Iris Scan Biometrics and Iris Scanning: Eye Codes Sell for $30
Quick answer
How does an iris scan work and is it safe to use?
An iris scan photographs the ring around your pupil with an infrared camera, then converts its fine patterns into a short numeric code that is compared with a saved one. The method is accurate, but a stored code can be copied or sold, and you cannot replace your eye.
Thirty dollars. That is about what an iris scan reportedly went for on a black market in 2023. Not a credit card number. A piece of somebody's eye. It all started with a silver orb that paid people in crypto to look into it.
TL;DR
An iris scan turns your eye into a short code that is nearly one of a kind, but because you can never get a new eye, a leaked or sold code stays dangerous for life.
If you searched "iris scan," you probably want two answers. How does it work? And should I be worried? Short version: the math is beautiful, and the worry is real, just not for the reason most people think. Let's take it apart, no tech degree needed.
Iris Scan Technology: How Iris Recognition Turns Your Eye Into a Number
Look in a mirror at the colored ring around your pupil. That ring is your iris. Up close, it is a tangle of ridges, ripples, and tiny threads. Sources vary on the count, but they put it at roughly 200 to 250 features that a computer can tell apart. Those unique patterns are what iris recognition measures. Think of it as a fingerprint that lives behind glass.
Iriscan or iris scan: what the machine is actually doing
People type it both ways, and an iriscan is just the same thing with the space squeezed out. Either way, it falls under iris scan biometrics. Biometrics (measurements of your body that can prove who you are) include your fingerprint, your voice, your face, and your eye. Each one works by turning something physical into a code a computer can compare.
Inside an iris scanner: sensors built to see a ring you can barely see
Here is how an iris recognition system works step by step. The first step is the picture. Iris scanning uses camera technology that is close kin to the one in your phone, but tuned very differently. Iris images are taken with a high resolution infrared camera, usually from about 10 to 40 centimeters away, according to a technical overview from Rootstrap. The sensors in these iris scanners are looking for fine detail, not a pretty portrait.
Light you cannot see: why infrared does the work
The camera lights your eye with subtle infrared illumination. Your own eye cannot see that light, so nothing flashes at you. The camera, though, sees plenty. This is also why an iris scan feels so easy: you look, it clicks, done.
Software turns the picture into a code
Step two is where the software earns its keep. It finds the pupil and the outer edge of the iris, then works out the pattern in between. In secure systems the photo is not what gets kept. The pattern is boiled down to a template (a short string of numbers) of about 512 bytes. That is smaller than a typical text message with a photo attached. Step three is the match. Next time you look into the camera, the system builds a fresh code and checks how closely it lines up with the saved one.
One often quoted estimate says the odds of two irises matching by chance are about 1 in 10 followed by 78 zeros. Treat that as a rough teaching number, not a promise. Still, the direction is clear. A fingerprint check leans on around 60 to 70 comparison points. Iris biometrics offer far more to compare, which is why governments and airports fell for it.
60 million This article is part of a series, start with Atlantic City Hotels Own Face Costs Star Hotel Guest 1 250.
people from about 170 nationalities have been enrolled in iris recognition systems
Source: Cambridge University, John Daugman's iris recognition research
That figure comes from the researcher behind the core algorithm, John Daugman at Cambridge. Hold onto it. A huge, global pool of people is exactly what makes a black market worth building.
Detection: how a machine tries to tell a live eye from a copy
The last piece is detection of fakes. A good system asks one extra question: is a living human eye really in front of me, or is this a printout or a screen? Systems that skip this check are easy marks. Systems that include it are harder to fool, but, as you will see, not impossible. Detection is a race, and the attackers get to study the finish line.
Iris Scanning in Use: Why Did a Silver Orb Pay People to Stare Into It?
Iris scans are used to prove that someone is who they claim to be, at borders, on phones, and at secure doors. In the silver orb story, an iris-scanning orb can help verify that each account belongs to a different living person. People who looked into it were paid in crypto, in Kenya about $50 worth, according to the IAPP.
Identity for sale: what the orb was really buying
Notice what is being traded. A crypto project wanted proof that each identity was a separate human, so it asked for something no one can fake easily: an eye. That sounds smart. The trouble began when the payments created a market. In May 2023, reports described a black market for verified credentials, with people in Cambodia and African countries being paid as little as $30 so that others could create multiple accounts. Biometric Update covered the story, and a second outlet, The Block, reported it too.
Then came the legal fallout. In August 2023, Kenya's government suspended the data collection and opened an investigation into public safety and data protection risks, after thousands of Kenyans had traded eye scans for coins. In May 2025, Kenya's High Court ruled the collection unlawful and ordered the biometric data collected from Kenyans deleted. Regulators in Spain, Portugal, and Colombia also investigated or suspended similar activity over privacy concerns.
