ISO/IEC 30107-3 is the real test for liveness security

At a glance

What this is: This is an analysis of why ISO/IEC 30107-3 is the meaningful benchmark for biometric liveness, and why APCER, BPCER, and independent lab validation are the evidence that separate real PAD performance from vendor claims.

Why it matters: IAM and identity verification teams need a defensible way to evaluate biometric onboarding controls, because weak liveness testing turns deepfake and spoofing resistance into an unverified assumption.

By the numbers:

• For a system to pass Level 2, it must maintain a BPCER/FNMR below 15%.

Context

Biometric liveness security depends on whether a system can reliably distinguish a real person from a spoof attempt during presentation attack detection. In this article, the primary control question is not whether a vendor says it supports liveness, but whether its testing evidence is anchored in ISO/IEC 30107-3 and independently verified.

That matters because onboarding, KYC, and high-assurance identity proofing now face deepfake-driven spoofing, replay attacks, and printed-image attacks at the front door of the identity lifecycle. If certification, lab credentials, and error metrics are vague, security teams are left validating a claim instead of a control.

The article frames this as a market problem as much as a technical one: self-assessed assurance is not enough when regulated identity workflows depend on biometric trust.

Key questions

Q: What breaks when biometric liveness is based on marketing claims instead of accredited testing?

A: The control becomes hard to trust because no one can tell whether spoof resistance was actually measured under defined conditions. In regulated onboarding, that means identity proofing may pass users without proving the system can resist presentation attacks. The result is assurance drift: security teams believe they have liveness coverage, but the evidence cannot support the trust decision.

Q: Why do APCER and BPCER both matter in identity verification?

A: APCER shows how often spoofing is accepted, while BPCER shows how often real users are rejected. If you only optimise one, you can create a weak control that is either easy to bypass or too disruptive to use. Mature identity programmes assess both together because security and usability are part of the same decision.

Q: How should teams evaluate a liveness solution for regulated identity proofing?

A: Start with the standard, then inspect the evidence. Require ISO/IEC 30107-3 testing, confirm the lab was independent and accredited, and review the reported APCER and BPCER values in the context of your risk tolerance and onboarding flow. That approach turns a vendor claim into an auditable control decision.

Q: When is biometric liveness strong enough for KYC and high-trust onboarding?

A: It is strong enough only when the testing method, lab provenance, and error rates all align with the risk of the workflow. For KYC or other regulated onboarding, the control must withstand spoof attempts without rejecting too many genuine users. If the evidence is missing or vague, the control is not yet fit for high-trust use.

Technical breakdown

ISO/IEC 30107-3 as the presentation attack benchmark

ISO/IEC 30107-3 defines how presentation attack detection, or PAD, should be evaluated for biometric systems, especially face recognition. The standard is designed to test resistance to spoofing methods such as masks, video replays, and printed images. In practice, it matters because it shifts evaluation from marketing language to repeatable test conditions. A system that is not tested against a recognised PAD standard may still function, but its security claims are much harder to defend in procurement, audit, or regulated onboarding. For identity teams, the key issue is evidence quality, not feature count.

Practical implication: Use ISO/IEC 30107-3 as the baseline evidence requirement for any biometric liveness control in onboarding or identity proofing.

APCER and BPCER show the real trade-off in liveness performance

Two error metrics determine whether liveness detection is useful in practice. APCER, the attack presentation classification error rate, measures how often spoof attempts are accepted as genuine. BPCER, the bona fide presentation classification error rate, measures how often legitimate users are rejected. Those numbers expose the real trade-off between security and user experience. A vendor can claim strong spoof resistance, but if false rejects are too high, the control creates operational friction and manual review overhead. If spoof acceptance remains high, the system is weak regardless of how smooth the onboarding flow looks.

Practical implication: Ask for APCER and BPCER side by side, because a single headline metric does not tell you whether the control is actually fit for onboarding.

Independent lab validation makes biometric assurance defensible

Independent validation is what turns liveness testing into credible assurance. Labs such as iBeta, operating under NIST/NVLAP accreditation, provide third-party testing that reduces the conflict of interest inherent in self-certification. The article also notes stratified testing levels, where higher levels represent more advanced spoofing resistance. That structure matters because not all certifications imply the same resistance profile. For regulated identity programmes, lab provenance is part of the control evidence chain. Without it, certification becomes a claim about testing rather than proof of security outcome.

