Topic starter
11/07/2026 8:38 pm
TL;DR: Liveness security is only as credible as the underlying testing standard, with ISO/IEC 30107-3, independent lab validation, and transparent APCER and BPCER metrics used to separate real presentation-attack resistance from marketing claims, according to Oz Forensics. In practice, biometric programmes should treat certification as a control evidence problem, not a feature checklist.
Editorial analysis by NHI Mgmt Group, based on content published by Oz Forensics: “How to Choose a Liveness Solution That Actually Works?”.
By the numbers:
- For a system to pass Level 2, it must maintain a BPCER/FNMR below 15%.
Key questions
Q: What breaks when biometric liveness is based on marketing claims instead of accredited testing?
A: The control becomes hard to trust because no one can tell whether spoof resistance was actually measured under defined conditions.
Q: Why do APCER and BPCER both matter in identity verification?
A: APCER shows how often spoofing is accepted, while BPCER shows how often real users are rejected.
Q: How should teams evaluate a liveness solution for regulated identity proofing?
A: Start with the standard, then inspect the evidence.
Practitioner guidance
- Require ISO/IEC 30107-3 evidence Make ISO/IEC 30107-3 certification a baseline requirement for any biometric liveness control used in onboarding, KYC, or identity proofing.
- Review APCER and BPCER together Ask vendors to provide both attack acceptance and legitimate-user rejection rates so you can judge security and usability as one control decision.
- Verify independent lab provenance Confirm that testing was performed by an accredited third-party lab and not only through internal validation or self-declared compliance.
Bottom line: Biometric liveness only becomes defensible when the control is tied to recognised PAD testing and independent validation, not self-declared performance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:06 pm
Certification is the control evidence, not the control itself: In biometric onboarding, the security programme does not end at a liveness claim. ISO/IEC 30107-3 gives teams a defensible testing frame, but the operational question is whether the evidence behind the claim is complete, current, and independently produced. Practitioners should treat certification as proof support for a control decision, not as the decision itself.
A question worth separating out:
Q: When is biometric liveness strong enough for KYC and high-trust onboarding?
A: It is strong enough only when the testing method, lab provenance, and error rates all align with the risk of the workflow. For KYC or other regulated onboarding, the control must withstand spoof attempts without rejecting too many genuine users. If the evidence is missing or vague, the control is not yet fit for high-trust use.
👉 Read our full editorial: ISO/IEC 30107-3 is the real test for liveness security