Topic starter
11/07/2026 8:38 pm
TL;DR: Liveness claims only become defensible when they are tied to ISO/IEC 30107-3 testing and independent validation, Oz Forensics notes. Biometric onboarding then needs evidence that spoof resistance and user rejection rates were measured together, not guessed from vendor claims.
Editorial analysis by NHI Mgmt Group, based on content published by Oz Forensics: “How to Choose a Liveness Solution That Actually Works?”.
By the numbers:
- For a system to pass Level 2, it must maintain a BPCER/FNMR below 15%.
Key questions
Q: Why do APCER and BPCER both matter in identity verification?
A: APCER shows how often spoofing is accepted, while BPCER shows how often real users are rejected.
Q: How should teams evaluate a liveness solution for regulated identity proofing?
A: Start with the standard, then inspect the evidence.
Q: What breaks when biometric liveness is based on marketing claims instead of accredited testing?
A: The control becomes hard to trust because no one can tell whether spoof resistance was actually measured under defined conditions.
Practitioner guidance
- Require ISO/IEC 30107-3 evidence Make ISO/IEC 30107-3 certification a baseline requirement for any biometric liveness control used in onboarding, KYC, or identity proofing.
- Review APCER and BPCER together Ask vendors to provide both attack acceptance and legitimate-user rejection rates so you can judge security and usability as one control decision.
- Verify independent lab provenance Confirm that testing was performed by an accredited third-party lab and not only through internal validation or self-declared compliance.
Bottom line: Biometric liveness only becomes defensible when the control is tied to recognised PAD testing and independent validation, not self-declared performance.
Glossary terms: Presentation Attack, APCER, BPCER, Independent Lab Validation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 9:06 pm
Certification is the control evidence, not the control itself: In biometric onboarding, the security programme does not end at a liveness claim. ISO/IEC 30107-3 gives teams a defensible testing frame, but the operational question is whether the evidence behind the claim is complete, current, and independently produced. Practitioners should treat certification as proof support for a control decision, not as the decision itself.
A question worth separating out:
Q: When is biometric liveness strong enough for KYC and high-trust onboarding?
A: It is strong enough only when the testing method, lab provenance, and error rates all align with the risk of the workflow. For KYC or other regulated onboarding, the control must withstand spoof attempts without rejecting too many genuine users. If the evidence is missing or vague, the control is not yet fit for high-trust use.
👉 Read our full editorial: ISO/IEC 30107-3 is the real test for liveness security