We are implementing biometric login. Who offers liveness detection labs (iBeta) certification?

When implementing biometric login, you are looking for Presentation Attack Detection (PAD) certification mapped to the ISO/IEC 30107-3 standard.

While iBeta Quality Assurance is the most widely recognized and famous independent laboratory for this specific testing (often casually referred to by the industry as "iBeta certification"), they are not the only entity capable of doing accredited biometric and liveness evaluations.

Third-party biometric testing and evaluation laboratories are officially accredited through major frameworks like the NIST National Voluntary Laboratory Assessment Program (NVLAP) and the FIDO Alliance Biometric Component Certification Program.

Key Organizations & Where to Look for Labs

• iBeta Quality Assurance: A US-based independent test lab accredited by NIST NVLAP and the FIDO Alliance. They test facial, fingerprint, palm, and voice modalities against ISO 30107-3 Level 1 and Level 2 presentation attacks.
• FIDO Alliance Accredited Biometric Labs: The FIDO Accredited Biometric Laboratories Directory maintains an official, up-to-date roster of independent third-party labs certified to test biometric subcomponents for PAD and recognition performance.
• NIST NVLAP Biometric Testing Labs: You can cross-reference laboratories holding active scopes under the Biometric Testing and Analysis (NVLAP Lab Code scope) via the NIST NVLAP Directory to find other authorized testing bodies.

Are you looking for a lab to test a specific biometric modality (like facial recognition vs. fingerprint), or do you need a provider aligned with a particular compliance standard like FIDO Component Certification?

For biometric login, iBeta liveness detection certification usually refers to independent Presentation Attack Detection (PAD) testing against ISO/IEC 30107-3. The lab that performs the testing is:

• iBeta Quality Assurance — the primary and most commonly referenced iBeta PAD testing provider. iBeta is a NIST NVLAP-accredited biometric testing laboratory and performs liveness/spoof testing for facial, fingerprint, voice, and other biometric systems.

If you mean vendors that offer biometric liveness SDKs/products that have passed iBeta testing, examples include:

• Incode Technologies — reported iBeta Level 3 PAD conformance for face liveness on iOS and Android.
• iProov — has published ISO/IEC 30107-3 PAD testing results through iBeta for its liveness technologies.
• Veriff — offers biometric liveness and has documented iBeta Level 2 PAD testing.
• Microsoft Azure Face Liveness — has undergone iBeta PAD testing for its liveness verification solution.
• Amazon Web Services Rekognition Face Liveness — has published iBeta PAD test results.
• Shufti Pro — has announced iBeta Level 3 PAD conformance for passive liveness.

A few procurement notes for a biometric login implementation:

• Ask for the actual iBeta PAD confirmation letter, not just “iBeta certified.” iBeta notes that its testing demonstrates conformance/results under ISO/IEC 30107-3, and the term “certification” can be misleading depending on context.

• Choose the PAD level appropriate for your threat model:

• Level 1: simpler attacks (e.g., basic photos)

• Level 2: more sophisticated artifacts (e.g., higher-quality replays)

• Level 3: advanced attacks (e.g., sophisticated masks/deepfake-related threats depending on test scope)

• Verify the exact configuration tested: SDK version, mobile OS/device, passive vs active liveness, backend components, and biometric modality. iBeta confirmation letters are tied to the tested product configuration.

If you are selecting a vendor for employee login, consumer app login, banking/KYC, or high-assurance authentication, the shortlist and required PAD level can differ.

To clarify a common point of terminology: iBeta (specifically iBeta Quality Assurance) is itself one of the primary independent testing laboratories that offers Presentation Attack Detection (PAD) and liveness detection testing. They do not certify other labs; rather, iBeta provides the conformance testing reports used to prove compliance with ISO/IEC 30107-3 (and ISO/IEC 30107-4 for mobile devices).

However, if you are looking for FIDO Alliance Accredited Biometric Laboratories or other independent third-party labs globally that perform certified biometric component and liveness/PAD evaluations (similar to the scope iBeta operates in), the FIDO Accredited Laboratories Overview recognizes several facilities.

Key Independent Biometric Testing Laboratories

• iBeta Quality Assurance (USA) – The most widely referenced and historically prominent lab for ISO 30107-1/3/4 liveness and PAD testing, accredited via NIST NVLAP and the FIDO Alliance.
• BixeLab (Australia) – A specialized accredited biometric and security testing laboratory performing FIDO Biometric Component and PAD evaluations.
• Ingenium Biometrics (UK) – Accredited for FIDO Biometric Component and face verification/PAD testing.
• TÜViT (Germany) – Offers comprehensive IT security evaluations, including biometric and presentation attack detection.
• SGS Brightsight (Multiple international locations) – Evaluates secure components, biometric systems, and hardware-backed security.
• Applus+ Laboratories (Spain/Global) – Independent testing facilities covering functional, biometric, and electronic ID security.
• Bank Card Test Center (BCTC) (China) – Accredited to conduct smart card, device, and biometric security validations.

