Many commercially available iris recognition systems are easily fooled by presenting a high-quality photograph of a face instead of a real face, which makes such devices unsuitable for unsupervised applications, such as door access-control systems. (http://en.wikipedia.org/wiki/Iris_recognition)
easy to abuse them?
(http://en.wikipedia.org/wiki/Iris_recognition)
Retinal scan is much harder to fake, if I recall.