HyperVerge Becomes First Indian Identity Verification Provider to Pass Independent PAD Level 3 and Deepfake Injection Attack Evaluation

Presentation attack detection, tested under ISO/IEC 30107-3, covers the first class. Level 3 is its most demanding tier: evaluators have days and a budget to build custom silicone masks and sculpted artefacts for specific targets. Injection attack detection, tested under CEN/TS 18099, covers the second. CEN/TS 18099 was published by the European Committee for Standardization in 2024 and is now referenced for remote identity proofing under eIDAS 2.0. ISO/IEC 30107-3 has been the international benchmark for presentation attack testing since 2017. Together, they are the two published frameworks a liveness system can be independently measured against.

Independent evaluations like the one HyperVerge has achieved against global and European standards offers risk, security and compliance leaders verifiable proof of system defense.

This matters in India because banks, NBFCs, fintech companies and insurers onboard millions of customers remotely, and the cheapest way to defeat a video-KYC journey is no longer a mask. It answers the most important question on the minds of BFSI leaders, “How good is the technology against fraud prevention?” HyperVerge cleared both global standards with results well within thresholds. This ensures injection attacks and deepfakes are stopped while genuine users get great customer experience.

“Attackers don’t stick to one fraud playbook. They may use physical masks in one instance and AI generated identities or manipulate video in another,” said Kedar Kulkarni, Co-founder and CEO of HyperVerge. “These independent evaluations give banks, financial institutions, insurers and fintech companies objective evidence of how our technology performs against sophisticated attacks, while maintaining a seamless experience for genuine users. We will continue to invest in fraud prevention so legitimate customers can access financial services quickly while bad actors face stronger barriers.”

What exactly do these certifications test for and how rigorous are the tests?

A third-party laboratory BixeLab in Australia evaluated HyperVerge’s defenses against fraud attacks against European standards through hundreds of genuine and fraudulent attempts across Android, iOS and web development kits. The testing covered attacks involving virtual cameras, USB capture devices, deepfake and face-swap videos. The evaluation followed CEN/TS 18099, a technical specification designed to test whether biometric systems can identify manipulated data injected during digital verification.

The certification independently verifies HyperVerge’s ability to detect attacks that use deepfakes, face swaps, virtual cameras and other methods to insert manipulated identity data into a digital onboarding journey.

Additionally, the ISO/IEC 30107-3 PAD Level 3 evaluates biometric systems against sophisticated presentation attacks. Testers spend days crafting hyper-realistic 3D presentation attack instruments like medical-grade silicone masks, latex coverings, wax molds and customized sculptures. They tune these artifacts to mimic human skin texture, facial depth and light reflectivity then manipulate ambient light, contrast, angles and device orientations to maximize the realism of every attempt.

This balance is important for financial institutions. Security systems that miss attacks expose organizations to fraud. Systems that frequently reject genuine customers cause delays, increase manual reviews and drive people away during onboarding.

“BixeLab’s evaluators approached our system the way a well-resourced attacker would. They rooted a device and concealed the root, decompiled and hooked our SDK to intercept the camera feed, and injected deepfake and face-swap video through virtual cameras and emulators across Android, iOS and web,” said Hariprasad PS, Head of AI at HyperVerge. “HyperVerge recorded a 0% false acceptance rate on both evaluations: not one deepfake, injected video or physical artefact was accepted as genuine. On the presentation attack test, every genuine user was verified, a 0% user-level false rejection rate. This outcome reflects several years of work on the capture layer itself.”

How this ties to HyperVerge’s mission to reduce financial fraud

For HyperVerge, the certification marks another step in its effort to build trusted identity infrastructure from India for organizations around the world.

HyperVerge builds its identity verification and fraud prevention technology in-house. Its AI models support face matching, liveness detection, deepfake detection, document verification, identity duplication, and other checks that help organizations distinguish genuine customers from fraudulent ones. HyperVerge designs its technology to work in real time, including on low-end devices and low-bandwidth networks.

“Every fake identity that enters the financial system creates a problem that banks must investigate later,” Kedar Kulkarni added. “Stopping that identity during onboarding protects the institution, its customers and the wider financial ecosystem.”