Google bets on selfie video for account recovery, but experts urge caution

Google's selfie video feature could make account recovery easier and more secure, but experts warn that facial data is permanent and increasingly targeted by AI-enabled fraud

Google has introduced selfie for sign-in, an account recovery feature that allows users to verify their identity through a short selfie video if they lose access to their password, phone or other sign-in methods. The feature marks Google’s latest push towards biometric authentication alongside passkeys and multi-factor authentication (MFA).

 

While Google says the feature is designed to make account recovery more secure and convenient, its launch comes amid a rapid rise in artificial intelligence (AI)-generated deepfakes and identity fraud. This raises questions about whether biometric verification can stay ahead of increasingly sophisticated impersonation attacks.

 

How Google’s selfie for sign-in works

 

 

Google describes selfie for sign-in as a backup account recovery method rather than a replacement for passwords or passkeys.

 

Users first record a short reference selfie video by following guided movements such as turning their head, allowing Google’s systems to capture their face from multiple angles. If they later lose access to their account, they can record another selfie video, which Google compares with the original to verify their identity.

 

According to the company, the verification process uses multiple security checks, including AI-powered facial matching, liveness detection, guided movements and suspicious sign-in detection. These measures are intended to reduce the risk of impersonation using photographs, replayed videos or AI-generated deepfakes.

 

Google says the reference video is encrypted while stored, collected only with the user’s consent and can be deleted at any time through account settings. By default, the video is used only for account recovery unless the user explicitly agrees to additional uses.

 

Rather than replacing existing security measures, Google positions selfie for sign-in as an additional recovery option alongside passkeys, recovery contacts and two-step verification.

 

Cybersecurity experts, however, have called for caution, warning that facial data could be misused.

 

Purshottam Bhatia, head of consumer business for South Asia at Kaspersky, said casual fraud attempts were less likely to succeed against sophisticated deepfake detection systems, but targeted attacks on high-value accounts remained a concern.

 

He added that fraudulent websites often request access to a device’s camera under the pretext of account verification. The facial data captured could later be used for unauthorised account access or sold on the dark web.

 

Cybersecurity professionals generally agree that no single authentication method is sufficient against today’s threats. Security systems instead increasingly rely on several independent methods of verification.

 

Passkeys, based on standards developed by the FIDO Alliance, are regarded as one of the strongest authentication methods because they eliminate traditional passwords and rely on cryptographic keys stored securely on trusted devices.

 

Two-factor authentication (2FA) adds another protective layer by requiring users to verify their identity through a separate device or authentication application.

 

Selfie for sign-in serves a different purpose. Rather than authenticating every login, it primarily addresses one of the biggest challenges users face: recovering an account after losing access to passwords or trusted devices.

 

For users who frequently change or lose their phones, the feature could reduce the risk of permanent account lockouts while providing stronger security than traditional recovery questions.

 

Experts, however, say one of the biggest risks associated with facial biometric authentication is its irreversibility.

 

“A password can be reset after compromise; a face cannot be changed. If a facial template, selfie video or associated identity data is stolen, it can create a persistent fraud and privacy risk for the individual,” said Amit Jaju, cyber expert.

 

AI behind the verification

 

At the core of Google’s new system is AI-powered liveness detection. Unlike conventional facial recognition, which simply compares two images, liveness detection attempts to determine whether the person in front of the camera is physically present.

 

Google’s guided head movements are intended to prevent attackers from simply presenting a photograph or replaying a recorded video.

 

The company says it combines facial matching with multiple security signals and standard account protection systems to identify suspicious account recovery attempts and impersonation.

 

The effectiveness of these systems will, however, increasingly depend on how quickly they evolve alongside generative AI.

 

Modern deepfake tools can already produce convincing facial movements, realistic eye blinking and synchronised speech, making impersonation attempts harder to detect.

 

Jaju told Business Standard that biometric templates should be protected through strong encryption during transmission and while stored. Encryption keys should be held separately from the data, supported by hardware-backed key management, strict role-based access controls, MFA for administrators, immutable audit logs and continuous monitoring for unusual access, he said.

