CHECKID · TRUST

PAD & ISO/IEC 30107-3

Explain Presentation Attack Detection and the bounded scope of PCEB 26/04/06.

Discuss integration →Claim ↔ Scope ↔ Evidence

CERTIFICATION EVIDENCE

Certificates published with explicit scope

Certificate → Standard → Capability → Public claim → Limitation.

ISO/IEC 27001:2022

SIS351224I008
05/12/2024 → 04/12/2027

Mobile-ID published scope includes CheckID; this is an information-security management-system certificate, not an algorithm certificate.

PCEB 26/04/06

ISO/IEC 30107-3:2017
06/04/2026 → 05/04/2028

Scope: eIDAS eID 2.0 module in Trusted Hub Service Provider Appliance QSCD; PAD Level 2 on Android phones and iPhones.

PCEB 26/04/07

eIDAS 2.0 · ETSI
07/04/2026 → 06/04/2028

Certificate-bounded scope; references ETSI EN 319 401, EN 319 411-1 and ETSI TS 119 461 at level HIGH.

STANDARDS MAPPING

From standards to controls

A module certificate is never generalized into a whole-service certification.

ISO/IEC 30107-3:2017

Biometric Presentation Attack Detection evaluation/reporting scope.

ETSI EN 319 401 .2.1

General policy requirements for trust service providers.

ETSI EN 319 411-1 V1.4.1

Policy/security requirements for certificate-issuing TSPs.

ETSI TS 119 461

Identity proofing concepts, authoritative evidence/source and HIGH scope per certificate.

SOURCE-BOUND REFERENCE

PAD evidence: certificate scope, current reference and threat boundary

Source → Scope → Evidence → Limitation

Current reference

ISO/IEC 30107-3:2023 is the current technical reference for PAD testing/reporting.

Certificate basis

PCEB 26/04/06 still shows ISO/IEC 30107-3:2017 because that is the basis stated on the certificate.

Scope

The certificate covers the eIDAS eID 2.0 module in Trusted Hub Service Provider Appliance QSCD, Level 2 on Android phones and iPhones according to the certificate matrix; it is not whole-CheckID certification.

Threat boundary

PAD presentation attacks do not automatically cover virtual camera, emulator, injection, compromised-client or channel-replay attacks.

Evidence

The Trust Center publishes certificate number, subject/module, basis, certification date, expiry, platform scope and limitations.

Interpretation

A PAD result does not replace a biometric match result, identity-proofing result or system-level security assessment.