I'm going to make a HUGE assumption: you're talking about the kind of software that would track people in the streets. Not software that would have the chance to closely examine people like access scanners. If you want to fool every scanner on earth, the answer is "absolutely not." I can't think of anything you can do to fool a retina scanner without cloning the target... and even that might not work.
Given the above assumption — and remembering that no recognition system is perfect...
The highest-end recognition systems are still only able to give you a statistically-correct answer (e.g., "92% match..."). This works tremendously in your favor. Especialy where mannerisms, gait, etc are involved because almost anything can cause those to change. "Correct" may be something closer to 60% (don't believe me? Sit in front of a TV for 3 hours, then walk in front of the scanner and see if it recognizes you with the limp from a sleeping leg. Or a twisted ankle. Or the bruise on your arm from trimming the tree....)
And I've seen makeup turn one person into another so completely that photographically a human can't tell the two apart. Remember, computers are far from perfect. Optical resolution, angle of scan, clouds in the sky, light reflecting off irises, not to mention motion. The engineer within is laughing hysterically over the idea that exclusion today could ever be better than 90% (and that might be wishful thinking).
Therefore, absolutely. Obviously, the exact circumstances (which you didn't provide) can affect my answer, but with no other data, yup, it can be done.
What are the actual points of potential failure?
That's it. Remember, you're dealing with a computer and an imager. No matter what people tell you, you can make bone structure and everything else look to be someplace completely different just using makeup. And if the software is using pupil location to justify "eye separation" then it could be fooled with contact lenses that adjust the "location" of the pupil. It it's using eyesocket or open-eye imaging, then you're back to fooling it with makeup. You might look a bit funny to a human, but the computer would be completely fooled.
Anybody who tells you differently is trying to sell you the system.
So, why don't people do this to fool the systems all the time? Because for nearly nine billion of us, it simply doesn't matter, and so we don't care. That works in the favor of people running the software. If half the people in a city starting acting to intentionally foil such systems (wearing hats, growing beards, wearing sunglasses, sticking cotton balls under your lips...) the usefulness of the software would drop to almost zero.
Unless we're talking about access scanners. Remember what I said in the beginning, it's much harder to fool access scanners because light, motion, angle, etc. are all controlled. That increases the liklihood of a good scan by the proverbial orders of magnitude.