Pause on that for a second. A person gave up something permanent for the price of a decent dinner. The buyer on the other end could keep it forever. The seller could never take it back.
Iris Scan Weak Spots: Why One of a Kind Does Not Mean Unfakeable
Here is the misconception, and it is a very natural one. "The odds of a match are astronomically small, so nobody could fake it." That sounds logical. We trust big numbers. But uniqueness and security are different jobs. Uniqueness describes the target: your eye really is one of a kind. Security describes the defense: whether anyone can slip a copy past the door. A diamond is one of a kind, too, and people still steal them.
Visualizer thinking: how a code can be turned back into a picture
Picture a visualizer, a tool that redraws numbers as an image. That is roughly the trick researchers pulled off. In work reported by the Electronic Frontier Foundation, Javier Galbally's team showed that a stored iris code could be used to build a synthetic eye image. Then they fed those images to real systems.
Red flag for biometrics: iris scanner vulnerability revealed. Previously in this series: Deepfake Scammers Clone Loved Ones Faces And Voices Podcast.
Headline of the Electronic Frontier Foundation's write-up, EFF
The results were not subtle. According to Biometric Update, about 40 percent of the images scanned were wrongly accepted by the system when the fakes were built from real irises. In some attack setups, as many as 90 percent of the programs tested were fooled. These were lab conditions, so do not picture a thief with a printer outside your window. But the lesson holds: a clever copy can be good enough.
Why the fake works, in plain terms
Why do people get this wrong? Because the iris feels private. You cannot photograph someone's iris in a crowd the way you can their face. So we assume it is locked away. The weak point is not the eye. It is every database, every vendor, and every "earn a little crypto" booth that holds the code afterward. And a patent filing on iris templates raises one more concern: an eye can hint at health conditions, so a leak could expose more than identity.
The skeleton key you cannot swap
Think of your iris code as a skeleton key stamped onto your own body. If a thief copies a house key, you change the lock. If a thief copies your iris code, the lock is your eye. Passwords, PINs, and card numbers all have a reset button. Your eye has none. That is the whole problem in one picture.
Face vs Iris Scan: Where Facial Recognition Fits In
At CaraComp, we spend our days on facial comparison, so here is the honest comparison. Your face cannot be reset either. But your face is already public. It sits in your profile photo, in school pictures, and in security footage. Because of that, facial systems were built from day one to assume that a photo of you is out there. Iris systems were built on the opposite assumption.
| What leaks | Face | Iris scan |
|---|---|---|
| Where it is captured | Photos, video, and security cameras in everyday life, often without you knowing | Special iris scanners and sensors, usually when you knowingly step up to one |
| Can you change it? | No, your face stays your face | No, and you cannot hide it behind a new haircut or glasses either |
| Typical copy risk | A fake video or a deepfake video built from public photos | A code sold or breached from a database, as in the $30 market |
| What the thief gets | A face that can be tried against facial recognition and video checks | A code that may rebuild a fake eye image, plus possible health clues |
Look at the last two rows. A face thief often needs to make a fake video or photo, and detection tools may catch it. An iris thief who has the code may skip the picture-making step altogether. Meanwhile, many apps ask for facial scans for age checks, and some ask for videos of you turning your head. That is a lot of face data floating around. It is also why a quick video call can be spoofed more easily than a person assumes.
Even eye filters have drawn warnings. The ACLU raised concerns about a social media trend of filming close-up eye effects, since it can hand over biometric details without people noticing. Not every video of your eye is an iris scan. But the habit of pointing a camera at one, and the video that results, is worth a second thought.
The black market price list
Criminals shop by completeness. Per Skyone, a single fingerprint can sell for $5 to $100, while a full profile (face, iris, and fingerprint together) can run up to $500 on dark web markets. Notice how cheap a single piece is. That cheapness is the point: you are selling something that cannot expire.
Iris Scan Solutions: What You Can Actually Do About It
Feeling a little helpless? Fair. But you have more control than the headlines suggest, because the risk lives at one moment: the moment you hand the scan over. These are the practical solutions.
- Say no to the trade. If a booth, app, or kiosk offers cash or coins for your eye scan, the price is far too low for something you cannot replace.
- Ask three questions first. Who keeps the code, how long do they keep it, and can I make them delete it? If the answers are vague, walk away.
- Check your own phone settings. Look at which apps you have allowed to use your camera and your facial or eye data inside your existing phone account, and switch off what you do not need.
- Think before filming your eyes. Skip close-up eye filters and videos that fill the frame with your eye.
- Report misuse to the right place. If someone misused your biometric data, contact the police or the FBI's Internet Crime Complaint Center. Your state attorney general or other government consumer agency is another good door to knock on.
