What is the source of truth for valid eyeball scans? Whoever uploads the eyeball scan data first? What would prevent someone with a large database of eyeball

What is the source of truth for valid eyeball scans? Whoever uploads the eyeball scan data first? What would prevent someone with a large database of eyeball scan data from embezzling $1/day for each eyeball-identity they control? If somebody reported that their eyeball-scan-identity was leaked on pastebin and now hundreds of people are trying to use it to claim their money every day, what next? That person can't update their biometric data once compromised.