FaceTec has successfully cleared the full spectrum of independent presentation attack detection (PAD) and injection attack detection (IAD) evaluations, announcing that its 3D Liveness technology achieved a zero percent failure rate across all five testing levels.
The testing was conducted by Australia-based BixeLab and the EU-accredited Ingenium Biometric Laboratories. The completion of these assessments means FaceTec has now been validated against physical spoofs, digital injection attacks, and camera bypass attempts by accredited third-party labs. The company reports that its software blocked every attempt across the testing framework, which included photos, high-quality masks, deepfakes, and emulator-based attacks.
Independent Lab Results
The evaluations were split between two ISO/IEC 17025-accredited laboratories. BixeLab, which has previously conducted independent performance and bias testing for New Zealand’s Identity Check system, managed the testing for Levels 1 through 3 and Level 5.
BixeLab’s testing reported a zero percent Attack Presentation Classification Error Rate (APCER) on all physical PAD attacks. On the digital side, the lab reported 100 percent rejection of 48 different injection attacks across Android, iOS, and Web platforms.
Ingenium Biometric Laboratories conducted complementary testing for Level 3 and Level 5. Ingenium, which was named earlier this year as one of the first accredited labs for the FIDO Alliance’s face-based remote IDV certification program, also reported a zero percent APCER. Their analysts tested against more than 40 attack types, including device rooting, virtual cameras, hooking, and API tampering.
Building on Security Architecture
This latest round of testing closes the loop on a security roadmap FaceTec has been executing throughout 2025. In September, the company achieved Level 4 security certification through Praetorian Security. That evaluation focused specifically on the “spoof bypass” layer, verifying that the software could resist reverse engineering, face data tampering, and attempts to decrypt the 3D FaceScan payload.
The rigorous testing schedule has run parallel to the company’s product updates. The underlying technology being tested is the recently released Version 10 of the 3D Face Verification software, which introduced the current neural network models used to defend against these increasingly sophisticated threat vectors.
Real-World Application: The UR Code Framework
While these certifications validate the software for remote onboarding – such as the fraud reduction recently reported by Tinder – they also serve as the trust anchor for FaceTec’s physical-to-digital identity strategy: UR Codes.
UR Codes function by embedding biometric data directly into a printed credential, whcih can be scanned to verify that the person holding the card is the legitimate owner. Earlier this year, FaceTec released the UR Scan+Match app to enable this verification on standard Android and iOS devices, effectively turning any smartphone into a high-security ID terminal.
For this decentralized approach to work, issuing authorities – such as DMVs or passport offices – must trust that the biometric engine on the phone cannot be tricked by a photo of the card owner or a manipulated video feed.
This is where the Level 1-5 testing becomes a critical enabler for adoption. With Owen McShane, formerly of the NY DMV, leading government relations, FaceTec is positioning the technology as a bridge between physical IDs and digital verification. The validation from BixeLab and Ingenium provides the necessary assurance to government agencies that the “unsupervised” verification performed by the app is resistant to the injection attacks and sophisticated spoofs that typically threaten mobile-based identity checks.
–
By Cass Kennedy and Alex Perala
