Why can synthetic video injected below the camera driver pass your liveness check cleanly?

Liveness detection runs at the application layer, above the OS driver. A camera injection attack intercepts the video stream below that layer, feeding the detector a synthetic face generated in real time that behaves exactly like a genuine camera signal because from the detector's perspective it is one. Group-IB documented 8,065 such attempts against a single financial institution between January and August 2025, and injection attacks on iOS devices surged 1,151% in the second half of 2025 alone. An RSA Conference analysis published in 2026 concluded that ISO 30107-3 PAD certification does not cover virtual-camera and API-level injection, leaving it entirely outside the scope of the only certification most vendors pursue. There is no consumer-level standard for hardware-attested camera feeds, and the entire KYC pipeline assumes the signal entering liveness detection originates from a phy