Remote identity proofing : attacks & countermeasures

The past decade has seen rapid development in the field of information technology and a digital revolution that has provided unprecedented benefits to European society and its economy, by facilitating trade and the provision of services, creating new opportunities for businesses and boosting productivity and economic gain. Furthermore, the global pandemic underlined the importance of well-regulated remote identification processes and trusted digital identities that public and private sector organisations can rely on. Remote identity proofing is a crucial element in creating trust for digital services. Remote identity proofing is the process where an online user proves he or she is the owner of a claimed identity. The proofing process is usually carried out over a webcam or a mobile device, where the users show their faces and produce their government issued documents - legal identity cards or passports. However, criminals are creative in devising tactics to circumvent these systems and a risk based approach is essential to stay ahead of the game. Establishing a secure standardised environment for remote identity proofing could mitigate the risks but also bring benefits to organisations including better compliance, greater customer reach, competitive advantages, streamlined secure onboarding processes, whilst protecting users and their assets. The present study analyses the collection and validation of evidence provided by the applicant to complete the verification of his or her identity. More specifically, we focus on face presentation attacks that aim to fool the facial recognition systems. Potential threats to remote identity proofing methods were identified and listed, as well as the corresponding security controls, in the previous ENISA Report Remote ID Proofing: Analysis of Methods to Carry Out Identity Proofing Remotely1 published in March 2021. Building on the previous report, this study will shed light on the details and practicalities of possible face presentation attacks against remote identity proofing methods, to better understand the existing threat landscape. Through the analysis, which consisted of a review of the literature, a survey and interviews, the following major face presentation attacks were identified: photo attack video of user replay attack 3D mask attack deepfake attack.