EAB examines biometric enrollment integrity protections against face morphing

Germany is taking a global lead with steps to prevent biometrics spoof attacks from making their way into breeder ID documents like passports. The EAB presented these steps and discussed their practical application and effectiveness in a Live Enrollment Workshop on Wednesday.

Christoph Busch pointed out that the community has been aware of the threat of biometric morphing attacks for a decade, but does not yet have a clear idea of how frequent they are.

“No-one can answer this question. It is impossible to answer,” he says.

A survey during the IFPC conference organized by NIST sheds some light on the volume of morphing attacks, however. Ten of 112 respondents said they saw more than 200 incidents of morphing attacks in 2024, and another 6 saw at least 50.

The question could be made academic by requiring live enrollment, whether at kiosks or with certified photographers. Until every country makes that shift, morphing detection technologies will be needed.

Dr. Uwe Seidel of the BKA provided the ICAO perspective, as well as his own agency, on biometric enrollment.

The ISO/IEC 39794 standard for biometric encoding is “probably the biggest change after the introduction of the ePassport itself,” he says. Inspection systems are expected to be able to handle the new encoding standard by January 1, 2026, though it is unlikely many states will be encoding passports with the new format. The new encoding formats are not required until 2030.

While morph attack images are typically described as an even mix of two photos, Seidel noted that importing only 30 percent of the facial features of another person to an image can result in a biometric match.

Siedel noted that the EU has invested around 20 million euros (roughly US$23.4 million) in research into biometric morphing detection, between the Fidelity, SOTAMD and iMARS projects, the latter of which wrapped up last September.

In the meantime, Germany has rolled out kiosks to municipalities to collect biometric data for passport applications which feature presentation attack detection (PAD) for face and fingerprint biometrics, and a larger facial image.

NIST has examined the effectiveness of morph detection technologies with its FRVT Morph, and found significant improvement from 2020 to 2025. The best algorithms are approaching the two percent false negative rate (FNR) and false positive rate (FPR) that experts say will work as an operational threshold for low-quality morphs.

Siedel also explained ICAO encoding for eMRTDs and data structure for barcodes.

Riccardo Konig of the BMI discussed Germany’s modernization of its ID document issuing process, which included the development of the PointID live enrollment system by state-owned printer Bundesdruckerei. The system is not entirely uniform, as changes were made during its development to allow municipalities to meet various needs.

The decentralized structure of the German state is the most significant challenge for live biometrics enrollment, Konig says, between legal and implementation differences. Having a single system provider can help.

He delved into the organizational and administrative issues around setting up a live enrollment system.

Anna Stratmann of BSI described the certification of the biometric capture devices used in the system.

The BSI normally issues new technical guidelines for certification every year, she says.

Under the guidelines, facial images can be delivered to the agency’s network from the cloud, but only under certain circumstances, and according to specified procedures. In practice, municipalities are at different stages of implementation.

For live enrollments in August, roughly half were captured on site, the other half delivered  via a  digital camera, a scan or the cloud.

BSI has received 18 applications for certification of live facial enrollment devices from five vendors since May, 14 of which have been finalized.

The biometrics provider perspective

Patrizia Knoppchen of Bundesdruckerei explained PointID, which is a modular device. It has been rolled out at around 5,500 locations across Germany. The device selects the best image from a one-second video that captures up to 30 images.

In addition to the PAD capabilities noted above, PointID devices also feature background elimination.

Germany-based Speed Biometrics is another provider of self-service live biometric enrollment equipment. Stefan Pahmeier pointed out that live enrollment has actually been available in Germany since 2012, just not required.

One challenge identified by Pahmeier is the requirement for installed capture devices to be observable at all times. This means the lobbies and waiting areas that had room for the devices could not be used, in many cases.

He expressed some irritation with Germany combining its decision to require live enrollment with the award of a federal contract to Bundesdruckerei. Despite this situation, Speed Biometrics has deployed more than 500 solutions in more than 200 municipalities.

The company’s kiosks feature software from Speed Identity AB and secunet.

Speed Biometrics also has customers and projects in Sweden, Switzerland, Lithuania and Estonia.

Marcos Kramer of ME Group presented his company’s approach to providing photo booths and kiosks for unsupervised facial image acquisition.

He emphasized that security arises from the combination of process and human controls.

Kramer believes ME Group’s two-step PAD process is unique in the face biometrics market.

Michael Barsoe of Biometric Solutions expressed hope that other countries will follow Germany’s lead on secure biometric enrollment.

Biometric Solutions developed both self-service terminals and smartphone software Biometric Go for biometrics enrollment in Denmark, Barsoe explains. Given the option between them, municipalities chose the smartphone solutions, so the company has left the market for dedicated devices in Germany to the companies above.

There are 2,600 active installations of Biometric Go in Germany, he says.

Article Topics

biometric enrollment  |  Biometric Solutions A/S  |  Bundesdruckerei GmbH  |  EAB  |  EAB 2025  |  European Association for Biometrics  |  face biometrics  |  face morphing  |  ISO 39794-5  |  Speed Identity