Back to All Articles

VerifyNow guide

How to Verify Biometric Liveness: A South African Guide

Ensuring the authenticity of individuals during identity verification is paramount in South Africa. This post guides you on how to verify biometric livenes...

Start verifyingView services
How to Verify Biometric Liveness: A South African Guide

Biometric liveness checks help a business assess whether a submitted face image appears to come from a live person rather than a photograph, screen replay or similar presentation attack. The result is a useful fraud signal, but it is not proof of identity and should not be treated as a complete FICA or KYC decision.

VerifyNow offers passive facial liveness as an API service. It analyses one still face photo and does not ask the person to blink, turn their head or record a video. VerifyNow does not currently offer an active challenge-based liveness service.

This guide explains how to use passive liveness accurately in a South African onboarding workflow, what the result means, and where FICA and POPIA fit.

What Is Biometric Liveness Detection?

Liveness detection evaluates a biometric capture for signs associated with a live presentation. In a facial workflow, it helps detect some attempts to submit an image of another image instead of a current selfie.

There are two common approaches:

  • Passive liveness analyses a face image without giving the user a movement challenge. The capture is usually faster because the person only needs to take one clear selfie.
  • Active liveness asks the user to complete an action, such as turning their head or following an on-screen prompt. It usually requires a short sequence or video.

VerifyNow's service is passive. A single photo is submitted for analysis, and the API returns a status, score and any warnings. References to active liveness in this article explain the category; they do not describe a VerifyNow service.

What a Liveness Result Does Not Establish

A liveness result answers a narrow question about the submitted capture. On its own, it does not establish:

  • the person's name or South African ID number;
  • whether two face images show the same person;
  • whether an identity document is genuine;
  • whether the person meets an age threshold; or
  • whether a business has completed its customer due diligence obligations.

Use a separate Face Match check when you need to compare a selfie with a reference photo. Use an identity or document service when you need ID-backed evidence. These checks can support the same workflow, but their results should remain separate so reviewers can see what each one actually established.

How to Verify Biometric Liveness with VerifyNow

The passive-liveness API accepts one Base64-encoded face image. A practical implementation has five steps.

Step 1: Capture a Suitable Selfie

Ask the person to take a current, front-facing photograph in even lighting. The full face should be visible, in focus and not covered by sunglasses, a mask or another object.

VerifyNow accepts JPG/JPEG, PNG, WEBP and TIFF images of up to 5 MB. The file contents are checked against the declared file type, so changing a filename extension does not convert an unsupported image.

Good capture guidance reduces unnecessary retries:

  • use the device's camera rather than an uploaded social-media image;
  • keep one face in the frame;
  • avoid heavy backlighting and deep shadows;
  • do not apply beauty filters or face effects; and
  • hold the camera still until the image is sharp.

Step 2: Send the Image to the Passive-Liveness Endpoint

Submit the image to:

POST /api/external/passive-liveness

Authenticate with your VerifyNow API key. Production requests also require a unique Idempotency-Key header. Reusing the same key for the same request makes a retry safer; reusing it with a different image is rejected.

The request body contains:

{
  "mode": "production",
  "image_base64": "data:image/jpeg;base64,..."
}

Use sandbox mode while building the integration. Move to production only after the capture, retry, review and consent flows have been tested.

Step 3: Read the Complete Result

The API returns a liveness object containing:

  • status: Approved, Declined or In Review;
  • method: PASSIVE;
  • score: the liveness score;
  • warnings: capture or analysis warnings; and
  • face information associated with the analysed image.

Do not make a decision from the score alone. Read the status and warnings together, preserve the request identifier for audit and support, and define your own response for each outcome.

An In Review result should not be silently treated as approved. It may call for a fresh capture or human review, depending on your risk policy. A declined result can reflect a suspected presentation attack or an unusable capture; your customer message should not accuse the person of fraud.

Step 4: Apply a Risk-Based Decision

Set the action for each outcome before launching:

  • Approved: continue to the next required identity or risk check.
  • In Review: request one fresh capture or refer the case for review.
  • Declined: stop the automated journey and follow the escalation path in your policy.
  • Technical failure: do not invent or display a partial result; offer a safe retry.

Keep the liveness decision distinct from the final onboarding decision. A customer may pass liveness and fail an identity check, or pass an identity check while the selfie needs to be recaptured.

