Ok, so current systems can be tricked with photographs, and that seem pretty silly. But future versions could record stereo images while altering the illumination of the subject's eye. Properly functioning (attached) human eyes should have irises that dilate with extreme changes to illumination. By masking the subjects eye or eyes from the surrounding environment and changing the illumination levels over time, a complex system could measure pupil dilation characteristics to evaluate if the eye before it is valid and alive. Randomly timed flashes would be hard to predict and might cause predictable blinking in most humans in addition to dilation changes. By using stereo images, the system could also verify the 3 dimensional shape of the changing iris, which would be much harder to fake with pictures.
Add an infrared camera to mesure eye temperature and faking iris with a screen gets even harder.