Secure use of voice recognition for access?

AKAGraham

Given the advent of voice cloning how secure are bank aaccounts which use voice recognition for access? I have lots of different accounts and several banks try to get me to use voice recogition to gain access. I have always resisted this but given my opening statement and the various news stories today should they not cease such practice?

eskbanker

Banks will obviously be aware of this, and the BBC ran an experiment in 2024:

https://www.bbc.co.uk/news/articles/c1lg3ded6j9o

while This Is Money also looked into it then:

https://www.thisismoney.co.uk/money/saving/article-13890745/How-bank-protecting-rising-tide-AI-voice-clone-scams.html

According to Google's AI:

How Banks are Reacting

Rethinking Voice ID: As AI improves, voice-based authentication is no longer considered foolproof. Security experts recommend that banks move away from relying on voice alone, which is a single point of failure.

Layered Security (MFA): Banks are being urged to implement multi-factor authentication (MFA) that combines voice biometrics with other, more secure methods (e.g., a PIN, a security code sent via SMS, or app-based authentication).

Liveness Detection: Some institutions are adopting "liveness detection," which can distinguish between a real human and a computer-generated, pre-recorded, or cloned voice.

"Safe Phrases": Banks like Starling are encouraging customers to create a "safe phrase" with family members to verify identities, which should be shared only out loud, never via text or email. 

Grumpy_chap

https://forums.moneysavingexpert.com/discussion/6654061/secure-use-of-voice-recognition-for-access

I previously had voice ID with First Direct.

It worked as an additional layer on top of the regular ID process. So, when calling the bank, they would take me through the normal ID process (which I had to pass) and, at the same time, do the voice ID by analysis of my voice in the conversation to go through the normal ID process.

With voice ID operating in that manner, the cloned voice alone would not be able to circumvent the security process.

The problem I had was it became so frequent that I was denied access because of the voice ID (even though I was me using my natural voice) that I eventually asked for the voice ID to be removed and just reverted to the standard security questions in any case. The sort of issues I experienced was failure to pass voice ID if I had a cold, any back-ground noise (wind noise particularly), or just a slightly flaky phone signal.

flaneurs_lobster

I don't think I have ever used voice recognition for ID at a financial institution.

I think I may have set it up when I opened my First Direct account, is there some indication online/app that this is so?

Is there a list of institutions that offer the facility?

SH88SH88

I seem to remember Halifax were pushing Voice ID a few months ago (may even have been a year or two). I swerved it for 2 reasons... (A) I thought it looked ripe for scammers and/or AI to exploit. (B) I thought Halifax were too pushy about it, I have a natural aversion to resist most things that are being almost 'forced' upon me.

Guessing that if Halifax use it, presumably other parts of the Lloyd's empire also do ?

oldagetraveller1

"Guessing that if Halifax use it, presumably other parts of the Lloyd's empire also do ?"

Lloyds certainly offer the option to use it if phoning them for anything account specific. I did register by saying "My voice is my password" numerous times, as requested, until their system was happy.

Grumpy_chap

https://forums.moneysavingexpert.com/discussion/comment/81872980#Comment_81872980

It does seem a bit of a security risk if the voice ID is relying solely on voice ID and everyone has to use the same phrase "my voice is my password" for the ID process.

That seems to be the weakness the BBC article linked upthread exploited with the cloned voice.

The FD system at least add the voice recognition as an extra layer above the standard security and each individual has a unique password and log in details.

GeoffTF

Santander was pushing it. I used it for the first time recently, but I think I was asked for other ID for a general enquiry.

mta999

Voices cloned in 'deeply disturbing' banking scam

Criminals are using artificial intelligence to clone voices and set up unauthorised direct debits over the phone, National Trading Standards (NTS) has warned. 

The "advanced" organised criminal operation appears to be targeting older people, getting them to take part in a fake lifestyle survey to gather their personal information. 

The information is used to create AI-generated voice clones to simulate consent to direct debits without the victim's knowledge.

iStock

Louise Baxter, head of the NTS scams team, said: "What we're seeing is a deeply disturbing combination of old and new: traditional phone scams supported by disturbing new techniques.

"This is no longer just a nuisance - it's a coordinated, sophisticated operation targeting some of the most situationally vulnerable consumers in society.

"We urge everyone to speak to friends and relatives about scam calls, check bank statements regularly and report anything suspicious."

GeoffTF

Where is the link?

eskbanker

https://forums.moneysavingexpert.com/discussion/comment/81873484#Comment_81873484

Yes, not good form to share unattributed copypasta, but it looks to be some sort of precis of this release from NTS yesterday:

https://www.nationaltradingstandards.uk/news/phone-scams-take-sinister-twist-as-victims-voices-cloned/