HyperVerge Clears Two Biometric Tests, as Deepfakes Reach India’s Remote KYC
The Indian identity company, HyperVerge, passed the toughest presentation-attack tier and a European injection-attack evaluation. The two test different things, and only one is accredited.
HyperVerge, a Bengaluru-based identity verification company, announced that it has passed two independent biometric security evaluations: ISO/IEC 30107-3 presentation attack detection at Level 3, the toughest tier, and an injection attack detection evaluation aligned to the European specification CEN/TS 18099. The company says it is the first Indian provider to clear both. An Australian laboratory, BixeLab, ran the tests and published letters of confirmation that set out the methodology and the results, which makes the claims checkable in a way that most security marketing is not.
The two evaluations matter because they test different things, and the difference is the point. A presentation attack puts something fake in front of a real camera: a photograph, a silicone mask, a screen replaying a video. An injection attack skips the camera, feeding a manipulated stream straight into the onboarding system through a virtual camera, an emulator or a hooked function, so a deepfake appears to come from a real customer completing a live check. A liveness algorithm reasons about what an image contains. An injection attack is a statement about where the image came from, and no improvement to the first answers the second.
What HyperVerge announced
HyperVerge runs identity verification and fraud prevention for banks, non-bank lenders, fintechs and insurers, and it builds its models in house. Its HyperKYC software development kit, with what it calls a FAS system on the liveness backend, went through both evaluations at BixeLab’s laboratory in the Australian Capital Territory. For the presentation attack test, BixeLab built five Level C attack species from six consenting subjects and ran 150 attack transactions and 50 genuine ones, and it recorded zero classification errors on the attacks, a transaction-level false rejection rate of 4 per cent and a user-level false rejection rate of zero.
For the injection test, BixeLab ran four attack methods and ten attack instruments, including virtual cameras, USB capture devices, face swaps, deepfakes and 3D avatar reenactment, across Android, iOS and web, and the system rejected all 630 injection transactions. HyperVerge’s head of AI, Hariprasad PS, describes how evaluators rooted a device, hooking the SDK to intercept the camera feed and pushing deepfake video through virtual cameras.
Two different attacks
The distinction between the two evaluations is worth dwelling on, because it decides what a buyer is actually getting. Presentation attack detection, standardised in ISO/IEC 30107-3 since 2017, measures whether a system can tell a live face from a fake object presented to its camera. Level 3 is the most demanding tier, and it assumes a well-resourced attacker: evaluators spend days crafting medical-grade silicone masks, latex coverings and sculpted artefacts tuned to a specific target, then vary the lighting, angle and device to maximise realism.
HyperVerge has climbed that ladder over five years, passing Level 1 with a different laboratory in 2021 and Level 2 in 2024, and Level 3 is a harder test than either. The levels describe the effort an attacker brings: Level 1 covers casual attempts with readily available artefacts, Level 2 covers moderate effort, and Level 3 assumes someone with skill, time and a budget who will build a custom instrument for a specific face.
BixeLab’s letter records five attack species derived from six consenting subjects, tested on a Samsung Galaxy S25 and an iPhone 13, which is a small but deliberately targeted sample. A pass at this level is a meaningful signal, and it is also a snapshot of one software version. Injection attack detection is newer and less settled. The European Committee for Standardization published CEN/TS 18099 in 2024, and regulators now reference it for remote identity proofing under the European digital identity framework. A liveness check cannot detect an injection, because it examines the image rather than its origin, which is why the second evaluation exists at all.
The accreditation caveat
Here is the part the release does not dwell on, and it matters. BixeLab’s own letter of confirmation for the injection test states that the National Voluntary Laboratory Accreditation Program, which accredits the lab for presentation attack testing, does not currently accredit injection attack detection to CEN/TS 18099. The evaluation, in the lab’s words, ran in close alignment with the specification but does not constitute an accredited outcome, and the letter adds that it is not a certification, benchmark or endorsement by any government agency. Germany’s federal cyber security agency goes further.
