There have been a few DEF CON talks about the security of biometrics but the most recent probably gives the best demos IMO.[1]
It's easy to use a mask (or occlusion) to prevent a system from detecting your real face, but spoofing a specific person's face is a much bigger task. Any decent modern face rec system is going to use liveness detection as part of its analysis.