Incode hits iBeta Level 3 with passive selfie liveness

Incode has secured iBeta Level 3 Presentation Attack Detection (PAD) conformance for its face liveness technology on iOS and Android, recording 0% error rates in the independent assessment.

The evaluation followed the ISO/IEC 30107-3 framework, a widely used standard for assessing biometric defences against spoofing attempts. iBeta Quality Assurance conducted the testing.

The result covers a fully passive process that relies on a single selfie, rather than challenge-based prompts such as head turns or facial movements.

Testing results

iBeta's Level 3 programme targets more sophisticated attack methods than lower levels. The regime included 900 Level 3 presentation attacks.

Incode reported scores of 0% APCER and 0% BPCER. APCER measures whether spoof attempts are incorrectly accepted, while BPCER measures whether legitimate users are incorrectly rejected.

"We are the first company to independently achieve iBeta Level 3 conformance on both iOS and Android - with zero errors and without adding friction to users", said Ricardo Amper, Founder & CEO of Incode.

iBeta's Level 3 assessment is designed to reflect attackers with greater resources and more realistic artefacts. It aims to test whether a biometric system can detect attempts that go beyond common 2D spoofs such as printed photos and replayed videos.

"iBeta Level 3 is designed to simulate well-resourced attackers using hyper-realistic masks and specialized fabrication techniques intended to challenge modern biometric systems," said Evan Call, Business Development Manager and Director of Biometrics Sales and Marketing at iBeta Quality Assurance. "Incode's results demonstrate conformance at Level 3 on both iOS and Android, with 0% APCER and 0% BPCER reported during testing."

Single-selfie approach

Face liveness checks are used in digital onboarding and authentication flows. The technology assesses whether a real person is present at the point of capture, rather than a spoof artefact such as a photo, a video replay, or a mask.

Organisations use liveness signals alongside document checks and other risk controls in remote identity verification, aiming to reduce account takeovers, synthetic identity fraud, and impersonation scams.

Vendors often pair liveness detection with challenge-based interactions. These prompts can increase completion time and introduce failure points, particularly for users in poor lighting, on older devices, or with accessibility needs. Incode's result centres on passive capture, where the user takes a single selfie without prompts.

Progression claims

Incode linked the Level 3 outcome to progress through earlier iBeta levels. It introduced a passive liveness model in 2019 focused on detecting 2D attacks such as printed photos and replay attempts, and said that work led to Level 1 testing success with a passive approach.

By 2022, Incode said it expanded its defences to address advanced 3D mask attacks while continuing to improve 2D detection, supporting Level 2 testing success in early 2023.

Level 3 testing places greater emphasis on high-quality masks and specialised fabrication techniques. Incode's conformance claim for iOS and Android is presented as a cross-platform result under the same evaluation level.

Market context

Digital onboarding has become a default route into financial services, marketplaces, and government platforms. This shift has increased scrutiny of identity assurance controls, particularly in remote settings where a business does not see the user in person.

Fraud teams also face competing pressures: reducing losses from spoofing and impersonation while avoiding false rejections that can disrupt sign-ups and access, and drive customer service costs and churn.

Independent testing has become a procurement input for some buyers, particularly in regulated sectors. Standardised metrics can give security teams a shared basis for comparing systems, though real-world performance still varies by device mix, user behaviour, lighting conditions, and how liveness checks feed into broader risk decisions.

Incode said it operates at scale across banking, telecommunications, and online marketplaces, supporting eight of the top 10 US banks and eight of the top nine telecom companies. It also reported processing more than 7.1 billion trust checks.

Amper framed the result as assurance paired with a simplified user journey. "That combination matters. It proves we can meet the highest bar for liveness assurance while keeping onboarding fast and easy, even in regulated and high-risk environments," he said.