We use a general hill-climbing attack algorithm based on Bayesian adaption to test the vulnerability of an Eigenface-based approach for face recognition against indirect attacks. The attacking technique uses the scores provided by the matcher to adapt a global distribution, computed from a development set of users, to the local specificities of the client being attacked. The proposed attack is evaluated on an Eigenfacebased verification system using the XM2VTS database. The results show a very high efficiency of the hill-climbing algorithm, which successfully bypassed the system for over 85% of the attacked accounts.