What liveness detection requires in Argentina
It is worth starting with an honest clarification: Argentine rules require an outcome; they do not always name the control. What the UIF asks of an obligated party is to identify and know its customer before they transact, and for financial institutions the BCRA also regulates how that remote onboarding is done. None of those requirements is met if there is a photograph on the other side.
That is where the real obligation comes from, even if the text uses other words: in a sign-up with no physical presence, the process has to be able to state that the person was there, at that moment, and that it was them.
Liveness detection is the control that settles exactly that. It determines whether the captured face belongs to a real, present person, and not to a photograph, a replayed video, a mask or a face generated by a model. It is applied in two ways:
- Passive — analyzes presence signals in the capture without asking anything of the user. It adds no friction and does not tell the attacker what is being measured.
- Active — asks the person to carry out random instructions, such as turning their head or following a dot. It adds friction and produces an interaction that is hard to prepare in advance.
Both are legitimate and respond to different threats. The decision of which one to use, or how to combine them, is a matter of risk design and not of compliance.
Two things liveness detection does not do, and that are often attributed to it. It does not say who the person is: that is settled by biometric matching against the document. And it does not replace document verification: a live face holding a fake document is still fraud.
Everything that control captures is biometric data, and it falls under Argentina's personal data protection regime: a specific purpose, a legal basis for processing, notice to the data subject and proportionate security measures.
What VU automates in liveness detection
VU runs the control and produces its evidence within the same verification flow, in its passive and active forms.
The part that can be independently verified is the part that matters. VU's liveness detection is certified by iBeta at Level 2 of its testing program, which applies the methodology of the ISO/IEC 30107-3 standard. Specifically, it means that an accredited, independent laboratory built and ran attack instruments against the system and measured how many were accepted. It is not a provider's statement about itself, and it can be forwarded internally when someone asks who tested this and against what.
Two clarifications about that certification that are worth having clear before comparing providers:
- The standard defines the method and the metrics, and it does not define levels. The levels belong to iBeta's testing program, which grades them by the time, expertise, equipment and cost required to build the attack instrument. It runs from Level 1, low-cost and easy to build, to Level 3, highly prepared instruments such as custom-made hyper-realistic masks.
- Its scope is presentation attacks, that is, those carried out in front of the capture device.
And what VU does not do:
- Injection attacks are another category and fall outside that scope. A synthetic video inserted directly into the channel, without going through the camera, is not tackled with the same control or measured with that methodology. It is a real problem, it has its own page and it needs integrity controls on the capture channel.
- Liveness detection does not identify anyone. It establishes that a real person is present. Who that person is gets settled by matching against the document.
- It does not decide whether the sign-up is approved. It produces a result and evidence; what is done with a doubtful result is the obligated party's policy.
Use cases in Argentina
Where this problem shows up in the real operation of the Argentine market.
Remote sign-ups at wallets and banks. It is the exact point where an attacker with a photo of someone else's DNI, obtained in a leak or bought, tries to pass as the holder.
Access recovery. When someone has lost their phone or second factor, liveness detection is once again the deciding control, and it is the moment account takeover attacks exploit most.
Updating the data of long-standing customers. Re-verifying a person who is already a customer requires the same control as sign-up, on a population that, moreover, does not expect to have to do it.
Circulation of document images. Photos and screenshots of DNIs circulate over messaging apps and in leaks. Any process that settles for the image can be attacked with material that already exists.
Ever-cheaper deepfakes. Generating a convincing synthetic face no longer requires specialized equipment, and that moves the floor of what a control has to withstand.
Frequently asked questions
Liveness detection is the control that determines whether the captured face belongs to a real person present at that moment, and not to a photograph, a replayed video, a mask or a face generated by a model. A regulator requires it because without it biometric matching is trivial to fool: a photo of the holder is enough. There are two ways to apply it: passive, which analyzes presence signals without asking anything of the user, and active, which asks them to carry out random instructions. What makes it possible to compare implementations is the ISO/IEC 30107-3 methodology, which measures how many presentation attacks a system accepts in an independent laboratory.
No, and in Argentina the confusion is common because the Spanish term, prueba de vida, is used for both. The pension proof of life is the periodic procedure by which a beneficiary shows the paying agency that they are still alive, in order to keep receiving payments. The liveness detection this page is about is a technical control within an identity verification process: it decides whether the face reaching the camera belongs to a person present at that instant. They share a name and an underlying logic, and they share neither the regulatory framework nor the process.
Active liveness asks the person to carry out random instructions, such as turning their head, moving closer or following a dot on the screen, and assesses how they respond. Passive liveness analyzes presence signals in the capture itself, without asking for anything. The active form produces an interaction that is hard to prepare in advance but adds friction and shows the attacker what is being measured; the passive form adds no friction and is harder to anticipate. Neither is superior in the abstract, and what makes it possible to compare specific implementations is not the modality but how many attacks each one accepts when measured with a common methodology.
By laboratory evidence, not by product description. The ISO/IEC 30107-3 standard defines the method and metrics for evaluating presentation attack detection, and an independent test measures how many attack instruments the system accepts. Three things are worth looking at: who ran the test, against what level of attack potential, and how recent it is. A provider that describes its technology with adjectives and does not show a third-party test is asking to be believed, which is exactly what a compliance regime does not accept.
