Oct
Eye Tracking Authentication: Where It Holds Up and Where It Fails
Eye tracking authentication verifies a person by how their eyes move, and sometimes by the periocular region around them, rather than by a password or a static image. It is a real research field with credible results. It is also a poor candidate for a standalone login gate today, because gaze behavior shifts with fatigue, stress and distraction, and because the attack surface around any camera-based biometric has moved from physical fakes to injected video. This article explains how the technology works, what the evidence supports, how spoofing and liveness apply to it, and how a fraud team should evaluate a vendor claim.
TL;DR
- Eye movement biometrics identify people from oculomotor behavior; the strongest published results come from fusing gaze with periocular images, not from gaze alone.
- Gaze patterns vary with fatigue, stress and cognitive load, so the technique fits best as an auxiliary or continuous signal, not a primary factor.
- Phone eye tracking such as Apple’s is an accessibility control that processes data on-device. It is not identity proofing.
- Passing presentation attack detection does not protect against camera injection; layered controls are required.
- Test any vendor on mid-range hardware and degraded lighting, never on vendor-supplied success rates alone.
Table of Contents
- What eye tracking authentication actually measures
- The variability problem
- Why fusion beats gaze alone
- Spoofing eye-based biometrics
- Eye tracking liveness and presentation attack detection
- Phone eye tracking is not authentication
- How to evaluate a vendor claim
- Privacy and regulatory exposure
- Our perspective
- Keep reading on Fraud Signals News
- FAQ
- Sources
What eye tracking authentication actually measures
The term covers several different things, and conflating them is the first way procurement conversations go wrong.
- Eye movement biometrics (EMB): a behavioral modality that extracts and compares the characteristics of an individual’s oculomotor behavior. The Eye Know You Too paper describes it as a relatively recent modality that may have potential to become a primary authentication method, which is a hypothesis, not a settled fact.
- Periocular recognition: matching the skin and structure around the eye from a standard image. It is a physical trait, so it is more stable than gaze behavior.
- Iris recognition: a separate, mature modality that works on the iris texture itself. It is often grouped with eye-based systems but has its own capture and spoofing profile. See our engineering coverage of iris liveness detection and LivDet open-set gaps.
- Gaze-based interaction: tracking where a user looks to operate an interface. This is not authentication at all, although the same sensor can feed an authentication model.
A typical gaze authentication session asks the user to follow or fixate on targets while an eye tracker records movement. One early study had users activate circles with their gaze while the tracker captured data for identification; modern work uses neural embeddings trained on large populations. The Eye Know You line of research reports that reasonable accuracy can be reached even during low-cognitive-load tasks and at low sampling rates, which matters because most consumer cameras sample slowly compared with lab trackers.
The variability problem
The pitch for gaze biometrics is that eye movements are hard to observe and not fully under voluntary control. That is partly true. The weakness is the flip side of the same fact: the signal is behavioral, so it moves with the person’s state.
Unlike a fingerprint or an iris, EMB patterns change with fatigue, stress, distraction and cognitive load. In practice this produces inconsistent enrollment and higher failure-to-authenticate rates in uncontrolled settings, which is exactly where consumer banking and fintech operate. A customer logging in from a train at 7 a.m. and the same customer enrolling at a desk at 2 p.m. generate different gaze traces.
The practical conclusion for fraud teams is conservative. Treat EMB as an auxiliary signal, for instance in continuous authentication during a session, and pair it with periocular analysis to stabilize results. Researchers in the field point the same way: successful deployment depends less on camera resolution than on how well the backend model absorbs natural user variability without forcing high-friction recalibration.
Why fusion beats gaze alone
The most useful recent evidence is on multimodal systems. A 2025 study on fusing gaze and periocular images investigates a calibration-free authentication system that combines the two eye-centric modalities. Calibration-free matters operationally: every calibration step is a drop-off point in an onboarding flow.
The broader literature is moving in the same direction. A survey of gaze-based biometric authentication reviews 222 peer-reviewed works and frames the field around secure, continuous verification. The pattern across them is consistent: combining modalities improves accuracy and stability over any single behavioral signal, and the research benchmarks are typically framed against the FIDO Alliance biometric requirements, which set false reject, false accept and presentation attack targets for biometric components.
