Liveness checks are everywhere online. They give the same reassurance as a face-to-face age or identity check: that the person on the other side is real.
They sit behind how people open accounts, access services and prove who they are (or how old they are). They also stop bots and bad actors from creating fake accounts, be that on dating sites where people are tricked into relationships with someone who doesn’t exist, or on ticketing sites where bots snap up all the best seats to resell at a profit.
Because liveness checks sit right at the front of these journeys, they have to work. And they have to keep working even as attacks get more sophisticated. That’s why this news matters:
Yoti’s MyFace is the first passive, single-selfie liveness technology in the world to conform to iBeta’s Level 3 testing under ISO/IEC 30107-3 – their highest level for liveness checks.
That’s a lot of jargon, so let’s unpack what it really means and why it matters for anyone relying on liveness checks to protect their users and their business.
Why effective liveness checks matter more than ever
As more of life moves online, liveness checks have become part of the infrastructure. They’re used for opening accounts, verifying identities, age checks, access control, issuing digital IDs and preventing mass fake registrations.
At the same time, the risks have changed, with AI-generated faces, screen-based attacks (now as common as photos) and hyper-realistic masks no longer rare or experimental. They’re widely available and improving fast, which means they’re already being used by fraudsters to exploit weak liveness systems.
When liveness checks fail, the fallout is real. Fake users get through. Accounts are taken over. Money is lost. Businesses face regulatory risk. And trust, which takes years to build, can disappear overnight.
What a liveness check actually needs to do
When someone is asked to take a selfie as part of an age or identity check, the liveness step has one critical job. It needs to work out whether there’s a real, live person in front of the camera, and not a photo, video, mask or deepfake.
If a liveness check gets this wrong, everything that follows is at risk. Even the most accurate face matching or identity verification systems are compromised if a fake ‘person’ slips through at the start. Getting liveness checks right is hard and that creates a vulnerable spot for attackers to exploit.
Why passive liveness checks are harder than they look
Some liveness checks are active, asking people to perform an action like blinking, smiling, turning their head or repeating a phrase. That can help but, with modern technology, it’s increasingly easy for deepfakes to mimic these actions convincingly and fool weak liveness detection systems.
Our MyFace technology is passive. Passive liveness checks don’t ask people to do anything special. There are no prompts or movements. The person just takes a single quick selfie, which is analysed for signals that indicate whether the face is real and present. This makes the experience much faster and easier for users, and leads to higher completion rates.
But, if liveness checks aren’t strong enough, they can let attacks slip through unnoticed, creating opportunities for fraud.
What is iBeta Level 3?
iBeta is one of the world’s most respected independent testing labs for liveness detection. It’s the only lab certified by the National Institute of Standards and Technology (NIST) to issue conformance for ISO/IEC 30107-3 applications – the international standard for presentation attack detection.
Presentation attacks are attempts to fool a system by showing something fake to the camera, like a photo of someone else, a video replayed on another device (like a phone or laptop), a mask or an AI-generated face.
This standard has three testing levels. Level 3 is the highest. At Level 3, experts in attacking biometric systems are given weeks to try to trick the technology using expensive, sophisticated masks and techniques, with no budget limits. These are the kinds of attacks used by well-resourced fraudsters in the real world. In comparison, Levels 1 and Level 2 place tighter limits on the time and budgets available to trick the system.
To pass Level 3, a system has to stop almost every attack. If a single mask successfully fools the technology more than twice out of 20 attempts, the system fails. Our MyFace technology detected every single attack. That makes it the first liveness detection technology of any kind to do so.
What Level 3 liveness detection changes in practice
Many liveness solutions look good on paper. But without independent testing against the toughest attacks, it’s hard to know how they’ll perform in the real world. Level 3 removes that uncertainty, providing objective, third-party proof that MyFace can stand up to the most advanced presentation attacks (not just basic photos or videos), without adding unnecessary friction for genuine users.
In practical terms, using MyFace means:
- Fewer fake users getting through – Sophisticated attacks are stopped before they reach live systems.
- Lower fraud and stronger compliance – Technology tested at the highest testing level reduces the risk of costly failures later.
- A smoother experience for real people – Strong security is delivered passively, with no extra steps or interruptions.
- Confidence at scale – It has the ability to run tens of millions of checks a day, without the complexity of hosting liveness systems on-premise.
Until now, many assumed that only the best active liveness systems could ever conform to Level 3 standards, and that the bar was simply too high for a single-selfie approach. This result proves otherwise.
Why this matters, from our CEO
Robin Tombs, CEO at Yoti, said, “When iBeta introduced Level 3 last summer, it was clear the bar for liveness checks would fundamentally change. iBeta Level 3 is designed to withstand expert, well-resourced attacks, including very expensive, high-quality masks. At that point, I set our R&D team a challenge – for Yoti to be the first to meet this new, gold standard with just a single-selfie, passive liveness solution. No prompts, no friction and no compromise on security or the user experience.
What our team has delivered is exceptional. We have proved that we can stop sophisticated fraudsters from beating liveness checks and demonstrated that businesses no longer need to choose between security, customer experience and ease of use. This milestone sets a new benchmark for trusted liveness detection and I’m incredibly proud of what we’ve achieved. Yoti’s MyFace liveness technology is going to move the goalposts – banishing claims that high-quality liveness checks can’t be both secure and easy to use with independent evidence that it absolutely can.”
If you’d like to learn more, take a look at our latest liveness white paper.
– The Yoti Team
