How a Child’s Finger‑Drawn Moustache Fooled AI Age Verification (and Made Engineers Speechless)

At the start of the year Discord introduced a "teen‑by‑default" policy, treating all users as minors and locking certain features unless they pass an age‑verification step. The verification can be done either by recording a short selfie video for on‑device AI age estimation or by uploading an ID.

Internet users quickly began testing the system’s limits. Some used game screenshots, others 3D models, and the most absurd method involved drawing a face on a thumb. By holding the thumb with two eyes and a mouth up to the camera, centering it, and turning the head left and right as instructed, the AI concluded the age was between 13 and 15, allowing the verification to succeed.

Another example cited a 12‑year‑old boy who drew a moustache with an eyebrow pencil; the system judged him to be 15 and let him pass.

The reason these tricks work lies in the platforms’ design choices. To comply with regulations while minimizing privacy concerns, they run facial‑age‑estimation models locally on the device and only send back the final age‑range result, never the raw video or facial data. Because the models must run on limited compute resources, they are relatively lightweight and cannot rely on heavy server‑side analysis.

These lightweight models infer age from visual cues such as eyes, mouth, facial contour, and skin texture. A simple thumb sketch, under specific lighting and low resolution, unintentionally matches the abstract pattern of a "young, smooth face" that the model has learned.

The verification flow also requires the "face" to be centered and to move left‑right, providing basic motion signals. The natural tremor of a finger during the motion satisfies the liveness check, leading the system to treat the drawing as a live object and approve it.

Since the age‑estimation models are trained on massive datasets of real human faces, they lack robustness to highly non‑standard, abstract inputs. During the rollout phase, platforms set relatively loose thresholds to avoid rejecting legitimate users who have poor lighting, unusual angles, or distinctive facial features, inadvertently creating an opening for such low‑tech exploits.

Similar bypasses have been reported on platforms like Roblox, demonstrating that current facial‑age technology is far from airtight when faced with deliberately crafted deception.

Platforms are not standing still. Meta recently announced that it will use AI to scan uploaded photos and videos, leveraging generic visual cues such as height and bone structure to infer whether an account holder is under 13, then automatically remove the account. Meta stresses that this is not facial recognition but a coarse age‑range judgment.

Beyond visual analysis, Meta will also consider textual content and interaction patterns—birthday mentions, school grade references, and other signals—to build a comprehensive profile. If the AI flags an account as potentially underage, the account is disabled pending a manual verification process. The system has already been deployed in several countries and is slated for expansion to Instagram Live, Facebook groups, and other scenarios.

Thus, the cat‑and‑mouse game between platforms deploying AI safeguards and users finding creative loopholes is likely to continue.

Reference links: https://techcrunch.com/2026/05/05/meta-will-use-ai-to-analyze-height-and-bone-structure-to-identify-if-users-are-underage/ https://www.instagram.com/reels/DUqrCoWDRI0/