ISO/IEC 30107-3 is the international standard for testing biometric presentation attack detection. It sets out how to assess whether a system can tell a real person from a photo, mask or replay, how to report the results, and how to classify attack types. It does not certify anything, and it defines no levels.
That second point surprises most people who have read a liveness detection provider datasheet. It usually comes out late in a procurement call, when someone asks which level and the room goes quiet. You will see Levels 1, 2 and 3 quoted everywhere, always bolted onto the ISO number. The standard itself contains none of them.
The levels belong to iBeta, a testing laboratory that applies the standard’s method and sorts its own program by how much effort an attack takes to build. Once you can see that split, you can read a certificate instead of being sold one.
HyperVerge’s face biometrics went through a Level 3 evaluation at BixeLab in September 2026, so this guide is written from inside the process.
What ISO/IEC 30107-3 establishes
ISO/IEC 30107-3 gives presentation attack detection a shared test method, so a result from one laboratory means roughly the same thing as a result from another. The current edition is the second, published in January 2023, replacing the 2017 version.
The scope is narrower than the marketing around it suggests, and the exclusions are the useful half.
A testing and reporting method, not a certification
The published standard says it does three things: it sets out how to measure whether presentation attack detection works, how to write up the results, and how to classify the attacks themselves in an annex.
None of that is a pass mark, which is the step marketing copy skips when it shortens all of this to “ISO certified”. The standard tells a laboratory how to run and report a presentation attack test. Whether the resulting numbers are good enough for what you’re building is your decision, and no amount of reading the specification will take it off your hands.
What it explicitly excludes
Three things sit outside the scope, and the 2023 edition names them directly:
- Standardization of specific PAD mechanisms
- Detailed information about countermeasures, algorithms or sensors
- Overall system-level security or vulnerability assessment
That third one does a lot of work. A PAD evaluation looks at what happens at the camera, which is where passive liveness works. It has nothing to say about the system around the camera. You can hold a strong PAD result in one hand and a weak security posture in the other, and neither one contradicts the other.
!What ISO/IEC 30107-3 covers and what it excludes from scope
What do APCER and BPCER actually measure?
APCER and BPCER are the two error rates a presentation attack detection evaluation reports, and a certificate quoting one without the other is unreadable. Both come from ISO/IEC 30107-3, and both describe the same system tuned to the same threshold.
Reading them together is most of the skill here, and it’s the difference between checking a result and taking one on trust.
APCER, the attacks that got through
Attack Presentation Classification Error Rate is the proportion of attack presentations wrongly classified as genuine. A mask, a printed photograph or a replayed video that the system accepted.
Lower is better, and this is the figure that goes on the slide, because it’s the one that sounds like security. It’s also the easier of the two to engineer, since a system tuned hard enough to reject anything unusual will reject almost every attack and a good many real customers along with them. Hence the second number.
BPCER, the real users you turned away
Bona Fide Presentation Classification Error Rate is the proportion of genuine presentations wrongly rejected. A real customer, physically present, refused by the liveness check.
Lower is better here too. You’ll see this one quoted much less, because a rejected customer sounds like friction rather than security, and in a high-volume onboarding flow it’s the figure attached to revenue.
Why the two have to be read together
The two rates move in opposite directions on the same dial. Tighten the threshold and fewer attacks get through while more real customers get rejected. Loosen it and the reverse happens.
A provider can therefore produce an extraordinary APCER by tuning a system no genuine user can pass. iBeta’s published methodology handles this by fixing the other side of the trade. Its confirmation letters record a false non-match or BPCER limit, set at 15%, alongside the PAD level and the product version.
An APCER quoted without the BPCER it was achieved at describes half a system.
Subsystem metrics versus full-system metrics
Two more metrics turn up when the whole system is tested rather than one component. Impostor Attack Presentation Accept Rate and Impostor Attack Presentation Match Rate ask a blunter question: did the attack actually get through the biometric comparison end to end? That’s different from asking whether the PAD component noticed it.