Two caveats belong next to any such figure. First, academic datasets are not your customer base; they rarely include the lighting, hardware and distraction your users bring. Second, a study that clears a benchmark in the lab is evidence of feasibility, not of production readiness.
Spoofing eye-based biometrics
Readers searching for biometric spoof materials are usually asking what an attacker actually uses. For camera-based eye and face systems the standard catalogue is physical artifacts: printed or high-resolution photos, screen replays, masks and, for iris systems, patterned contact lenses. A patent describing eye movement biometrics names a lens with an imprinted iris pattern as a spoof of the iris modality, and discusses mechanical replicas of the eye, which is why researchers pair eye-based identification with liveness analysis of the signal itself.
Eye movement has one structural advantage here. A printed photo or a looped video does not respond to an unpredictable stimulus. A challenge that moves a target and checks whether the eye follows, with the natural variability of a live oculomotor system, is harder to fake with a static artifact than a simple blink check. That advantage is real but narrow, and it does not address the larger problem below.
Eye tracking liveness and presentation attack detection
Presentation attack detection (PAD) is the discipline of stopping physical spoofs. ISO/IEC 30107-3:2023 is the international standard for testing and reporting PAD performance, and financial institutions increasingly require PAD-tested liveness for remote biometric verification. Level 2 testing involves hundreds of attack attempts across different artifact species per device. Independent labs run these evaluations: iBeta, for example, is accredited by NIST/NVLAP to test to this standard.
The limit matters more than the certificate. ISO 30107 results apply only to the tested configuration and to presentation attacks, meaning the fake is shown to the camera. An eye-tracking liveness test that is certified against masks and replays says nothing about an attacker who never shows anything to the lens.
Presentation versus injection
The greater danger is the shift from presentation to injection. In an injection attack, synthetic video is fed straight into the software pipeline, through a virtual camera, a hooked SDK or a compromised device, bypassing the physical sensor entirely. Industry analysis of banking biometrics notes that PAD does not stop this, and that a layered approach is needed: device attestation, SDK integrity and behavioral risk scoring, in line with guidance from bodies such as NIST and ENISA.
The common failure we see in vendor evaluations is the equation of a passed PAD audit with total security. As one practitioner write-up on KYC in the deepfake era argues, organizations can be fully compliant on PAD and still wide open to camera injection. The remedy is to mandate endpoint attestation and integrity monitoring alongside PAD, so you can verify where the biometric data came from, not only what it looks like. Our own pieces on replay and injection fraud with NIST-aligned liveness, liveness detection spoofing defenses and capture integrity against deepfake ID fraud cover the controls in operational detail.
Phone eye tracking is not authentication
People also ask whether a phone can serve as an eye tracker. It can, but the purpose differs. Apple’s iPhone feature uses the front-facing camera to control the interface by gaze, with dwell and snap interactions, and Apple states that the data used to set up and control the feature is kept securely on the device. It asks for periodic calibration through on-screen movement prompts and works best with the phone placed about 1.5 feet from the face.
That is a design for hands-free accessibility. A security-grade system has a harder job: it must tolerate users who do not hold a steady gaze at enrollment, resist spoofing and injection, and produce auditable error rates. Reading the existence of consumer eye tracking as proof that eye-based login is ready for banking is a category error.
How to evaluate a vendor claim
A short checklist for fraud and identity leaders:
- Ask where the numbers came from. Vendor success rates are often calibrated on high-end infrared hardware that does not exist in typical consumer smartphones.
- Test on mid-range devices. Include ambient and degraded lighting, and users who fail to hold steady gaze at enrollment.
- Separate error types. Request false reject, false accept and failure-to-enroll rates, plus attack-presentation results, against the FIDO-style framing.
- Check the PAD scope. Ask which ISO/IEC 30107-3 level, which lab and which device configuration the certificate covers.
- Demand injection defenses. Device attestation, SDK integrity and virtual-camera detection should be documented, not implied.
- Position the factor correctly. If gaze is one signal among several, the risk model should say so, with step-up paths when it is unavailable.
