there is provided , in accordance with some embodiments , a method comprising using one or more hardware processors for receiving a behavioral biometric model that characterizes a human user according to pointing device data of the human user , where the pointing device data comprises screen coordinate and time stamp pairs . the method comprises an action of monitoring an input data stream from a pointing device in real time , wherein the input data stream covers two or more spatial regions of a display screen , and an action of segregating the input data stream into one or more subset streams that is restricted to one of the plurality of spatial regions . the method comprises an action of computing a similarity score based on one or more comparisons of the behavioral biometric model and the one or more subset streams , and an action of sending the similarity score to a user authorization system .