{"id":8116,"date":"2026-03-13T12:00:00","date_gmt":"2026-03-13T10:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/2026\/03\/13\/face-value-what-it-takes-to-fool-facial-recognition\/"},"modified":"2026-03-13T12:00:00","modified_gmt":"2026-03-13T10:00:00","slug":"face-value-what-it-takes-to-fool-facial-recognition","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2026\/03\/13\/face-value-what-it-takes-to-fool-facial-recognition\/","title":{"rendered":"Face value: What it takes to fool facial recognition"},"content":{"rendered":"

Facial recognition is increasingly embedded in everything from airport boarding gates to bank onboarding flows. The widely-held assumption is that a face is hard to fake<\/a> and that matching a live face to a trusted source is a reliable identity signal.<\/p>\n

Jake Moore<\/a>, ESET Global Cybersecurity Advisor, recently put this assumption through several practical stress tests. His experiments showed that the powerful technology can actually be both misused and defeated.<\/p>\n

In one test, Jake used a pair of modified off-the-shelf smart glasses that can identify people in real time. He walked through a public space, captured people\u2019s faces and compared them against publicly available online data sources, with identity matches returned within seconds. The names and social media profiles were pulled from nothing more than people\u2019s glances.<\/p>\n

This ability might come in handy if, say, a conference attendee struggles to remember people’s names, but it\u2019s far less palatable when you consider what someone with ill intentions could do with that information.<\/p>\n

The second demo had a different spin. It went after financial services, turning a fraud prevention system against itself. Using AI-generated images and freely available software, Jake created a fictitious face to open an actual bank account. The bank’s facial recognition and eKYC (know your customer) platform accepted it as a genuine person.<\/p>\n

After proving the point, Jake closed the account and shared all information with the bank, which has since shut down that specific method of identity abuse. But one broader question remains: how many financial institutions may still be susceptible to this kind of attack?<\/p>\n

\"jake-facial-recognition-tom-cruise\"<\/p>\n

Lastly, Jake added himself to a facial recognition watchlist at a busy train station in London. He then walked through the monitored area while running real-time face swap software that overlaid Tom Cruise\u2019s likeness onto Jake\u2019s own in the camera feed. The system, which is also used by the UK police, never recognized or flagged him. It was as if he simply wasn’t there and anyone actively searching for him on CCTV would have seen the actor instead.<\/p>\n

\n
\n

There’s a lot more to these experiments than we can cover here \u2013 they\u2019re all part of Jake\u2019s talk at RSAC 2026<\/a>, which is due in San Francisco from March 23rd<\/sup>-26th<\/sup>, 2026. If you’re at the conference, consider attending the talk \u2013 after all, seeing this all work against an in-production system in a live environment is different from \u2018just\u2019 reading about it. To learn more, including about other ESET talks at the conference, visit this website<\/a>.<\/p>\n<\/blockquote>\n<\/div>\n

The big picture<\/h2>\n

Facial recognition systems are being deployed with implicit trust that doesn’t match their actual resilience when someone tries to break them \u2013 even where they only use off-the-shelf consumer hardware and easily available software, just like Jake did. Identity verification that is solely dependent on a face match clearly carries more risk than most people and organizations realize.<\/p>\n

The experiments also send a message to vendors of facial recognition systems and anyone responsible for identity verification systems. Among other things, the systems should be tested in attack simulation settings and under other adversarial conditions. The technology behind facial recognition is fragile in ways that matter when someone attempts to subvert it.<\/p>\n

\"rsac26-banner\"<\/a><\/p>\n

Read the full analysis on WeLiveSecurity \u2192<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

ESET\u2019s Jake Moore used smart glasses, deepfakes and face swaps to \u2018hack\u2019 widely-used facial recognition systems \u2013 and he’ll demo it all at RSAC 2026<\/p>\n","protected":false},"author":5,"featured_media":8117,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[167],"tags":[],"class_list":["post-8116","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/8116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/comments?post=8116"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/8116\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media\/8117"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media?parent=8116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/categories?post=8116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/tags?post=8116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}