Biometric authentication has been applied in many domains due to the promoting awareness of privacy and security risks. Most of the previous work has shown the performance of single biometric, but a few studies explored the feasibility of hybrid biometrics. On this basis, we proposed a hybrid brain–computer interface (BCI) authentication approach that combined user’s electroencephalogram (EEG) and eye movement data features simultaneously. In anti-shoulder-surfing experiments, the proposed approach reached the average accuracy of 84.36% (the highest was 88.35%) to identify shoulder surfers and outperformed the only EEG and only eye movement data-based authentication approach. In additional experiments, the approach was proven to be useful in reducing the possibility of user misidentification. Our approach holds a great potential in providing references for implementing hybrid BCI authentication for anti-shoulder-surfing applications.