, step-up authentication adds a second biometric confirmation at the point of action. This means that even if an account is compromised at the credential level, the fraudster cannot complete high-value actions without passing a live biometric check. 

Beyond login, biometrics support two further use cases across the customer lifecycle: 

• Re-verification: Periodic confirmation that the person using an account is still the verified account holder, without requiring a full KYC flow. This supports the ongoing monitoring obligations that regulated institutions carry throughout the customer relationship.  

• Standalone authentication: Biometric authentication deployable independently of the original KYC provider. If a customer's identity was verified by a different institution or through a different platform, standalone authentication allows a new provider to authenticate that customer biometrically without requiring them to re-register from scratch.  

Together, these capabilities shift biometrics from an onboarding tool to a continuous security layer, reducing fraud exposure across the customer lifecycle. 

The 1:N advantage: Catching fraud that 1:1 matching misses 

Most biometric systems operate on a 1:1 basis — confirming that the person presenting themselves is the same person who onboarded. This is effective, but it only answers half the question. It cannot tell you whether that face has appeared elsewhere in the system under a different name, with different documents, or as a previously rejected applicant. 

That is what 1:N face search does. Rather than comparing a live capture against a single stored reference, it compares it against an entire database of facial images — identifying matches across identities, not just within them. The fraud typologies this catches are those that 1:1 matching cannot reach, including: 

• Duplicate identity fraud — where a fraudster creates multiple accounts using the same face but different documents or slightly modified personal details.  

• Synthetic identity attacks — where AI-generated or manipulated facial images are used to create fictitious identities that pass standard document and face matching checks.  

• Recurring fraudsters — known bad actors whose previous applications were rejected attempting to re-enter under new identities.  

The importance of this capability is growing. As deepfake technology and AI-generated identity tools become more accessible, fraudsters are increasingly able to defeat 1:1 matching while leaving traces across a broader dataset that only 1:N search can find.  

What to look for in a biometric authentication solution 

Not all biometric authentication solutions are equal. As the technology has matured, so has the gap between providers that meet the baseline and those that offer genuinely robust, enterprise-grade capability. When evaluating options, the following capabilities are worth treating as non-negotiable: 

• iBeta Level 2 certified liveness detection: The most rigorous independent standard for presentation attack detection. Level 1 certification is increasingly the minimum; Level 2 is the meaningful differentiator for institutions facing sophisticated spoofing attacks. 

• Configurable tolerance levels: Different institutions carry different risk appetites, and the system should reflect that. A neobank onboarding retail customers at scale has different sensitivity requirements to a private bank onboarding high-net-worth individuals. 

• 1:N face search capability: Essential for institutions where duplicate identity, synthetic identity, or recurring fraudster risk is material. 1:1 matching alone is insufficient if the question is not just who someone claims to be, but whether they have appeared before. 

• Standalone authentication: The ability to deploy biometric authentication independently of the original KYC provider, without requiring customers to re-register. Critical for institutions onboarding through partnerships, acquisitions, or third-party flows. 

• Full audit trail: Every authentication outcome, whether passed, failed, or escalated for manual review, must be documented and available for regulatory examination.

• High automation rate: The system should resolve the majority of authentications without manual intervention, reserving human review for genuinely ambiguous cases whilst maintaining accuracy. 

  
  

Biometric authentication with Fourthline 

Fourthline's biometric authentication solution combines iBeta Level 2 certified liveness detection, configurable tolerance levels, 1:N face search, and standalone authentication, deployable even when the original KYC was completed by a different provider. Every authentication outcome, whether automatically resolved or escalated for review, is captured in a complete audit trail, so that your team is compliant and ready for regulatory examination at any time. 

Explore Fourthline's biometric authentication solution → 

FAQs  

What is the difference between biometric verification and biometric authentication? 

Biometric verification and biometric authentication are related but distinct processes. Verification happens at onboarding. A customer's live biometric capture is compared against their identity document to confirm they are who they claim to be. Authentication happens afterwards: the same customer's biometric is compared against the reference established at onboarding to confirm they are the same person returning. Verification establishes identity once; authentication confirms it repeatedly throughout the customer relationship. 

What is liveness detection and why does it matter? 

Liveness detection confirms that the biometric being captured comes from a live, physically present person rather than a photograph, video replay, or synthetic deepfake. Without it, a facial authentication system can be spoofed using readily available materials.  

How does biometric authentication prevent account takeover fraud? 

Account takeover fraud typically relies on stolen credentials, such as passwords, PINs, or answers to security questions, to impersonate a legitimate customer. Biometric authentication removes the credential as the attack surface entirely. Because it requires a live biometric match rather than something that can be stolen, phished, or guessed, it is significantly harder to spoof than knowledge-based authentication.  

What is iBeta Level 2 certification? 

iBeta is an independent testing laboratory that evaluates biometric liveness detection systems against the ISO/IEC 30107-3 standard for presentation attack detection (PAD). Level 2 is the more rigorous of the two iBeta certifications, testing a system's resistance to a broader and more sophisticated range of spoofing attacks — including printed photos, video replays, and 3D masks. For financial institutions evaluating biometric authentication providers, iBeta Level 2 certification is the most reliable independent indicator of liveness detection quality.