In draft guidance published in July, it observes that CEN/TS 18099 does not cover all publicly known attack vectors, gives no guidance on rating known attacks, and does not ensure a laboratory can assess high-potential threats, concluding that evaluations following it provide only limited confidence and depend heavily on the evaluator. None of that makes HyperVerge’s result worthless; the lab holds accreditation and publishes its methodology. It does mean the injection result is a strong piece of evidence rather than a certificate.
The release also carries a small but telling error: the headline and opening paragraph call the standard CEN/TS 19099, while the body correctly calls it CEN/TS 18099. A reader checking the claim against the specification would find only the second number. It is the kind of slip that a careful vendor avoids, and it is worth noting because the whole value of the announcement rests on precision about which standard was tested.
Why this matters in India
The Indian context gives the announcement its weight. Banks, non-bank lenders, insurers and fintechs onboard millions of customers remotely, and video-based customer identification has been part of the regulatory toolkit since the Reserve Bank of India formalised it. The cheapest way to defeat such a journey is no longer a mask. India’s own cyber crime coordination centre issued an advisory in June warning that criminals use deepfake videos and synthetic identities to bypass facial authentication and liveness checks, and describing a workflow in which fraudsters harvest facial data through fake job interviews and video calls, generate a replica, and use it to pass verification.
The World Economic Forum, in a report this year, evaluated seventeen face-swapping tools and found that the highest risk came from those combining real-time swapping with a virtual camera path into the verification flow, and that some browser-based flows failed against injection while modern SDK-based systems held. That is precisely the distinction HyperVerge is claiming to have tested.
HyperVerge is not alone at this level, and the release’s claim is narrower than it may read. BixeLab‘s public list of letters of confirmation shows Level 3 presentation testing for Legitimuz, Emirates Face Recognition, Advance.AI, OzForensics, Verichains and FaceTec, and injection evaluations for IDEMIA, Aware, FaceTec and others. What HyperVerge can claim is a first in India, where the buyer base is large and the domestic competition includes IDfy, Signzy and several bank-owned systems. The distinction matters for procurement: a bank comparing providers should look for the same evaluations across the shortlist rather than treating a single pass as a differentiator.
What buyers should ask
For a bank or lender weighing an identity provider, the questions are specific. Which standard and which level did the evaluation cover, and can I read the laboratory’s letter rather than the vendor’s summary? Was the injection test accredited, or aligned to the specification, and what does the lab say about the limits? Which versions of the software were tested, and does my deployment run those versions? How does the system detect the capture path, not just the image, since that is what catches injection? What is the false rejection rate, because a system that stops attacks by rejecting genuine customers creates its own cost? And how often does the provider re-test, given that attack tools improve every few months?
What it signals
HyperVerge has done the work that matters in identity security, which is to submit its system to an independent laboratory, publish the methodology and accept the results. That is more than most vendors in the category do, and it puts the company alongside the handful of global providers that have passed Level 3 presentation testing and injection evaluations. The limits are the ones the whole field shares. The injection standard is immature, the accreditation does not yet cover it, and a determined attacker adapts faster than a test report ages. The right reading is that HyperVerge has raised the floor for Indian identity verification, and that buyers should treat the published letters as evidence to interrogate rather than a badge to trust.
That is the useful way to read the announcement. HyperVerge has produced evidence that a bank can inspect, from a laboratory with published methodology, and it has done so on the two attack classes that matter for remote onboarding. The company’s scale figures, two billion transactions and 55 million fraud attempts stopped, give a sense of the volume it handles, though both are self-reported. The gap that remains is the one every identity provider shares: a test report describes a laboratory’s best effort on a fixed version, while the fraud economy iterates monthly. HyperVerge has moved the Indian baseline up, and that is the honest measure of a certification. Whether it stays there depends on how often it returns to the laboratory and what it publishes when it does.