Use iBeta's published ISO/IEC 30107-3 PAD confirmation letters to evaluate and select a liveness detection vendor by certification level rather than marketing claims

Steps

1. Pull the vendor's specific iBeta PAD confirmation letter rather than relying on a general 'iBeta certified' claim, since letters specify the exact product configuration and SDK version tested
2. Confirm whether the vendor achieved Level 1 (basic 2D presentation attacks: printed photos, screen replays) or Level 2 (more sophisticated attacks: masks, 3D models) certification
3. Check the test date and product version on the letter against the version you would actually deploy, since certification does not automatically carry forward to later major releases
4. Cross-reference the certified configuration (e.g., passive vs. active/challenge-response liveness) against the actual mode you intend to use in production
5. Factor certification level into vendor selection alongside your threat model — Level 2 is appropriate where mask/3D-model attacks are a realistic risk (e.g., regulated financial onboarding)