Capture ID → Document verification → Selfie and liveness → Face match → Decision
A forged document can be caught at the document step. When it is not, a manipulated selfie that matches its portrait carries the application through the face step.
Document-led KYC / NeuroVerify
Deepfake Detection API for Document Tampering
When an applicant submits an ID document, the attack rarely stops at the document. A forged or AI-generated ID usually arrives with a selfie built to match it. NeuroVerify checks that selfie and face evidence for deepfakes and manipulation, in one API call.
It fits the selfie step of the document-led journey you already run: send the face media you already capture, with no new step for the end user.
NeuroVerify does not analyse ID documents. Your document verification provider keeps document authenticity checks; NeuroVerify protects the selfie and face-match step that follows them.
Powered byNeuroVerifyExplore the product
- #1 of 36on the public VendorBench-100
- <200 msp95 on eligible image requests
- 6 → 1six checks, one unified score
- 0new steps for your customer
The gap
Document checks can pass while the selfie behind them is fake.
Document-led KYC asks two questions. Is this document genuine? Does the person in the selfie match its portrait? Document verification vendors answer the first. Face match answers the second, at a similarity threshold.
Attackers who tamper with a document or generate a synthetic one need a face that matches it. That face is often edited, generated or injected. Face match then confirms the selfie resembles the portrait, but not that the selfie is an authentic capture of a live person.
Where the seam is
This page is about that face step only. NeuroVerify does not read or validate documents. It checks whether the selfie, video or audio submitted alongside them is authentic. See Synthetic Document and Selfie Fraud and Document Deepfake Detection for KYC.
Threats
How document fraud reaches the selfie step.
These are attack techniques, not claims about any specific institution. Document-side attacks are handled by your document provider; these are the face-side attacks that travel with them.
01
Selfie generated to match a forged ID
An attacker creates an AI-generated portrait for a fabricated ID and a matching selfie. Face match passes because both came from the same synthetic face.
02
Portrait swapped, selfie edited to follow
The ID portrait is replaced with the attacker's target face and the selfie is edited or face-swapped to match. Each image looks plausible alone.
03
Face swap during the selfie session
The attacker holds a real stolen document and swaps the victim's face onto their own live video, so the on-screen face matches the portrait.
04
Injected video in place of the camera
A virtual camera feeds prepared video into the capture app. The document is shown to a real camera but the face never is. See Virtual Camera Injection Attacks.
05
Re-used faces across many applications
One generated face is paired with many different fabricated documents. Individually each application matches; together they reveal a ring.
06
Screen replays of a genuine holder
A genuine holder's selfie or video is replayed from a screen against their own stolen document. The face is real but not live.
Document-led KYC is part of most remote onboarding rules worldwide. FATF guidance and EU frameworks such as eIDAS focus on reliable identity evidence. See FATF Digital Identity Guidance.
Authenticity evidence on the face supports your controls. Your policy decides what to approve.
Where NeuroVerify fits
Protect the selfie that your document checks depend on.
NeuroVerify sits after the selfie is captured and before face match and your policy act. Your document verification vendor stays exactly where it is. NeuroVerify checks only face images, video and audio, never documents.
Document verification → Selfie and liveness → Face match → Decision
A manipulated selfie that matches the document portrait is approved.
Document verification → Selfie → NeuroVerify risk score → Face match → Decision with evidence
One call is added on the face side. The document step is untouched.
What runs in the request
Six signals run in a single request: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. They return one unified risk score with signal-level evidence. See NeuroVerify.
What stays with you
Your document verification, OCR, registry and face-match providers and your final decision stay with you. NeuroVerify supplies authenticity evidence on the face media.
NeuroVerify Unified Trust LayerSix parallel analysis layers
- Visual Safety Screening
- Live Presence Verification
- Face Manipulation Detection
- AI Generative Model Analysis
- AI Pixel-Level Manipulation
- AI Content Compliance
Keep your document step
Continue to run document capture and verification with your existing provider. NeuroVerify does not replace it.
Send the selfie or video
Pass the selfie or video you already capture through a mobile SDK, a backend SDK or the REST API.
Read the unified score
Get one risk score with signal-level evidence, typically under 200 ms p95 for eligible image requests.
Combine with document results
Let your policy weigh the face score alongside document and face-match results to approve, review or decline.
What you get
What document-led KYC teams get.
Covers the face side of document fraud
Forged and synthetic IDs need a matching face. Checking that face closes a gap document checks are not built to cover.
Works with your document vendor
There is nothing to replace. NeuroVerify adds one call on the selfie, leaving your document provider in place.
Fewer surprises after face match
A selfie that matches the portrait is no longer enough to approve. Authenticity evidence travels with the match score.
Explainable reviews
Signal-level evidence shows reviewers why a selfie was flagged, so manual queues stay manageable.
Fast enough for onboarding
Under 200 ms p95 on eligible image requests under defined test conditions, with methodology available on request.
Flexible deployment
Managed cloud, private cloud or customer VPC, secure container, on-premises or air-gapped.
Questions
What teams ask before they integrate.
Does NeuroVerify detect forged or tampered documents?
No. NeuroVerify checks face images, video and audio. It does not analyse ID documents, so keep your document verification provider for that.
What NeuroVerify adds is authenticity evidence for the selfie and face media that document-led journeys depend on.
Why look at the selfie if the document is the thing being tampered with?
A tampered or synthetic document needs a face that matches it. That face is often generated, edited or injected, and the face step is where many such applications are approved.
Checking the selfie gives you a second line of defence even when the document step is passed.
We already run liveness. Why add NeuroVerify?
Liveness answers whether a live person appears to be present. It was not built to answer whether the face, video or audio was generated or manipulated. A face swap, a virtual camera feed or a synthetic video can still pass a liveness prompt.
NeuroVerify includes Live Presence Verification as one of six signals, then adds face manipulation, generative-model and pixel-level analysis in the same request. You keep your existing liveness step and add authenticity evidence to it. See Deepfake Detection vs Liveness Detection.
How hard is it to integrate?
Most teams send the media they already capture. There is no new step for the end user. NeuroVerify offers native mobile SDKs (Android/Kotlin, iOS/Swift, Flutter), backend SDKs (Python, TypeScript/Node.js, Go, Java), a REST API and an MCP server for AI agents.
Integration is two lines of code, and teams can be live in under 24 hours. That is a product claim; your timeline depends on your own change process.
Where can it be deployed, and how is data handled?
NeuroVerify can run as a managed cloud API, in a private cloud or customer VPC, as a secure container, on-premises, or air-gapped. Pick the option that fits your security review and data-residency rules. See Deployment and Product data handling.
Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications, shown on the Trust page.
Can we test it on our own media first?
Yes. We recommend evaluating on your own captures, including real customer media and the attack types you worry about most. Use your own acceptance criteria rather than a vendor demo set.
For context, NeuroVerify ranked first of 36 systems on VendorBench-100, with a detection score (MCC) of 0.876 against 0.646 for the next-best vendor. Read How to Evaluate Deepfake Detection Vendors for a checklist.
Who makes the final decision, and what about false positives?
You do. NeuroVerify returns one unified risk score with signal-level evidence. Your own policy decides what to approve, send to review or block. No detector is perfect, so set thresholds against your own risk appetite and review volume.
Because the evidence is signal-level, reviewers can see why a case was flagged instead of facing an unexplained score.
Evaluate NeuroVerify
Check the selfies behind your document-led approvals.
Send us selfie and video media from your document-led journey and see the unified risk score and signal-level evidence on your own captures.