Google has begun rolling out a new account recovery tool that lets users verify their identity with a short selfie video. The feature is aimed at moments when a person is locked out of their account and cannot access their usual phone or computer. During setup, the user records themselves while following a series of guided head movements, allowing the system to capture the face from multiple angles. If a lockout occurs later, the user films a new clip, which is then compared to the stored recording. The rollout has been underway in phases since July 23, and users can check availability for their account at g.co/signin-selfie.
Designed as a supplementary recovery option
The selfie video does not replace a password or passkey. It functions strictly as an additional recovery method, sitting alongside options such as recovery contacts. Google encourages users to enable several recovery mechanisms. The feature is not available for Workspace accounts, children’s accounts, or accounts enrolled in the Advanced Protection Program—groups that, paradoxically, often have elevated security needs. The stored video is encrypted, is used for sign-in recovery by default, and can be deleted at any time. Google may use the footage to refine its detection systems, but only with the user’s explicit consent.
The limits of liveness detection
Google layers several safeguards to block fake photos and videos. Central to this is liveness detection: the system requests small, real-time movements to verify that a living person is in front of the camera. A printed photo or a previously recorded video will not satisfy the check. Basic presentation attacks are therefore filtered out.
Injection attacks remain a blind spot
The real vulnerability lies elsewhere. A sophisticated deepfake can blink, nod, and turn its head on command. Even more concerning, some of the most dangerous attacks bypass the physical camera entirely. In an injection attack, a fake live video stream is fed directly into the application, mimicking the camera’s output. Motion checks offer no defense against this technique. A widely cited paper presented at the USENIX Security Conference in 2022 showed that commercial liveness detection systems can be bypassed automatically. On top of that, common certification frameworks—such as ISO 30107-3, iBeta, and FIDO—test presentation attacks aimed at the lens, not injection attacks. Security firms have reported a sharp increase in injection-based fraud over the past two years.
Biometrics as part of a broader strategy
The U.S. National Institute of Standards and Technology (NIST) advises that biometrics should never operate in isolation, recommending that they always be paired with a second factor and a non-biometric fallback. Unlike a password, a face cannot be rotated or reset. In practical terms, the selfie video is a useful recovery option and offers an improvement over SMS-based recovery, which remains susceptible to SIM swapping. For primary authentication, passkeys and hardware security keys stay the stronger choice. High-value targets should avoid using the face video for recovery, and Google already excludes such accounts from the feature through the Advanced Protection Program.
Sources: blog.google, arxiv.org