What You Just Learned
- It is a code, not a photo: an iris scan turns your eye into a template of roughly 512 bytes.
- Unique is not unbreakable: fakes built from real codes fooled systems about 40 percent of the time in one test, and up to 90 percent in another.
- The market is real: scans were reported selling for as little as $30, and Kenya's High Court ordered data deleted in 2025.
- Your control is at the handoff: once you give the scan away, you cannot take it back.
The Aha Moment: Your Eye Is Private Until You Hand It Over
Here is the click. Your face is public by default, so the world built defenses around that fact. Your eye is private by default, so nobody bothered, until companies started paying people to hand it over. The strength of an iris scan (nobody can copy it casually) turned into its weakness the moment it was collected, stored, and sold. The most secure-looking lock in the world was only as safe as the filing cabinet holding the key.
Key Takeaway Up next: Iris Scan Eye Codes Sell For 30 And Can Never Be Replaced.
An iris scan is only as safe as the place that stores the code, and because you can never replace your eye, iris scan biometrics deserve more caution than a password, not less.
Recap: An iris scan turns your eye into a nearly unique code. If that code leaks or is sold, you cannot get a new eye, so the danger lasts a lifetime.
So here is the question to carry to bed tonight. If someone offered you $30 to look into a camera, would you know what you were actually selling?
iris scan: Frequently Asked Questions
Do iris scanners use a smart camera or an ordinary one?
An iris scan uses camera technology, but not the kind in a casual selfie. Most iris scanners rely on near-infrared light and a close, steady shot of the eye so fine detail shows up. Some phones now do this with a small built-in sensor, which is why a smart phone can unlock with a glance. The camera does the seeing, and the software does the matching. The picture is usually turned into a short code and then thrown away.
What are iris scan stock images, and can they fool a scanner?
Iris scan stock images are pictures sold for websites and presentations, usually showing a glowing eye. They are made for illustration. The research I reviewed tested synthetic images built from real iris codes, not stock photos, so there is no evidence here that a stock picture can open a lock. Still, iris cameras that skip live checks can be tricked by good copies, which is why methods for catching fakes matter so much.
What is an iris id, and how is it different from a password?
An iris id is the code your eye produces, used for biometric verification using your body instead of something you remember. A password can be changed in a minute if it leaks. An iris id cannot, because you cannot swap your eye. That difference is the heart of the risk. It also means services that ask for one should explain exactly how long they keep it and how they delete it.
Why are scanners called advanced if they can be fooled?
These scanners are advanced iris technology for biometric authentication, and the matching math really is powerful. But strong math does not stop a copy that looks legitimate. Where iris recognition is used, such as border checks and secure buildings, the quality of the live check matters as much as the matching. The tests that fooled systems at 40 to 90 percent were run under lab attack conditions, so the real lesson is to protect the stored code, not to panic about the eye itself.
How can I learn if someone is collecting my iris data?
You usually learn it from a consent screen or a sign, so read them. If someone is acquiring biometric data, the company should say what it takes, why, and for how long. If you cannot find that information, assume you are not being told. Also check which apps on your phone can use the camera, and ask any service holding your data to delete it in writing. If something seems off, tell the police or a government consumer agency.
Can my iris or face be copied from video or HD photos?
The research I reviewed focused on infrared iris scanners, not ordinary video. So I cannot say a normal video call captures a usable iris code. Faces are different: a clear video or hd photo of your face is exactly the raw material for a deepfake. The ACLU raised concern about close-up eye filters, so a sensible habit is to avoid filming extreme close-ups of your eye and to keep public photos limited.
Do analytics from an iris scan reveal health information?
It is a concern raised in a patent filing on iris template storage, which warns that an eye image can reveal certain health aspects. That is a reason to treat the data as sensitive. It does not mean every system reads your health, and the research gives no proof that the orb or other services did. It does mean a leaked iris image could expose more than your identity, so security and deletion promises matter.
Ready for forensic-grade facial comparison?
Full forensic reports with detailed similarity scoring. Results in seconds.
Run My First SearchMore Education
How to Take Passport Photo at Home: 4 Rules Software Checks
A computer, not a person, decides first whether your passport photo passes. Learn the four measurable rules it checks so a bad picture never costs you six weeks.
digital-forensicsFirst AI Generated Image: 9 Years From Blur to Perfect Fake
The first AI generated image was nothing like a photo, and the story from there to today's fakes explains why your eyes can no longer be the test. Learn what to check instead.
facial-recognitionGoogle Face Recognition: 1 Switch Deletes Every Face Code
Your photos app has been sorting faces into piles for years. Learn what google face recognition actually does, where it gets people wrong, and the one setting that deletes it.