Question for people who know about phishing etc software

PoGee

I preferred the old way of banking but eventually went onto online banking a couple of years ago. I on the odd occasion, need to call them. I called today and was told that on 15/01/24, everyone has to record their voice as that'll be the way to access your accounts by telephone. I'm sure I watched a programme a few years back about this. It said a scammer could call you, you say 'hello....hello....who is this...', scammer records your voice then uses some sort of voice simulation to pretend to be you, and call the bank. Is this possible?? Sorry if I sound daft but you just don't know how clever these scammers can be. I think a lot of us have had those strange robot calls from China.

DullGreyGuy

most of these require you to say a specific phrase, one bank uses "my voice is my password". 

Whilst it's possible to teach a simulator to sound like someone you'd need vastly larger data set than what is likely to be the answer to a call saying "hello....hello....who is this..." if you want to be able to realistically create a phrase containing words you haven't recorded etc.  

Much easier ways to access someone's account than trying to gain enough samples of them talking naturally in full sentences etc. 

MikeJXE

I have been with Santander for 10 years, my voice is my password has been set up for months

Santander will not contact you to activate that, only when you call them they will ask. 

Read what Santander tell you about scams and how to avoid them 

prettyandfluffy

PoGee said:

I think a lot of us have had those strange robot calls from China.

No, never.  However I do not answer calls from unknown or hidden numbers; if they have a legitimate reason for contacting me they will leave a message or send a text.

adindas

PoGee said:

I preferred the old way of banking but eventually went onto online banking a couple of years ago. I on the odd occasion, need to call them. I called today and was told that on 15/01/24, everyone has to record their voice as that'll be the way to access your accounts by telephone. I'm sure I watched a programme a few years back about this. It said a scammer could call you, you say 'hello....hello....who is this...', scammer records your voice then uses some sort of voice simulation to pretend to be you, and call the bank. Is this possible?? Sorry if I sound daft but you just don't know how clever these scammers can be. I think a lot of us have had those strange robot calls from China.

You could easily know that the voice PW is not from the scammer as they ask you to set it uo when you call tem using the recognise phone number
I have set up my voice password with Santander, since many years ago. It is a preventive measure to access your phone banking, CS when you need them.

masonic

Voiceprint would be just one factor used to verify they are speaking to the intended customer. Unless you are a public figure, this shouldn't be overly concerning.

eDicky

PoGee said:

...', scammer records your voice then uses some sort of voice simulation to pretend to be you, and call the bank. Is this possible??

The possibilità certainly exists, using AI to replicate the speech of a scammer's victim. It's widely used already to extort money from relatives by faking a kidnap or lost wallet distress, etc, using the realistic and convincing voice fake over the phone. If the banking industry continues to implement voice recognition system, its development will have to be continually one step ahead of the scammers' deep fake abilities...

PoGee

Yes eDicky, I heard that scammers are using kids voices to call kids parents, asking for money for emergencies.

GeoffTF

DullGreyGuy said:

Whilst it's possible to teach a simulator to sound like someone you'd need vastly larger data set than what is likely to be the answer to a call saying "hello....hello....who is this..." if you want to be able to realistically create a phrase containing words you haven't recorded etc.

Don't say that. Just say "Hello". Scammers will nearly always hang up. If they don't say who they are, hang up yourself.

masonic

eDicky said:

PoGee said:

...', scammer records your voice then uses some sort of voice simulation to pretend to be you, and call the bank. Is this possible??

The possibilità certainly exists, using AI to replicate the speech of a scammer's victim. It's widely used already to extort money from relatives by faking a kidnap or lost wallet distress, etc, using the realistic and convincing voice fake over the phone. If the banking industry continues to implement voice recognition system, its development will have to be continually one step ahead of the scammers' deep fake abilities...

They will just need to pay up in instances where they are fooled by a deep fake. But if the bank is using security questions beyond publicly available personal information, then the number of instances of such fraud fooling them should be low. A deep fake is unlikely to be able to furnish characters from my telephone password in my voice, or know what transactions I made recently, even if it has access to a recording of my voice. Voice only authentication should only be used for the low risk stuff. But voice not matching is a convenient filter for less sophisticated fraud attempts. Rather like confirming basic information such as address and registered phone number at the outset.

No system will ever be perfect, so it's important to use layers of security, which are less likely to all simultaneously fail.

Considering the 'distressed relative' fraud, it would be advisable to go beyond "it sounds just like them" before sending money, but you probably wouldn't do so if they just phoned from their usual number at a normal time and wanted to chat (although of course that could be a fraudster capturing your voice for later misuse, it is rather unlikely).

Emily_Joy

To be honest, I would be more concerned about not being able to access my account/verify myself when I am calling from somewhere with poor connection. Often from abroad I would be calling via skype and then the voice could be distorted. In my experience it is very difficult, if not impossible, to override decisions made by artificial intelligence, (see post office scandal for the most prominent case) and therefore I am trying to avoid any "smart" features when they are added for no good reason.