Step 5: Add the Other Checks Your Use Case Requires

Passive liveness is most useful as one layer in a defined workflow:

  1. verify the supplied identity data or document;
  2. run passive liveness on the current selfie;
  3. run Face Match when a reference face comparison is required;
  4. apply screening or enhanced due diligence based on risk; and
  5. record the evidence and decision according to your retention policy.

This layered approach gives a compliance or fraud team clearer evidence than combining several signals under a vague “biometric passed” label.

Does Age Estimation Include Liveness?

Yes. VerifyNow's Age Estimation API returns an estimated age together with a passive-liveness method and score from the same face photo. If your age-estimation workflow already uses that result, you do not need a second standalone liveness call for the same selfie.

The two outputs still answer different questions:

  • age estimation approximates the person's age from the image; and
  • passive liveness assesses the face capture for signs associated with a live presentation.

Neither result proves identity. For regulated age gates or higher-assurance decisions, add the ID-backed or document checks required by your policy. See Age Estimation and the API documentation.

Passive Liveness for iGaming Onboarding

VerifyNow's iGaming onboarding API uses the same selfie for age estimation and its included passive-liveness signal. The bundled workflow does not make a second standalone liveness call. Face Match remains a separate check with its own result.

This distinction matters when designing player onboarding rules. A liveness pass should not be presented as proof of age or identity. Review the age estimate, passive-liveness signal, identity result, face-match result and any duplicate-onboarding or AML/PEP signals according to the operator's risk rules.

See iGaming verification for the complete workflow.

FICA: A Supporting Control, Not a Prescribed Check

FICA does not prescribe passive or active liveness as a mandatory technology. Accountable institutions must identify and verify clients and apply customer due diligence using the risk-based controls documented in their Risk Management and Compliance Programme.

The FIC's Revised Guidance Note 7A explains this risk-based approach. A business may choose liveness as one fraud control where remote onboarding, impersonation or presentation attacks create relevant risk. It must still decide what other evidence is needed for the client, product and delivery channel.

Avoid claims that a liveness result “makes an onboarding FICA compliant”. Compliance depends on the institution's full controls, risk assessment, records and decisions—not one API response.

POPIA and Biometric Information

POPIA treats biometric information used to uniquely identify a person as special personal information. A business using facial liveness should establish an applicable legal basis and, where required, an authorisation for processing before collecting the image.

A defensible workflow should address:

  • a specific, explained purpose for the selfie and liveness check;
  • an appropriate processing condition or authorisation;
  • data minimisation and a defined retention period;
  • reasonable technical and organisational security measures;
  • access controls and an audit trail;
  • operator obligations where another party processes the image; and
  • cross-border processing requirements where relevant.

The Protection of Personal Information Act and the Information Regulator's guidance on special personal information are the appropriate starting points. Your information officer or legal adviser should confirm how the rules apply to your purpose and sector.

Common Implementation Mistakes

Treating Face Match as Liveness

Face Match compares two face images. It does not, by itself, determine whether the submitted selfie is a live capture. Call passive liveness separately unless the workflow uses an age-estimation result that already includes the passive signal.

Treating Liveness as Identity Verification

A live face can still belong to the wrong person. Identity verification requires appropriate reference data or documents, and Face Match is needed when two images must be compared.

Hiding Review Outcomes

Do not collapse In Review into a pass. Show the actual status internally and give the operator a clear review or recapture action.

Collecting More Biometric Data Than Necessary

Avoid indefinite storage “just in case”. Document why the image and result are needed, who can access them and when they are deleted or de-identified.

Frequently Asked Questions

Does VerifyNow offer active and passive liveness?

VerifyNow currently offers passive facial liveness. It does not offer an active challenge or video-based liveness service.

Does passive liveness prove that a person is who they claim to be?

No. It assesses the submitted face capture. Pair it with the identity, document and Face Match checks required by your policy.

Is liveness mandatory under FICA?

No specific liveness method is mandated. Accountable institutions choose proportionate controls under their risk-based programmes.

Can I use the age-estimation selfie for liveness?

Yes. VerifyNow's Age Estimation API includes a passive-liveness method and score from that selfie, so a second liveness call is not needed for the same capture.

Should an In Review result be approved?

Not automatically. Use a fresh capture or human review according to your risk rules.

Add Passive Liveness to Your Workflow

Use VerifyNow's Passive Liveness service when you need a low-friction liveness signal from one face photo. The service is API-only and can be combined with Face Match, Age Estimation and identity checks without blurring the purpose of each result.

Read the Passive Liveness API documentation or create a VerifyNow account to test the integration.