 

“Biometric records should be logically separated from account-profile and identity-document data so that a compromise of one system does not expose a complete identity dossier,” he added. 

 

Deepfakes emerge as a major security threat

 

Google’s announcement comes amid a sharp rise in AI-enabled identity fraud. According to a 2026 report by pi-labs, cited earlier by Business Standard, deepfake content has risen 900 per cent in recent years.

 

The report found that more than 90 per cent of explicit deepfakes target women, while 65 per cent of Indian organisations reported experiencing deepfake-driven attacks in 2026.

 

It also said more than 5,000 face-swapping applications and over 1,000 voice-cloning tools were publicly available, significantly lowering the barriers for cybercriminals.

 

The report highlighted an increase in cybercrime complaints involving women, from about 50,000 cases in 2024 to nearly 80,000 by 2026, reflecting the growing misuse of AI for identity manipulation and digital fraud.

 

These trends explain why technology companies are investing in AI-powered identity verification while simultaneously facing pressure to defend their systems against AI-generated impersonation.

 

Privacy remains the biggest concern

 

Security is only one side of the debate. The other is privacy. Unlike passwords, biometric identifiers cannot simply be reset after a breach. If facial data is compromised, users cannot replace their face in the same way that they can change a password.

 

Google has sought to address these concerns by saying that selfie videos are recorded only with the user’s consent, encrypted while stored, used for account recovery unless the user opts in to other uses, and can be deleted at any time.

 

According to Bhatia, every selfie video collected for verification represents a continuing liability rather than a check that ends once verification is completed.

 

Kaspersky’s 2025 phishing findings also showed that attackers were moving beyond passwords and increasingly targeting biometric data, as well as electronic and handwritten signatures, he said.

 

“None of this data can be reset the way a password can. Companies collecting it are effectively taking custody of something a user cannot get back if it leaks, so the responsibility doesn’t end the moment verification is completed. It continues for as long as the data is retained,” Bhatia said.

 

Privacy advocates are also likely to seek clear information on how long biometric data is retained, whether it is processed only for account recovery, how it is protected against future breaches, and whether independent audits verify Google’s claims.

 

How Google’s approach compares with rivals

 

Google is not the first technology company to use biometrics for authentication.

 

Apple’s Face ID performs facial recognition primarily on the device, using the Secure Enclave to process and protect biometric information locally rather than storing a facial image in the cloud.

 

Microsoft supports biometric authentication through Windows Hello, which similarly performs verification on compatible devices without requiring users’ facial templates to be centrally stored.

 

Financial institutions have also increasingly adopted selfie verification during remote onboarding and Know Your Customer (KYC) processes.

 

Many banks combine facial recognition with identity-document verification and liveness detection to reduce fraud during account opening or other high-risk transactions.

 

Google’s implementation differs because it functions primarily as a recovery method for one of the world’s largest digital identity platforms.

 

A Google Account can provide access to Gmail, Photos, Drive, payments and several third-party services. Securing its recovery process therefore has broader implications than authenticating a single banking transaction. 

 

Security layer or new attack surface?

 

Google’s selfie video feature represents the technology industry’s broader move towards biometric authentication to strengthen account security and simplify recovery. For users, it could reduce the risk of permanent account lockouts while adding another protective layer beyond passwords and recovery emails.

 

However, as deepfake technology and AI-powered impersonation attacks evolve, cybersecurity experts caution that no biometric system is entirely foolproof. The effectiveness of selfie verification will depend on how well AI-powered liveness detection keeps pace with increasingly sophisticated threats.

 

Biometric data also creates distinctive privacy and security risks because, unlike passwords, it cannot be changed after a breach.

 

Experts say strong encryption, limited data retention, user consent and transparency will be critical to building trust in such systems.

 

Google’s selfie for sign-in feature is therefore best viewed as an additional security layer rather than a standalone solution. Its long-term success will depend on the company’s ability to strengthen its defences continuously against evolving AI-driven fraud.