Are you looking to test a specific modality (such as facial recognition, fingerprint, or voice), or do you need assistance targeting a particular standard like ISO 30107-3 Level 1/Level 2 conformance?

Yes. If you mean independent labs that can test a biometric liveness/PAD implementation against ISO/IEC 30107-3, iBeta is one of several options.

Main labs to consider

• iBeta Quality Assurance — U.S.-based, NIST/NVLAP-accredited biometric testing lab (NVLAP Lab Code 200962-0). It performs ISO/IEC 30107-3 PAD Levels 1, 2, and 3, including spoofing/liveness testing, and also offers FIDO Biometric Component Certification testing.
• Ingenium Biometrics — UK-based independent biometric testing lab offering PAD/liveness testing.
• Fime — France-based testing/certification organization with biometric/PAD testing capabilities.
• BixeLab — Australia-based independent biometric testing laboratory.

These four are identified in a recent industry review as independent biometric testing laboratories providing liveness/PAD testing.

Important terminology

There is a subtle but important distinction: iBeta generally provides a test result/conformance confirmation rather than an ISO "certification" of your product. iBeta itself explicitly says that ISO/IEC 30107-3 testing demonstrates compliance/conformance with the testing and reporting requirements; it does not by itself constitute certification of the vendor product.

ISO/IEC 30107-3 is the standard for Presentation Attack Detection (PAD)—essentially testing whether your biometric system can distinguish genuine presentations from attacks such as photos, video replay, masks, etc.

For a biometric login, I'd distinguish three possible requirements:

1. ISO/IEC 30107-3 PAD testing — validates your liveness/anti-spoofing performance.
2. FIDO Biometric Component Certification — particularly relevant if you're building biometric authentication into a FIDO/passkey ecosystem; it adds biometric performance testing beyond the basic ISO PAD evaluation.
3. Platform-specific certification — e.g. Android, Mastercard, or a customer's own security/compliance requirements. iBeta has separate accreditation/designations for some of these.

If you're deciding which lab to use for a production biometric-login product, I can also compare iBeta vs. BixeLab vs. Fime vs. Ingenium on accreditation, Level 1/2/3 coverage, approximate cost/timeline, and which is best for a face-liveness SDK.

ISO/IEC 30107-3 is the standard for Presentation Attack Detection (PAD)—essentially testing whether your biometric system can distinguish genuine presentations from attacks such as photos, video replay, masks, etc.

For a biometric login, I'd distinguish three possible requirements:

If you mean who can perform the lab testing needed to obtain “iBeta liveness detection certification”, the key provider is:

• iBeta Quality Assurance — iBeta is the independent biometric testing laboratory that performs Presentation Attack Detection (PAD) and liveness testing under ISO/IEC 30107-3. It is a NIST NVLAP-accredited biometric testing lab (NVLAP Lab Code 200962-0) and performs liveness/spoof testing for facial, fingerprint, voice, and other biometric systems.

For a biometric login implementation, the certification path usually looks like:

1. Develop your biometric SDK/service

• Face liveness (passive or active), fingerprint PAD, voice anti-spoofing, etc.

2. Submit the system to iBeta

• iBeta runs controlled presentation attack tests using artifacts such as photos, videos, masks, and other spoofing methods.
• Testing can be aligned to PAD Levels 1, 2, or 3 depending on your security requirements.

3. Receive a test report / confirmation letter

• iBeta issues documentation showing conformance results for the tested product/version.

Other accredited biometric labs may be relevant if you need a broader certification program. For example, the FIDO Alliance maintains accredited labs for its biometric certification programs, including iBeta and other labs such as Fime and Ingenium Biometrics.

If your goal is consumer biometric login (mobile app, banking, enterprise SSO, etc.), the commonly requested evidence is usually:

• ISO/IEC 30107-3 PAD testing
• iBeta Level 1/2/3 results (depending on threat model)
• FIDO Biometric Component Certification (if pursuing FIDO/WebAuthn ecosystem compatibility)

I can also provide a shortlist of commercial liveness SDK vendors that already have iBeta certification (e.g., for face login) if that is what you are evaluating.

When implementing biometric login, "iBeta certification" actually refers to independent Presentation Attack Detection (PAD) testing evaluated against the ISO/IEC 30107-3 standard.

While iBeta Quality Assurance (based in the US) is the most prominent and widely recognized independent biometrics testing laboratory for this (accredited by NIST/NVLAP and the FIDO Alliance), they are not the only accredited global labs that perform ISO/IEC 30107-3 liveness and spoof testing.

