1. A method comprising: receiving, by a computing device from a user, an indication that the user wishes to access a secured resource on the computing device; attempting, by the computing device, to authenticate the user a first time based on first facial biometric data presented by the user to a face-based authentication system of the computing device; and if the attempting to authenticate the user the first time is successful: directing, by the computing device, the user to look at a reference point in a graphical user interface (GUI) of the computing device, the reference point corresponding to an initial location of a virtual pointer; capturing, by the computing device, one or more images of a face of the user while the user is looking at the reference point; determining, by the computing device based on the one or more images, a reference frame for the user indicating a first gaze or a first face pose of the user when looking at the reference point; presenting, by the computing device to the user, a sequential series of pluralities of targets on the GUI, each target being a visual element designed to direct the user's attention to a location in the GUI, wherein at each step in the sequential series the plurality of targets for the step includes a valid target and an invalid target, wherein the valid target corresponds to a secret known to the user, and wherein the number of steps in the sequential series is based upon one or more criteria pertaining to the secured resource; determining, by the computing device, whether the user has successfully hit the valid targets in the sequential series by checking whether the user has moved the virtual pointer over the valid targets, the checking comprising: capturing one or more further images tracking movement of the user's face; and comparing a gaze or a face pose of the user in each of the one or more further images against the first gaze or the first face pose in the reference frame in order to determine how far and in which direction the user has moved the virtual pointer from the reference point; if the user has successfully hit the valid targets, attempting, by the computing device, to authenticate the user a second time based on second facial biometric data presented by the user to the face-based authentication system; if the attempting to authenticate the user the second time fails, denying, by the computing device, the user access to the secured resource; and if the attempting to authenticate the user the second time is successful, concluding, by the computing device, that the user is a live subject and granting the user access to the secured resource.