Recent works have shown that multi-modal biometric systems are not robust against spoofing attacks [12, 15,13]. However, this conclusion has been obtained under the hypothesis of a "worst case" attack, where the attacker is able to replicate perfectly the genuine biometric traits. Aim of this paper is to analyse the robustness of some multi-modal verification systems, combining fingerprint and face bio-metrics, under realistic spoofing attacks, in order to investigate the validity of the results obtained under the worst-case attack assumption