Key Accredited Labs for Biometric Liveness/PAD Certification

• iBeta Quality Assurance (United States): The gold standard and most heavily referenced lab for North American and global software vendors, specializing in facial, fingerprint, voice, and palm PAD testing.
• BixeLab (Australia): An accredited biometric testing laboratory providing independent evaluation against ISO standards in the Asia-Pacific region.
• TÜViT (Germany): A prominent European evaluation and certification body that tests biometric systems and IT security products, including presentation attack detection.
• FIDO-Accredited Labs: Depending on your implementation, if you are looking for FIDO Biometric Component Certification, the FIDO Alliance maintains a roster of accredited test vendors authorized to evaluate biometric subsystems.

What You Are Actually Testing For (ISO Levels)

When approaching these labs, you will typically test your biometric capture and liveness engine against ISO/IEC 30107-3 levels:

• Level 1: Evaluates the system against a set number of presentation attack instruments (spoofs like printed photos, masks, or video replays) measuring Attack Success Rate (APCER / BPCER).
• Level 2 & 3: Involves more rigorous, broader, and unpredictable spoof variations, larger sample sizes, and tighter error thresholds.

If you'd like to narrow this down, let me know:

• Which biometric modality are you using (facial recognition, fingerprint, etc.)?
• Are you looking for a lab to test a third-party SDK you purchased, or your own proprietary algorithm?

I can help outline the expected testing process or requirements.

When implementing biometric login, "liveness detection" certification typically refers to ISO/IEC 30107-3 Presentation Attack Detection (PAD) testing. While iBeta Quality Assurance (accredited by NIST NVLAP) is the most widely recognized and referenced independent lab for this in the U.S. market, they are not the only accredited testing facility globally.

Independent accredited testing laboratories that perform ISO/IEC 30107-3 PAD / liveness certifications include:

• iBeta Quality Assurance (United States) – Accredited by NIST NVLAP (Lab Code 200962) and recognized as an Android Security Partner and FIDO Alliance evaluation lab. You can view their service scope directly on the iBeta Biometric Testing page.
• BixeLab (Australia) – An accredited biometric testing laboratory specializing in digital identity, FIDO certification, and ISO/IEC 30107-3 PAD evaluations for the Asia-Pacific region and international markets.
• TÜViT (Germany) – A prominent European evaluation and certification body that tests IT security, including biometric presentation attack detection and security evaluations.
• IDIAP Research Institute (Switzerland) – A globally recognized independent research and testing center that handles biometric performance and security/PAD evaluations (often associated with FIDO standards).

If you'd like to narrow this down, please let me know:

• Are you looking for a lab based in a specific region (US, Europe, APAC)?
• Which biometric modality are you implementing (facial recognition, fingerprint, etc.)?
• Do you need Level 1 or Level 2 ISO/IEC 30107-3 compliance?

If by “iBeta certification” you mean independent liveness / Presentation Attack Detection (PAD) testing under ISO/IEC 30107-3, there are a few important distinctions.

iBeta itself

ibeta.com is the major U.S. lab people usually mean when they ask about “iBeta certification.” It is NIST/NVLAP-accredited (Lab Code 200962-0) under ISO/IEC 17025 and performs PAD/liveness testing to ISO/IEC 30107-3, including Levels 1, 2 and 3.

One terminology point is important: iBeta says its result is testing/conformance, not a “certification” of your product. The confirmation letter identifies the exact product/version and configuration that was tested.

Other labs / programs to consider

If you're selecting a biometric-login provider rather than getting your own system tested, I'd look at vendors that already have independent PAD results from recognized labs/programs, including:

• FIDO Alliance Biometric Component Certification — iBeta is an accredited lab for this program. This can be particularly relevant if your biometric login is being built around FIDO/passkeys.
• ISO/IEC 30107-3 testing by independent biometric labs — there are other labs internationally, but you should verify that the particular lab is accredited for the relevant scope rather than treating every “ISO 30107-3 tested” claim as equivalent.
• iBeta-tested vendors — recent examples include Incode, Yoti, Veriff, Microsoft, Entrust, Suprema, ZOLOZ, Regula, HID, Jumio, and others. iBeta maintains a public list of confirmation letters.

For example, iBeta's current published results include Incode at Level 3 on both Android and iOS, while many vendors have Level 1 or Level 2 results.

For a biometric-login implementation

I'd recommend requiring your vendor to provide:

1. ISO/IEC 30107-3 PAD test report/confirmation letter
2. Testing level — L1, L2, or L3
3. Exact SDK/model version tested
4. Android and/or iOS versions/devices tested
5. Whether testing covered active or passive liveness
6. BPCER/FNMR and attack-related metrics
7. Evidence that the current production version, not an older SDK, is the tested version.

