With millions of us accustomed to barking orders at Alexa and Siri, it’s probably not surprising that voice recognition services offered by banks and other organisations are taking off in a big way.
It emerged this week that HM Revenue & Customs has so far signed up about 6.7 million people to its voice identification (or “voice ID”) service, while HSBC says it has more than 10,000 people registering each week.
Lloyds Bank, Halifax, Vodafone and TalkTalk are just a few of the other big names that have brought in, or are rolling out, these services. They let people access their accounts simply by using their voice – so you can say goodbye to hard-to-remember passwords and pin codes.
One leading futurologist reckons it won’t be too long before the technology takes over from contactless when it comes to making payments.
Also known as “voice biometrics,” it confirms your identity by analysing your voice’s unique characteristics. Companies say it makes accessing your account fast and easy – plus it reduces fraud. But how secure is it? This week Guardian Money was told that if there are clips of your voice out there on the web – on a podcast, say – there is technology that can create a very convincing imitation of your voice.
And should we be worried about the large-scale harvesting of our voiceprints? Earlier this year, it was claimed that HMRC had collected millions of taxpayers’ voiceprints without their consent. This data, it has emerged, is being held by a private company, KCOM – formerly Kingston Communications.
So how exactly does the technology work? It basically verifies a caller’s identity by comparing their voice to the voiceprint the company has stored in its database.
The companies behind this technology say that a voiceprint includes more than 100 unique physical and behavioural characteristics of each individual, such as length of the vocal tract, nasal passage, pitch, accent and so on. They claim it is as unique to an individual as a fingerprint, and that their systems even recognise people if they have a cold or sore throat.
However, this is different to the tech behind digital assistants such as Apple’s Siri and Amazon’s Alexa, which recognise what words are said, not how someone says them.
When a customer first signs up, their bank (or whichever company it is) will make a recording of their voice over the phone. For example, with HSBC and HMRC you are asked to repeat the phrase “my voice is my password” up to five times. Then what typically happens is that the next time you phone, you won’t need a password – you will just need to repeat that phrase.
Nuance Communications, a leading provider of this technology, says surveys have repeatedly shown that customers prefer this sort of authentication over pins, passwords and security challenge questions. It claims that “even professional voice imitators can’t fool our system”, and will generate an alert if it detects synthetic speech or a recorded voice.
The technology is taking off rapidly: specialist analysts Opus Research expect the number of people worldwide that have enrolled to jump from about 160 million in 2017 to about 600 million by 2020.
Barclays was an early adopter, bringing it in for some customers in 2012, and HSBC embarked on a major rollout in 2016, with almost 1.5 million customers so far signed up. HSBC adds that the new system has significantly cut the amount of telephone fraud, with almost 8,000 attempts identified, and more than £200m of customer funds protected.
Meanwhile, Lloyds Banking Group, which includes Halifax, says it has been rolling out its service gradually this year, and it has been successfully used about 1m times to date. It adds: “This will make a significant difference to vulnerable customers who may sometimes struggle to pass security with pins or memorable information. Our oldest registered customer is 100.”
Firms claim that voice recognition systems are “even able to spot the difference between identical twins” – however, in May 2017, HSBC’s system was fooled by a BBC reporter. The bank let Dan Simmons’ non-identical twin, Joe, access his account via the telephone after he mimicked his brother’s voice.
Graham Cluley, a leading computer security expert, says of these systems: “They certainly can be duped – you don’t need to be Mike Yarwood or Rory Bremner … There have been a number of occasions when these things have been found to be not up to scratch.”
He adds: “There is extraordinary technology now which is able to emulate people’s voices pretty much in real time. If a criminal has fragments of you speaking already – for example, a YouTube video or podcast – there’s technology that can put together a very convincing imitation of your voice.”
Cluley believes you can use something like a voiceprint as an additional method of confirming someone’s identity, “but it shouldn’t be the only one. Simply the voice alone, I think, isn’t enough … we need financial institutions to be a little more sceptical about it.”
HMRC started rolling out voice ID in January 2017 to speed up the security steps customers are asked when calling (they can access its systems without using this technology). However, in June this year, the campaign group Big Brother Watch claimed HMRC had been collecting voiceprints without consent, and that this basically amounted to “a mass ID scheme”.
In response, HMRC says it is working with the Information Commissioner’s Office (ICO) “to address the concerns expressed”. It adds that the system “is very popular with customers as it gives a quick and secure route to access their account by phone”.
An HMRC document, seen by Money, discloses that its private sector partner KCOM will hold this data “for a number of years” – though there is no indication of precisely how long. It added: “Voiceprints are encrypted and stored in a secure database behind the firewall, just like any other sensitive customer data.” All data, it says, is stored in the UK.
So can you ask the taxman to remove your voiceprint? The HMRC document states, perhaps alarmingly, that “there is no delete function”. However, a spokesman told us: “There is a deletion process that can and has ben used to delete voice IDs from our service.”
The future? It’s all talk
You owe the guy who sits next to you at work £10, or perhaps you need to give your son his pocket money. No need to log on to your online banking in order to make a payment, or rifle around in your wallet for notes and change – simply point at them, say “Pay X £10” (or words to that effect) into your mobile phone, and you’re done.
This is what we could all be doing fairly soon, according to futurologist Dr Ian Pearson, who invented text messaging back in 1991.
Just over a year ago, Pearson said it won’t be long before people complete a financial transaction with just a simple gesture and a few words – thereby replacing the need for contactless payments. This week he said he stood by his prediction: “It still hasn’t really happened yet but we’re getting closer and closer. People are getting used to talking to Alexa and Siri … You can imagine giving your kids pocket money – you’d say: ‘I give Fred £2.50.’ It’s easy to see how those casual transactions would happen.”
® Copyright of authors and sources is cited by the newspaper.