A system can detect an attack and still match it, or flag nothing and still fail to match. The subsystem number and the full-system number answer different questions.
The levels belong to iBeta, not to the standard
ISO/IEC 30107-3 defines no conformance levels. The tiers everyone quotes belong to whichever laboratory ran the test, and iBeta is the lab that made them famous.
The distinction is not pedantry. It changes what a certificate claim is worth.
What the standard says about levels
The 2023 edition gives you scope text, metrics and a classification of attacks. You will not find a tier in any of them, because the standard is a way of measuring rather than a bar to clear.
So when someone says they are “ISO/IEC 30107-3 certified” and stops there, they have told you which manual they were measured against. They have not told you how they did.
What each iBeta level actually means
iBeta sorts its tiers by how much effort an attack takes, and it publishes the actual mechanism instead of describing it in adjectives. There’s a spending cap on the artifacts: Level 1 artifacts cannot exceed 30 US dollars, and Level 2 artifacts are limited to 300 US dollars.
| Level | Artifact cost ceiling | What the attacks look like |
|---|---|---|
| Level 1 | 30 US dollars | Printed photos, screen replays, low-cost artifacts anyone can build |
| Level 2 | 300 US dollars | Higher-quality masks and prints, artifacts needing resources and time |
| Level 3 | Not fixed by cost | Highly prepared instruments such as custom hyper-realistic masks |
Level 3 arrived later than the other two. Attack technology moved, Level 2 stopped separating serious systems from merely adequate ones, and the laboratory added a tier above the original pair.
iBeta also publishes how it picks the attacks. It uses six species, which the standard calls presentation attack instruments, and tries to apply them evenly across everyone it tests. If your system asks the user to do something, which active liveness does, the lab builds attacks that do exactly that thing: the movement, the smile, the blink.
The laboratories other than iBeta
BixeLab in Australia and TUViT in Germany run evaluations under the same standard, and a result from either carries the same methodological weight. Published head-to-head liveness comparisons are a different kind of evidence again, useful but not accredited. BixeLab published a Level 3 PAD evaluation of FaceTec’s mobile and web SDK implementations conducted in October 2025.
Naming the laboratory matters for the same reason naming the level does. Both are part of the result, and neither one is implied by the ISO number on its own. Ask which lab, and ask which level, because a team that has been through this will have both answers ready, and one that hasn’t will reach for the standard’s name instead.
How do you read a PAD confirmation letter?
A PAD confirmation letter is a short document, and almost all of its value sits in fields people skim past. iBeta publishes every letter it issues in a dated public table, which is the easiest way to see what a real one contains.
Six fields decide whether a certificate describes the product you are buying.
The six things a result must name
- The laboratory. Which accredited independent test laboratory ran the evaluation.
- The level. Which tier of the laboratory’s program. The ISO number on its own tells you nothing.
- The modality. Face, fingerprint, iris or voice. A fingerprint result says nothing about a face product.
- The product and version. iBeta’s table records exact versions, down to entries like v1.0.9 and v0.15.2.
- The error limit accepted. The false non-match or BPCER ceiling the result was achieved under, which iBeta records at 15%.
- The dates. When testing ran, and when the letter was issued.
Miss any of the six and you don’t have a result, you have a pointer to one. Ask for the letter.
What the test did not cover
Presentation attack detection stops at the capture device, by definition. An injection attack never reaches one: it swaps the feed out further upstream, through a virtual camera, an emulator or a hooked system function. Nothing is ever held up to a lens, so there is nothing for PAD to catch.
No ISO/IEC 30107-3 result, at any level, from any laboratory, says anything about injection resistance. A separate European specification, CEN/TS 18099, exists to test that surface, and Germany’s Federal Office for Information Security now requires accredited testing against it for regulated identity proofing before the end of 2026.
Certificates age
A confirmation letter names a version and a date. Shipping software passes both, usually within months.
