Beyond ‘deepfake’: Persona, University at Buffalo taxonomy maps how selfie fraud actually happens

Calling an identity attack a “deepfake” may no longer tell fraud teams enough about what actually happened.

Persona, working with researchers at the University at Buffalo, has launched the Digital Taxonomy of Fraud, an interactive framework designed to give fraud teams, technology providers and researchers a common language for describing selfie fraud.

The project maps how different attacks are created and delivered to identity verification systems, with more than 3,800 visual examples intended to make increasingly complex fraud techniques easier to understand and classify.

Mapping how selfie fraud happens

A facial identity verification flow typically captures an image, checks for liveness and manipulation, then matches the face against a reference or enrolled identity. Fraudsters attack different points in that pipeline. Presentation attacks put a physical artifact — a photo, mask or replayed video — in front of the camera. Injection attacks bypass the camera stream itself, often through virtual-camera software. Manipulation attacks alter the underlying media using AI, as in face swaps.

The vocabulary for describing these attacks hasn’t kept pace with how varied they’ve become. Persona’s taxonomy breaks each attack into stages — selecting a target, obtaining or creating media, manipulating it, and delivering it to the verification system — and lets users explore the results through an attack-path matrix, a visual gallery, and a tool that deconstructs individual examples. It launches with more than 3,800 examples.

Why the terminology matters

A video replay shown to a camera is a presentation attack. That same video fed into an app through a virtual camera is an injection attack. A face-swapped version of it introduces manipulation of the underlying media.

Lump all three together as “deepfake fraud” and you obscure which controls need attention: presentation defenses address the first, injection detection the second, while the third requires analysis of the manipulated media itself. A company that diagnoses a “liveness problem” when attackers are really bypassing the camera could end up investing in the wrong fix.

This is why the distinction can’t stay confined to biometric engineers. Fraud, risk, compliance, product and procurement teams all need to know which specific attack they’re facing before they pick a technology to stop it — and a shared taxonomy is what lets them connect attack, vulnerability and defense without losing precision along the way.

Why now

Persona’s own data shows why that precision is overdue. In its first-half 2026 analysis of more than 27 million fraudulent selfies, published separately earlier this year, the company found that 86.2 percent were presentation attacks — and despite the attention generative AI gets, 76.5 percent involved no deepfake, synthetic face or AI-generated selfie at all.

Injection attacks made up a smaller share, but even there attackers were 194 percent more likely to inject video of a real person than an AI-generated one; more than 80 percent of injection attempts used basic virtual-camera setups.

In other words, “deepfake” has become shorthand for modern selfie fraud even though much of the fraud Persona observed wasn’t AI-driven at all. Generative tools are a real and growing part of the threat, but presentation attacks, stolen media and simple injection techniques remain significant — and as these methods increasingly combine, naming the attack accurately becomes part of stopping it.

Production experience meets academic research

The Persona–University at Buffalo partnership also addresses a data gap: Persona has visibility from verifying more than a billion identities, a scale of production fraud that academic researchers rarely get to see.

Raw customer selfies cannot simply be published, so the taxonomy relies on synthetic and recreated examples modeled on real attack patterns, with more than 3,800 examples freely available via Hugging Face for training and testing fraud-detection models.

The project also lines up with Persona’s work in emerging digital-identity infrastructure, including Europe’s EUDI Wallet ecosystem, where higher-assurance remote identity proofing makes distinguishing between attack mechanisms increasingly important.

Beyond the fraud team

For the taxonomy to matter, its vocabulary has to travel. A suspicious verification can start as a customer-support ticket, move to a fraud analyst, then to engineering, product and security — and may eventually become a new vendor requirement.

“Deepfake” loses information at those handoffs. “Video-replay presentation attack” or “face-swapped video delivered via virtual-camera injection” tells each team more precisely what was altered, how it was delivered and where defenses may be needed.

The same precision changes procurement. Instead of asking vendors for “better liveness” or “deepfake detection,” buyers can name the specific attacks they’re seeing and evaluate tools designed to address them.

Persona and the University at Buffalo have built the framework, examples and dataset. Whether it is adopted more broadly is the open question — a shared taxonomy only works if customer support, fraud teams, developers, vendors and researchers use the same words for the same attacks.

Knowing that something was “manipulated” isn’t the same as knowing what was manipulated, how, and how it reached the system — and that can be the difference between choosing the right defense and the wrong one.

Article Topics

AI fraud  |  biometrics  |  biometrics research  |  deepfake detection  |  injection attack detection  |  Persona  |  presentation attack detection  |  selfie biometrics  |  University at Buffalo