Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

How do deepfakes defeat remote identity verification, and what is the difference between presentation and injection attacks?

Liveness checks were built to catch a photo held up to a camera. Deepfakes often never go near the camera at all.

hardNewPreparation tags: JPMorgan Chase, Stripe, AppleUpdated Nov 2026

Liveness checks were built to catch a photo held up to a camera. Deepfakes often never go near the camera at all.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A fintech app opens accounts remotely with an ID document photo and a selfie video. Fraud analysts see accounts that passed liveness being used for money laundering.

  1. How can these accounts have passed a liveness check?
  2. What evidence would show injection rather than presentation attacks?
  3. What if you add injection attack detection and attestation for the mobile app, but the web flow stays?
  4. What if a document check also passes because the ID is a high-quality forgery?
  5. How would you choose and test a verification vendor?
  6. What verification architecture would you recommend?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackAttackers keep getting in by calling your IT help desk and asking for an MFA reset. How do you redesign account recovery?Next in this trackHow can a website tell that a request really comes from a specific AI agent or crawler? Explain signed requests and Web Bot Auth.Next in this trackWhat is device code phishing, why does it beat ordinary MFA and URL checks, and how do you shut it down in Entra ID or Google Workspace?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.