HyperVerge builds identity verification for digital onboarding, covering fraud prevention and deepfake detection, and we have been through this evaluation ourselves. Running our own result through those six fields is the clearest way to show what they are for.
BixeLab, in the Australian Capital Territory, evaluated our face biometrics against ISO/IEC 30107-3:2023 in September 2026, at the tier its confirmation letter calls Level 3. Five attack-instrument species, built from six consenting subjects, across 150 attempts.
Not one of those attacks was classified as genuine.
Level 3 is the hardest tier a laboratory currently offers. It’s also where systems that cleared Levels 1 and 2 comfortably start to fail, because a mask built over several days for one specific face is a different problem from a photo held up to a lens.
Very few systems have been through it. Fewer still have been through it and the injection equivalent. HyperVerge is the first identity verification provider in India to pass at this tier, and one of a handful anywhere measured against both.
Bona fide testing produced two misclassifications in 50 presentations, a transaction-level BPCER of 4%. Every participant still completed at least one valid transaction, so the user-level error rate was zero. Tested on Android SDK 2.10.0 and iOS 1.6.1, on Samsung Galaxy S25 and iPhone 13 hardware.
We quote both BPCER figures together because they describe the same test. Reporting the 0% user-level number on its own would be the exact move the standard’s metrics exist to prevent.
iBeta, which runs the most widely cited program, drops its bona fide ceiling from 15% at Levels 1 and 2 to 10% before a system can qualify for Level 3. So a tier is defined as much by how many real users the lab will let you turn away as by the masks it builds.
“Ask for the re-test cadence before you ask for the certificate. A team that re-certifies on a schedule is telling you something about how they build. A team with one letter from three years ago is telling you something too.” Vignesh Krishnakumar, CTO, HyperVerge
Where this leaves us
We’re proud of this one. BixeLab spent 150 attempts trying to get a hyper-realistic mask past our liveness check, and none of them got through. That makes us the first identity verification provider in India to pass at Level 3, and the credit goes to a team that has spent months building for attacks most systems never see. The full story, including the injection attack evaluation we cleared alongside it, is in our press release.
FAQs
What is ISO/IEC 30107-3?
ISO/IEC 30107-3 is the international standard for testing biometric presentation attack detection. It establishes principles and methods for assessing PAD performance, how results are reported, and a classification of known attack types. The current edition is the second, published in January 2023.
Is ISO 30107-3 a certification?
No. ISO/IEC 30107-3 is a testing and reporting method, not a certification scheme. An accredited independent test laboratory applies the method and issues a result. A provider claiming to be certified to the standard should name the laboratory, the level and the product version tested.
What are APCER and BPCER?
APCER, the Attack Presentation Classification Error Rate, is the proportion of attacks wrongly accepted as genuine. BPCER, the Bona Fide Presentation Classification Error Rate, is the proportion of real users wrongly rejected. The two move in opposite directions and must be read together.
Does ISO 30107-3 define Levels 1, 2 and 3?
No. The standard defines no conformance levels. Those tiers belong to the testing program of iBeta, the laboratory that applies the method, which organizes them by attack potential. Level 1 and Level 2 are separated by a material cost ceiling of 30 and 300 US dollars.
What is the difference between iBeta Level 1 and Level 2?
Mostly it comes down to what the attack artifact costs to build. iBeta’s methodology caps Level 1 artifacts at 30 US dollars, covering printed photos and screen replays anyone can produce. Level 2 artifacts are capped at 300 US dollars, covering higher-quality masks and prints that need resources and preparation time.
Does ISO 30107-3 cover injection attacks?
No. Presentation attack detection is defined at the capture device, and an injection attack bypasses that device entirely by replacing the feed upstream. Injection resistance is tested under CEN/TS 18099, a separate European technical specification, by separately accredited laboratories. See how HyperVerge’s deepfake and liveness defenses perform under accredited PAD testing, and what we re-test against.
