Case study 02 · Liveness · Fraud prevention · Android
Making ration handouts fraud-resistant for 47.78 million people
Replacing a blink check that a phone video could fool with a randomised head-movement liveness test, plus a nominee flow for the parents who actually collect the ration.
- Role
- Product designer (IC)
- Organisation
- Digital India Corporation
- Programme
- Poshan Abhiyaan
- Shipped
- 2 system generations
The two-minute version
Take Home Ration (THR) handouts are confirmed by face recognition. The first system checked for a blink, and in the field it could be beaten by holding a video up to the camera. I redesigned the distribution flow end to end: structured inputs instead of free text, a nominee layer for guardians, and a randomised directional liveness check (FRS 2.0).
The problem
Before face verification, THR distribution ran on manual records, which were hard to audit and easy to claim falsely. FRS 1.0 digitised authentication with a straight-facing photo and blink detection.
Field use exposed two gaps. Recorded videos passed the blink check, and the registered beneficiary, often a child under six, is rarely the person who collects the ration.
Constraints
- Long queues, crying children and time pressure at every distribution
- Children under six have no stable biometrics
- Low-literacy users need icon-led guidance
- Every transaction must be auditable at national level
Key decisions
- Decision 1
No free-text numbers
Typed days and packet counts caused input errors and cancelled transactions. Steppers and tap-to-select cards replaced them, with live validation that keeps the button locked until the form is valid.
- Decision 2
A nominee layer for real caregiving
The worker picks who is collecting: mother, father, guardian or nominee. Face recognition then matches that person. For children under six, the parent's verified face stands in.
- Decision 3
Liveness that can't be predicted
FRS 2.0 asks for a random sequence of head movements (look left, right, up, down). A replayed video can't follow it. The check runs in the separate Poshan Secure app, which keeps biometric logic isolated.
- Decision 4
A receipt that builds trust
Every distribution ends with a receipt showing the beneficiary, the verified collector, the quantity and the match status, which heads off disputes in the community.
What changed
- Beneficiaries now authenticated on FRS-enabled distribution
- 46.36MBeneficiaries now authenticated on FRS-enabled distribution
- A randomised head-movement check replaced the blink test
- Replay-proofA randomised head-movement check replaced the blink test
- Days and packets are chosen with steppers and cards
- No typingDays and packets are chosen with steppers and cards
The 46.36M figure is from official Ministry of Women & Child Development statistics: 97.01% of the 47.78M eligible THR cohort.
47.78M Eligible THR beneficiaries
97% Onboarded with eKYC + face
1.33M Anganwadi workers
What I learned
Predictable checks become vulnerabilities
FRS 1.0 was a real improvement over paper, but once users learned its pattern, they could game it. Security flows in the field need unpredictability designed in, and they have to stay simple enough for a low-literacy user to follow.
Full deep-dive · shared on request
Go deeper: production screens and the full flow.
The deep-dive walks through every screen, the 8 stages of the flow and the trade-offs behind them. It uses production material, so I share it on request.