Abstract: The present invention is directed to a method and system for defeating replay attacks against biometric authentication systems by randomly prompting the subject to adjust a part of their body in some measurable way. The timing of these adjustments would be used to verify that the biometric input is coming from a live subject and not a recording. One embodiment of the design would include a commodity camera-equipped mobile device (130) connected to an authentication server (110) via the Internet (120). In this embodiment an encrypted video stream of the subject—for example his or her hand (140a)—would be established from the mobile device to the authentication server. The authentication server would generate a unique series of time delays, at which intervals a prompt—for example to extend or retract a specific finger—would be relayed from the server to the mobile device and subsequently the subject.