Incode mobile identity verification posts zero bypasses in adversarial testing

Incode Technologies has released its Independent Adversarial Penetration Testing Report, which shows zero mobile bypasses on biometric testing by cybersecurity firm SocialProof Security, using attacks like deepfakes, injected media and AI-generated documents to simulate real-world fraud conditions.

“Today we’re publishing something most identity verification vendors won’t,” says the firm in a post on LinkedIn. “The full results of an independent adversarial pentest.”

The results come as identity verification providers face growing scrutiny over their resilience to deepfakes, injected media and other AI-enabled fraud techniques. Independent adversarial testing is increasingly emerging as a complement to traditional accuracy benchmarks, providing insight into how systems perform against real-world attack scenarios.

Per the report, the “engagement was designed to simulate the capabilities of a moderately capable external attacker operating with a mix of physical artifacts, digital manipulation, and AI-assisted tooling.” Rachel Tobac, who runs SocialProof, hacked Incode more than 110 times across 13 distinct attack types to find the latest vulnerabilities.

“We tested mobile and browser flows: hardware and software video injection, deepfakes, replay attacks, emulators, rooted devices, manipulated identity docs and more,” Tobac says on LinkedIn.

Across all testing, no attacks successfully bypassed Incode’s mobile authentication flows. Browser-based web flows also performed well, although Incode had to address “limited early penetration” with prompt fixes to identity verification, accounting for the fact that “browser-based environments inherently allow greater flexibility in media input selection.”

In the web tests, deepfake tests showed “mixed outcomes,” while injection attacks were “the only categories that produced repeatable success prior to remediation.” Once Incode fixed the problems SocialProof Security identified, it passed re-testing with no bypasses.

Nonetheless, a conclusion Incode takes from the results is that “native mobile IDV deployments provide materially stronger protection against modern fraud techniques due to tighter platform constraints and stronger device-integrity guarantees.”

Incode says transparent, independent testing is “the bar we think identity verification should be held to.”

“Not vendor-marketed accuracy numbers, but independent adversarial testing.”

The findings also add to a growing industry debate over the relative security of native mobile and browser-based identity verification. As fraud attacks become more sophisticated and injection attacks gain prominence, vendors are increasingly looking to independent adversarial testing to demonstrate real-world resilience beyond traditional performance metrics.

Article Topics

adversarial attack  |  AI fraud  |  biometric testing  |  biometrics  |  Incode  |  injection attack detection  |  pen testing  |  SocialProof Security