Google Introduces Selfie Verification for Locked Accounts
Google has opened a new route back into locked accounts, allowing users to verify their identity with a short selfie video, a move that places facial biometrics at the centre of one of the most sensitive moments in digital life, the moment a user has lost every other way in.
The company announced the feature on Thursday, July 23, 2026, describing it as an additional sign in and recovery option rather than a replacement for existing methods. Setup takes place within the security and sign in section of a Google Account. The user looks into a device camera and completes a short sequence of guided head movements, such as turning left, turning right or nodding, so the system captures the face from several angles. That enrolment video is stored to the account. When the user is later unable to sign in, perhaps after losing a phone, forgetting a password or attempting access from a borrowed device, a fresh video is recorded and matched against the saved one.
Google framed the design as a direct answer to synthetic media. “When you use a selfie to sign in, we use multiple layers of security to help prevent impersonation attempts like fake photos and videos (i.e., deep fakes),” the company wrote in its blog post. “For example, we match your video against your saved selfie and require you to perform simple movements to prove it’s a live video. We also use our standard security practices to detect and help prevent suspicious sign in attempts.”
The company also set out the controls attached to it. Google said the video is recorded and stored only with the user’s consent, is encrypted while at rest, can be deleted from the account at any time, and is used for sign in unless the user chooses to share it for other purposes, including a separate option on whether Google may use the recordings to improve its facial recognition and verification technology. The feature joins recovery phone numbers, recovery email addresses, passkeys and recovery contacts, and Google has repeatedly advised account holders to keep more than one method active.
The rollout lands at a point where the industry has largely conceded that passwords are the weakest link, without quite managing to retire them.
The FIDO Alliance, the standards body behind passkeys, announced on World Passkey Day, May 7, 2026, that an estimated five billion passkeys are now in use worldwide. Its State of Passkeys 2026 report, drawn from parallel studies conducted by Sapio Research in April 2026 covering 11,000 consumers and 1,400 enterprise decision makers across ten countries, found that 90 per cent of people are aware of passkeys, 75 per cent have enabled one on at least one account, and 49 per cent use them regularly where available. On the enterprise side, 68 per cent of organisations have deployed or are actively deploying passkeys for employee sign in, and while 82 per cent name full passwordless authentication as the goal, only 28 per cent report having reached it. The consumer study carries a margin of error of 0.9 percentage points and the workforce study 2.6 percentage points, both at 95 per cent confidence.
The gap between adoption and transition is where recovery lives. Passkeys are tied to devices and hardware protected keys, which is precisely what makes them phishing resistant and precisely what makes a lost phone a crisis. Security researchers have argued for some time that recovery flows are the soft underbelly of otherwise strong authentication systems, and that no single check, whether a face, a voice or a code sent by text, should carry the full weight of restoring access.
Google is not first into biometric identity. Apple has offered Face ID based authentication since 2017, and Microsoft extended Windows Hello facial recognition into account recovery workflows years ago. What is new is the placement of a stored facial video, held server side, at the recovery layer of an account estate that anchors email, cloud storage, payments and, for millions of Nigerians, business identity.
Google’s emphasis on liveness reflects a threat curve that the identity verification industry has been tracking with alarm, though the figures come almost entirely from vendors who sell detection products and should be read with that in mind.
Entrust, in its 2026 Identity Fraud Report drawn from analysis of more than one billion identity verifications across 195 countries and over 30 industries, reported that deepfakes now account for roughly one in five biometric fraud attempts, that deepfaked selfie attempts rose 58 per cent during 2025, and that injection attacks climbed 40 per cent year on year. The same report found that 41 per cent of surveyed organisations placed their direct annual fraud costs above one million dollars.
The distinction between attack types matters for judging what Google’s head movements actually achieve. A presentation attack holds a fake in front of a real camera, and liveness prompts are reasonably effective against it. An injection attack bypasses the camera entirely and feeds manipulated video directly into the verification pipeline, which is a software level problem rather than a performance one. iProov, in its 2026 Threat Intelligence Report released on April 8, 2026, recorded a 1,151 per cent surge in injection attacks targeting iOS devices in the second half of 2025, producing a 741 per cent increase across the full year.
