John Rumm wrote:

Yup, that is why to fool them you have to cut out the pupil of the photo
and look through the hole while the photo is scanned ;-)

Just so. One of the absolutely crucial distinctions that's very rarely
mentioned in general discussions is between 'supervised' and
'unsupervised' measurement of the sample biometric. 'Supervised' means
there's a trained, motivated person watching you present the biometric -
e.g. at border control points. 'Unsupervised' sampling, at ATMs say,
allows the whole range of photos, gummi-bears, and all the rest of the
equipment-fooling stuff to be deployed by the attacker.

Oh, and then there's 'stupid', which is doing it over the Net an
trusting the attacker's computing equipment. Doesn't stop some people
saying 'and ID cards will work for electronic commerce, too!'...

Stefek