Written by: Mikhaylo Pavlyuk, Digital Identity Consultant
Face biometrics is becoming a popular and secure method for digital identity verification in multi-factor authentication (MFA) or two-factor authentication (2FA) systems.
However, like all technology, it’s not without its flaws. Challenges like spoofing attacks or false matches can compromise the system’s reliability and leave it vulnerable to fraud attacks.
In this article, I’ll explore 5 main bottlenecks of face authentication in 2FA/MFA systems—and more importantly, show you how to overcome them to build a robust and secure digital identity verification.
However, like all technology, it’s not without its flaws. Challenges like spoofing attacks or false matches can compromise the system’s reliability and leave it vulnerable to fraud attacks.
In this article, I’ll explore 5 main bottlenecks of face authentication in 2FA/MFA systems—and more importantly, show you how to overcome them to build a robust and secure digital identity verification.
1. Reducing False Match Rate (FMR)
Problem: A high False Match Rate (FMR)—the probability of incorrectly authenticating an unauthorized user—increases the risk of unauthorized access. Unfortunately, standard FMR benchmarks often fail to account for potential spoofing attempts, leaving the system vulnerable to various forms of fraud.
Solution: To minimize security risks, maintain an FMR of 1 in 1000 or better under zero-effort impostor attempts, as defined in the ISO/IEC 30107-1 standard.
2. Addressing the Probabilistic Nature of Facial Biometrics
Problem: Unlike passwords or PINs, which provide a yes/no response for authentication, biometrics is based on probabilities. This probabilistic nature means that face recognition systems may occasionally produce uncertain results.
Solution: To build a more reliable authentication system, combine face authentication with deterministic factors like digital signatures or PINs. By using multiple verification factors, you create a stronger 2FA/MFA that ensures both accurate and secure identity verification.
3. Securing Biometric Templates
Problem: Biometric credentials, such as facial recognition data, cannot be easily changed or reset if they are compromised. If a biometric template is leaked or stolen, attackers could potentially impersonate the user indefinitely.
Solution: To protect against such vulnerabilities, it’s crucial to implement biometric template protection schemes with credential revocation, so that compromised biometric templates can be invalidated and replaced.
4. Preventing Spoofing with Presentation Attack Detection
Problem: Fraudsters can attempt to bypass face authentication using photos, videos, or even 3D masks.
Solution: Implement PAD technology—specifically liveness detection—to effectively spot and block spoofing attempts. To maximize effectiveness, ensure that your PAD solution achieves at least 90% resistance to known presentation attacks. Additionally, consider deploying PAD locally on user devices or centrally within your verification system for better performance and scalability.
5. Limiting Failed Authentication Attempts
Problem: Allowing unlimited failed authentication attempts opens the door for brute-force attacks, where attackers repeatedly try to gain access by guessing or manipulating the system.
Solution: Introduce incremental delays (e.g., 30 seconds) after several failed authentication attempts (e.g., five). Also, disable face authentication after a set number of failed attempts and require alternative verification methods (such as PINs or OTPs) to ensure that unauthorized users are blocked from gaining access.
All the patterns above we've implemented in 3DiVi BAF, a biometric identity verification platform — and they work in production.
→ 3DiVi BAF Platform Overview
