Qoobiss Submits ONTRACE for Injection Attack Detection Evaluation Under CEN/TS 18099 and ETSI TS 119 461
Follow us
The Romanian identity verification provider has entered independent assessment for both presentation and injection attack detection, with the injection component evaluated at Level High, ahead of European Digital Identity Wallet conformance requirements taking effect from December 2026.
Qoobiss, a Romanian regulatory technology company, has submitted its ONTRACE identity verification platform for independent third-party evaluation against CEN/TS 18099 and ETSI TS 119 461. The submission, made in June 2026, covers Extended Level assessment for presentation attack detection and injection attack detection, with the injection attack detection component evaluated at Level High. Results will be published once the evaluation concludes.
CEN/TS 18099, titled Biometric data injection attack detection, was approved by the European Committee for Standardization in 2024 and is the first published specification written specifically for this attack class. It addresses attacks that replace or modify a biometric sample after capture but before feature extraction. The specification establishes terminology, characterises injection attack instruments, and sets out test methodology and evaluation levels across enrolment and verification.
The specification covers ground that existing presentation attack standards do not. ISO/IEC 30107-3 defines how to evaluate whether a biometric system can detect a printed photograph, a screen replaying a video, or a silicone mask. In each case a physical artefact is presented to a sensor, and the test measures whether the system identifies it as an artefact. An injection attack presents nothing to a sensor. A fabricated video stream is delivered directly into the application through a virtual camera driver, a hooked media pipeline or a manipulated device input, arriving already in digital form. Conformance to ISO/IEC 30107-3 therefore does not, by itself, indicate any defence against injection attacks.
“The era of treating biometric verification as a solved problem is over,” said Teodor Rogojina, Chief Executive Officer of Qoobiss. “Generative AI has fundamentally shifted the threat model from presentation attacks to injection attacks.”
ETSI TS 119 461 operates at a different level. It sets policy and security requirements for trust service components performing identity proofing, covering the remote verification workflow rather than the biometric subsystem alone. Recent revisions reference both ISO/IEC 30107-3 for presentation attacks and CEN/TS 18099 for injection attacks.
The evaluation is taking place against a fixed regulatory timetable. Under Regulation (EU) 2024/1183, every European Union member state must make at least one European Digital Identity Wallet available by 6 December 2026, and private-sector relying parties legally needed to use strong user authentication must accept the wallet by 6 December 2027. Providers targeting higher-tier conformance are expected to submit their detection mechanisms for independent testing before the end of 2026.
Certification against CEN/TS 18099 remains uncommon. The first conformity certificate against the specification was issued at the end of 2024, and a number of providers are currently in evaluation rather than certified. Qoobiss states that ONTRACE is in evaluation and is not yet certified against the specification.
Qoobiss has been an accredited remote identity verification provider with Romania's Authority for Digitalisation since December 2022. In March 2024 the company reported that its Identify solution had become the first e-KYC product in Romania to validate the country's new chip-based national identity cards remotely by video.
About Qoobiss
Qoobiss is a Romanian regulatory technology company headquartered in Bucharest, building compliance and digital onboarding infrastructure for regulated industries. Its portfolio includes ONTRACE for remote identity verification, OMNICHECK for AML and sanctions screening and ongoing monitoring, OVERWATCH for compliance risk management, and ORIGIN for onboarding orchestration. Its solutions cover more than 250 countries and territories and over 15,000 identity document types.
Address: Expo Business Park 54A Av. Popisteanu Street, 1st floor Bucharest, Romania
Contact
Ramona Voiculescu
Qoobiss
+40745223105