Systems, computer-implemented methods, and non-transitory machine-readable storage media are provided for detecting recapture attacks of images. One method comprises extracting one or more features from an image captured by a device; applying the one or more features as input to a trained machine learning model, wherein the trained machine learning model outputs a first score based on the extracted features; obtaining metadata of the image; performing a statistical analysis of the metadata of the image; generating a second score based on the statistical analysis of the metadata of the image; and generating a probability that the image is a recapture of an original image based on the first score and the second score.