Human judgment offers little fallback. The most robust independent measure remains a 2024 peer reviewed meta analysis published in Computers in Human Behavior Reports, pooling 56 studies and 86,155 participants, which put average human accuracy at distinguishing real from synthetic media at 55.54 per cent, with a confidence interval running from 48.87 to 62.10 per cent. In other words, close to a coin toss.
Facial data has become one of the most expensive categories of information a technology company can hold.
Google settled a class action in Illinois in 2022 for 100 million dollars over the face grouping feature in Google Photos, brought under the state’s Biometric Information Privacy Act. Texas Attorney General Ken Paxton announced a 1.375 billion dollar settlement with Google on May 9, 2025, resolving suits filed in 2022 over the collection of location data, biometric identifiers and browsing activity under the state’s Capture or Use of Biometric Identifier Act, with the office confirming finalisation later that year. Google admitted no wrongdoing. That followed the 1.4 billion dollar settlement Texas reached with Meta in 2024 over facial recognition data, and Meta’s earlier 650 million dollar Illinois settlement in 2020.
The rulebook is still moving. Transparency and disclosure obligations under Article 50 of the European Union’s AI Act, which cover synthetic content and biometric categorisation, become binding on August 2, 2026, roughly a week after Google’s announcement.
For Nigerian users, the feature arrives in a market where biometric identity is already national policy and where fraud remains stubbornly social rather than technical.
President Bola Tinubu signed the National Identity Management Commission Act 2026 into law on June 27, 2026, repealing the 2007 legislation, establishing the National Identification Number as the country’s foundational credential under a one person, one identity policy, and designating NIMC as root certification authority for the national public key infrastructure. NIMC Director General Abisoye Coker Odusote announced on July 7, 2026 that enrolment had crossed 136 million, and later put the figure at 137,371,080, up from 117.36 million recorded as at February 28, 2025. She said the President had directed the commission to capture every Nigerian before the end of 2026.
Biometric data is classified as sensitive personal data under the Nigeria Data Protection Act, signed into law on June 12, 2023, which created the Nigeria Data Protection Commission. The Act provides for penalties reaching 10 million naira or two per cent of annual gross revenue for data controllers of major importance, and lower thresholds for others. Compliance audit return filings for 2025 were extended to May 30, 2026, according to widely reported commission notices, and compliance trackers have put cumulative penalties collected across Nigeria’s data protection enforcement at about 7.2 billion naira, a figure the commission has not independently itemised in public.
On fraud, data presented by NIBSS Managing Director Premier Oiwoh at the 2026 Nigeria Electronic Fraud Forum technical kickoff in Lagos showed digital payment fraud losses of 25.85 billion naira in 2025, down 51 per cent from 52.26 billion naira in 2024, a year distorted by a single incident valued at 31.1 billion naira. Losses stood at 17.67 billion naira in 2023. Case volumes fell from 123,918 in 2021 to 67,518 in 2025. Lagos accounted for 63.43 per cent of fraud activity and Abuja 3.12 per cent. Oiwoh identified social engineering, including phishing, SIM swap and account compromise, as the most prevalent technique, with insider involvement a recurring factor. “Awareness remains critical, as many victims are still easily deceived,” he said.
Nigeria ranked twelfth among countries reporting cybercrime complaints to the United States Internet Crime Complaint Centre in 2025. Industry threat monitoring reported that organisations in Nigeria faced an average of 4,361 attempted attacks weekly in June 2026, second highest in Africa.
Three questions will determine whether the selfie option strengthens or weakens account security in practice. The first is where the enrolment videos are processed and stored, and whether Nigerian users’ recordings cross borders in a manner that engages the transfer provisions of the NDPA. The second is whether Google publishes measurable false acceptance and false rejection rates, since a recovery channel that is easier for a legitimate user is also, by definition, a channel an attacker will study. The third is enforcement appetite, both from the NDPC, which has faced criticism over the pace of its actions, and from European regulators once the AI Act transparency provisions take effect.
Google’s own guidance points at the safest posture available to users today, which is redundancy. A face is convenient precisely because it cannot be forgotten. It is risky for the same reason. It cannot be changed either.