- Review data handling. Gaze and periocular data are biometric data; see our six operational controls to prevent a biometric breach and the research on privacy-preserving biometrics for a first pilot.
Vendors that combine identity proofing with robust PAD are the sensible shortlist for modernizing legacy flows. DAON is one good option to include when you assess enterprise-grade biometric platforms, because its offering integrates identity proofing with presentation attack detection. Judge any platform, DAON included, against the checklist above rather than the brochure.
Privacy and regulatory exposure
Eye-based capture can be passive, and passive capture is where regulators and privacy advocates push back hardest. The Electronic Frontier Foundation’s analysis of Facebook’s face recognition plans points to the risk of identifying bystanders and to the multi-billion dollar settlements that followed earlier programs. The lesson for eye tracking is about consent and scope: authenticate the person who opted in, store templates securely, and do not repurpose gaze data for analytics. Compliance teams should read our overview of why biometrics satisfy compliance requirements before drafting a pilot.
Our perspective
We have little patience for the way eye movement biometrics are marketed as a finished replacement for passwords. The research is serious and improving, but the operational reality is a behavioral signal that drifts with the user’s state, tested on datasets that do not look like a retail banking population. Deploying it as a sole gate would trade a known weakness, passwords, for an unmeasured one.
Where it earns a place is as a quiet, continuous, fused signal inside a layered stack, with periocular analysis for stability and with hard controls against injection. The industry’s habit of treating a PAD certificate as the finish line is the more urgent problem, because deepfake tooling already targets the pipeline, not the lens. Our advice to fraud directors is to spend the next budget cycle on capture integrity and attestation first, and on novel modalities second.
The common thread across every biometric we cover, from voice to selfie to gaze, is that the sensor is rarely what fails. Provenance, integrity and the fallback path fail. Measure those.
— Carlos Ochoa
Keep reading on Fraud Signals News
If you are building the case for biometrics internally, start with our guide on why biometrics reduce bank fraud, which frames the ROI discussion for fraud and risk leaders. For the selfie flow most customers actually meet, see how selfie identity verification works. Our coverage of evolving verification risk is collected on the Fraud Signals News home page.
FAQ
What do eye trackers do?
An eye tracker records where a person is looking and how the eyes move, usually with a camera and, in dedicated devices, infrared light reflected off the eye. The data can drive interface control, research or, in biometrics, identity verification. Which of those uses applies depends on the product, and they carry very different security requirements.
Can you use your phone as an eye tracker?
Yes, for accessibility. Apple’s Eye Tracking uses the front camera to move a pointer and trigger taps by dwelling on an item. It is built for hands-free control, not for proving identity to a bank.
Is eye tracking accurate enough to replace passwords?
Not as a standalone factor today. Gaze patterns change with fatigue, stress and cognitive load, which causes inconsistent enrollment and authentication failures outside controlled settings. Fusing gaze with periocular features performs better, and the technique is best used as an additional or continuous signal.
How is eye tracking liveness tested?
Liveness is tested through presentation attack detection under ISO/IEC 30107-3, where an accredited lab attempts many attacks with masks, photos and replays. That covers physical spoofs only. You still need separate controls against injected video, such as device attestation and SDK integrity checks.
Sources
- Eye Know You Too: Toward Viable End-to-End Eye Movement Biometrics for User Authentication
- Ocular Authentication: Fusion of Gaze and Periocular Modalities
- Through the Eyes: A Survey on Gaze-Based Biometric Authentication Systems
- FIDO Alliance Biometric Requirements v4.0
- US patent: Health assessment via eye movement biometrics
- Presentation Attacks Explained, Types, PAD, and ISO 30107
- iBeta PAD Level 2 confirmation letter
- Biometrics in Banking: Use Cases, Benefits and Standards
- KYC in the Deepfake Era: Why a Selfie Stopped Being Proof
- Control iPhone with the movement of your eyes, Apple Support
- EFF: Seven Billion Reasons for Facebook to Abandon Its Face Recognition Plans
Recommended
Share this post
RELATED
Posts
ID Security Features: What Each One Does and How to Check It
Face Liveness Detection: How It Works and Where It Fails