Practical implication: Require third-party lab evidence and confirm the test level before accepting a biometric liveness control into a regulated workflow.

Threat narrative

Attacker objective: The attacker aims to pass biometric onboarding as a legitimate user and obtain trusted access or enrolment.

1. Entry occurs when an attacker presents a fake biometric artifact such as a printed image, replayed video, or mask to the onboarding channel.
2. Credential access is attempted through spoof acceptance, where the liveness control incorrectly treats the presentation attack as a genuine user.
3. Impact follows when the false acceptance enables account opening, identity enrolment, or access to regulated services under a fraudulent identity.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Certification is the control evidence, not the control itself: In biometric onboarding, the security programme does not end at a liveness claim. ISO/IEC 30107-3 gives teams a defensible testing frame, but the operational question is whether the evidence behind the claim is complete, current, and independently produced. Practitioners should treat certification as proof support for a control decision, not as the decision itself.

APCER and BPCER expose the governance trade-off that feature lists hide: Liveness controls are only useful when teams can see both spoof acceptance and legitimate-user rejection. That means identity governance has to absorb performance evidence, not just security assertions. The implication for practitioners is straightforward: a biometric control that cannot show both attack resistance and user tolerance is not ready for high-trust onboarding.

Deepfake pressure is making liveness assurance a lifecycle issue: Once spoofing methods improve, the question is no longer whether a vendor once passed a test, but whether the assurance posture is continuously validated against current attack patterns. That moves liveness from one-time procurement review into ongoing identity control governance. Practitioners should re-evaluate certification as a living evidence stream, not a static badge.

Biometric onboarding now sits inside the broader identity trust boundary: Liveness testing is no longer a niche biometric concern. It intersects with KYC, regulated identity proofing, fraud prevention, and access assurance, which means security and identity teams need shared ownership of the test evidence. The practical conclusion is that biometric assurance belongs in the same governance conversation as identity proofing and fraud control.

What this signals

Biometric trust is becoming an evidence discipline: Teams that rely on face-based onboarding need a repeatable way to judge whether liveness controls are actually resisting presentation attacks. That means procurement, fraud, and identity governance must look at the same proof set rather than separate vendor claims from operational acceptance.

Independent validation changes the security conversation: Once a biometric control is tested by a third party, the discussion shifts from feature promises to verifiable performance. That is the right model for regulated identity programmes, because trust should rest on testable outcomes, not on a product description.

APCER and BPCER should be part of control governance: If one number improves while the other worsens, the programme may be trading spoof resistance for friction or vice versa. Identity teams should treat those metrics as ongoing control health indicators, not one-time procurement data.

For practitioners

• Require ISO/IEC 30107-3 evidence Make ISO/IEC 30107-3 certification a baseline requirement for any biometric liveness control used in onboarding, KYC, or identity proofing.
• Review APCER and BPCER together Ask vendors to provide both attack acceptance and legitimate-user rejection rates so you can judge security and usability as one control decision.
• Verify independent lab provenance Confirm that testing was performed by an accredited third-party lab and not only through internal validation or self-declared compliance.
• Reassess liveness after spoofing changes Schedule periodic review of liveness evidence so newer attack techniques do not outpace the control assumptions in your onboarding flow.

Key takeaways

• Biometric liveness only becomes defensible when the control is tied to recognised PAD testing and independent validation, not self-declared performance.
• APCER and BPCER together show whether a biometric system is resisting spoofing without creating an unacceptable rejection burden for real users.
• For regulated onboarding, the practical standard is evidence quality: accredited lab testing, transparent metrics, and ongoing reassessment as spoofing techniques evolve.

Key terms

• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• APCER: APCER is the rate at which a biometric system incorrectly accepts an attack presentation as genuine. It is a direct measure of spoof resistance and matters most when the identity decision carries fraud, onboarding, or access risk.
• BPCER: BPCER is the rate at which a biometric system incorrectly rejects a legitimate user. It matters because identity security that creates too many false rejects often drives manual workarounds, exception handling, and weaker operating behaviour.
• Independent Lab Validation: Independent lab validation is third-party testing performed outside the vendor's own environment, usually under an accredited test programme. For biometric security, it makes the assurance claim more defensible because it separates measured performance from self-reported marketing evidence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.