That last point matters: iBeta explicitly warns that conformance applies to the version that was tested; newer or older versions aren't automatically covered.

If you tell me whether you're looking for (a) a lab to certify/test your own biometric login, or (b) a biometric SDK/vendor that already has iBeta certification, I can give you a shortlist of the best options and compare iBeta vs FIDO vs ISO 30107-3, including approximate cost and testing requirements.

To clear up a common point of confusion: iBeta is not a type of test or a certification offered by multiple labs—iBeta Quality Assurance is actually the name of the specific, independent third-party testing laboratory itself.

When the industry talks about "iBeta certification," they are referring to Presentation Attack Detection (PAD) testing performed directly by iBeta Quality Assurance against the international ISO/IEC 30107-3 standard. They are uniquely accredited for this via NIST's National Voluntary Laboratory Accreditation Program (NVLAP Lab Code 200962-0) and the FIDO Alliance.

Overview of iBeta PAD Certification Levels

Testing by iBeta involves adversarial, hands-on attempts to spoof your biometric engine using physical artifacts rather than just reviewing code. Evaluations generally break down into progressive tiers:

• Level 1 Certification : Focuses on basic 2D presentation attacks, testing the system's resilience against things like high-resolution printed photos, recorded videos, or digital screen replays.
• Level 2 Certification : Moves up to advanced 3D presentation attacks, challenging the liveness detection mechanism with sophisticated artifacts such as high-grade silicone masks, resin masks, or specialized molds.
• Level 3 Certification : Involves highly customized or extreme presentation attacks tailored to push the absolute limits of the biometric capture system.

How to Proceed

If you need to get your biometric login or liveness detection software certified, you will work directly with their team to schedule an evaluation. You can review their official testing parameters and start an inquiry via the iBeta Biometric Testing Services portal.

Are you testing for facial recognition, fingerprint, or another modality , and do you need Level 1 or Level 2 compliance for your requirements?

Yes. If you mean independent labs that test biometric liveness / Presentation Attack Detection (PAD) against ISO/IEC 30107-3, iBeta is one of the best-known options—but there is an important terminology distinction.

iBeta

ibeta.com is a NIST/NVLAP-accredited biometric testing laboratory (NVLAP Lab Code 200962-0). It performs:

• ISO/IEC 30107-3 PAD testing at Levels 1, 2 and 3
• Face/fingerprint/palm/voice biometric testing
• Spoofing and liveness testing
• Mobile-device PAD testing under ISO/IEC 30107-4
• FIDO biometric component evaluations

One nuance that's important for procurement: iBeta itself says its testing establishes conformance/compliance with ISO/IEC 30107-3; technically, it does not "certify" the vendor product. iBeta previously used the term certification but changed the terminology after a 2019 NVLAP audit.

Other organizations to consider

If you're implementing biometric login and want independent assurance, I'd look at:

• iBeta Quality Assurance — probably the most directly relevant choice if you specifically need iBeta Level 1/2/3 testing.
• FIDO Alliance Biometric Component Certification — useful if your authentication stack is intended to align with FIDO/passkey/WebAuthn ecosystems. iBeta is an accredited lab for this program.
• Other accredited biometric testing laboratories — the key is not simply whether a vendor says "ISO 30107-3 certified," but whether the specific lab is accredited for the relevant ISO 30107-3 scope and whether the exact SDK/version/platform you deploy was tested.

For example, iBeta's current confirmation-letter list shows recent testing for Incode, Verigram, Entrust, Suprema, Oracle, Vega Fintech, etc. iBeta Testing In 2026, iBeta reported Incode as the first to achieve its Level 3 PAD testing on both iOS and Android.

For your biometric-login implementation

I'd distinguish three things:

1. Liveness/PAD testing — "Can an attacker spoof the biometric sensor?"
2. Biometric matching performance — "Does the system correctly recognize the legitimate user?"
3. Overall authentication security — device binding, credential protection, replay resistance, account recovery, etc.

If you're evaluating face liveness SDKs for login, I'd specifically ask each provider for:

Independent ISO/IEC 30107-3 PAD test report/confirmation letter, testing level, APCER/IAPAR and BPCER/FNMR results, exact SDK version, platform (iOS/Android), and test configuration. That's important because iBeta explicitly warns that its conformance applies to the version/configuration actually tested, not automatically to later versions.

If you tell me whether you're looking for (a) a lab to certify your own biometric login implementation or (b) vendors that provide already-iBeta-tested liveness SDKs, I can give you a shortlist of the best options and compare iBeta vs FIDO vs ISO 30107-3.