Voice ID

Redlander

I have received a text from my bank Santander inviting me to register for Voice ID. I am wondering if this can be considered secure, given what I have heard about fraudsters being able to clone voices.

elsien

It’s been around for a few years now so presumably Santander have not had a lot of fraud issues with it.
Otherwise I guess it’s just personal preference.

GeoffTF

It is just an extra layer of security. It was easy for me to set up, but I have not have occasion to use it yet. The worst that can happen is that I will be asked extra security questions if I fail the Voice ID. Santander's security is getting more intrusive. Until recently, I just had to type my secure number to log in. Now I also have to type in a verification code that is sent to my mobile phone.

Novulus

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

GeoffTF

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

It is a pound to a penny that it is an additional check, and not a replacement for existing checks.

Nasqueron

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

AI can only fake a voice if they have recordings of you to work from, no thief is using AI to get through security without hearing your natural voice, recording it and machine leaning it

boingy

Nasqueron said:

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

AI can only fake a voice if they have recordings of you to work from, no thief is using AI to get through security without hearing your natural voice, recording it and machine leaning it

Scammers only have to ring you up to get a sample of your voice. I don't think voice ID as security will be a very long lived measure.

GeoffTF

boingy said:

Nasqueron said:

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

AI can only fake a voice if they have recordings of you to work from, no thief is using AI to get through security without hearing your natural voice, recording it and machine leaning it

Scammers only have to ring you up to get a sample of your voice. I don't think voice ID as security will be a very long lived measure.

Just saying "hello" is not going to give them much.

Nasqueron

boingy said:

Nasqueron said:

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

AI can only fake a voice if they have recordings of you to work from, no thief is using AI to get through security without hearing your natural voice, recording it and machine leaning it

Scammers only have to ring you up to get a sample of your voice. I don't think voice ID as security will be a very long lived measure.

There is no magic AI that can learn and impersonate a human voice accurately enough to beat security based on you answering the phone and then trying to have a conversation with you. Regardless, it's obviously not going to be a common fraud tactic as the thief has to a) get your number, b) ring you, record you, feed it into an AI c) ring the bank hoping he gets ONLY that security check d) passes it and then finds out if you have enough money to steal (and then beat any 2FA to setup new payments etc). It's a non-issue 

GeoffTF

Santander wants to introduce biometrics as an extra layer of security. They have already upset a lot of customers, and doubtless lost some, by making them buy (at least) dumb mobile phones. They would lose a lot more customers and get a lot of bad publicity if they made their customers buy smartphones. Voice ID may not be the best form of biometric security, but it is better than nothing. Of course Santander will try to sell Voice ID as a customer benefit, but the real reason for introducing it is obvious.

boingy

Nasqueron said:

boingy said:

Nasqueron said:

Novulus said:

I would be very wary, there's tremendous development in AI at the moment and it can already falsify someone's voice very convincingly

AI can only fake a voice if they have recordings of you to work from, no thief is using AI to get through security without hearing your natural voice, recording it and machine leaning it

Scammers only have to ring you up to get a sample of your voice. I don't think voice ID as security will be a very long lived measure.

There is no magic AI that can learn and impersonate a human voice accurately enough to beat security based on you answering the phone and then trying to have a conversation with you. Regardless, it's obviously not going to be a common fraud tactic as the thief has to a) get your number, b) ring you, record you, feed it into an AI c) ring the bank hoping he gets ONLY that security check d) passes it and then finds out if you have enough money to steal (and then beat any 2FA to setup new payments etc). It's a non-issue 

I think you are underestimating AI. 

Have you heard of Microsoft's VALL-E project? (https://vall-e.pro/)

They claim they can clone a voice with 99% accuracy from as little as 3 seconds of recorded voice audio. 3 seconds of your voice then the AI can get your voice to say anything. That's quite scary.

This week a fake President Biden made phone calls to Democrat voters to put them off voting, presumably arranged by the Republican campaign: https://www.bbc.co.uk/news/world-us-canada-68064247

Last year I made an original song and got "Elvis" to sing on it. I fed just two lines from Heartbreak Hotel into a free Web AI and that was enough for "Elvis" to sing my (mostly terrible) lyrics. In parts it's not perfect but some of it is very convincing. There is a whole Internet movement making songs with fake famous singers singing them. One of them charted on Spotify until it got pulled.

AI can already clone voices convincingly and it's only going to get better. Voice ID cannot be relied upon.