This week, I learned that Chase has introduced voice ID for my account, meaning when I call them, they will match my voice with their stored information, and allow phone access to my account based on a match, instead of asking 'security' questions.

This actually makes me very nervous - my job requires me to be in meetings all day, most of them get recorded, and a large number of people have access to these recordings. I think half of today's 6th-graders can use software to cut those recordings in words or phrases, and make my voice say different sentences. Then they call the call center, and there goes my money.
The bank will of course decline any liability, as they have a recording where I (no, my voice!) ordered those transfers.

What protects customers from this seemingly simple attack vector?

Should I change banks?

  • 2
    This might be more on-topic for security.stackexchange.com. – chepner Oct 19 '18 at 19:20
  • i considered that, @chepner , but it seemed that side's question are much more technical (code and network related). I am sure willing to consider a migration. – Aganju Oct 19 '18 at 20:19
  • Do you have the option not to communicate by voice? (I really can't see why anyone would even want to do bank transactions that way, unless they're functionally illiterate.) If so, simply turn it off. – jamesqf Oct 20 '18 at 17:44
  • I never use it, but doesn't that make it worse? Anyone could call now and get his voice registered - I can only hope that they ask for something more secure than my address and mother's maiden name... – Aganju Oct 20 '18 at 18:46
  • I wish I could complete block phone interactions. I'll look into that. – Aganju Oct 20 '18 at 18:47

Your assets should still be safe. From the FAQ on the Chase Voice ID site (emphasis mine):

Why are you still asking me security questions?

There may be instances when there is too much noise in the background for us to make a positive verification using Voice ID, or additional verification is needed based on your request. Our specialists may ask you security questions to protect you and your accounts.

Based on that, I would expect Voice ID to only be used in lieu of security questions for "read-only" operations, such as checking your account balance or recent transactions. Even if it were used for "undoable" transactions such as transfers between your own accounts, your assets would still be safe. The only way your assets could be at risk would be for transfers out of your account, and in that case I expect further verification would be needed.

If you're still concerned, you may opt-out if you wish (also from the FAQ page):

You are not required to participate if you elect to answer additional security questions.

Given this, I see no reason for you to change banks. Personally, I would welcome the added convenience, and I tend to be a little more paranoid than most.

| improve this answer | |
  • 1
    I'm pretty sure that you're right and that reputable financial institutions such as Chase have different tiers of account access and requests such as fund transfers from Chase accounts to outside institutions would require a much higher tier of access than allowed by just a Voice ID command. Very unlikely that the OP's concern of "Then they call the call center, and there goes my money." is a realistic one. – Barney Cowell Oct 20 '18 at 7:02

Yes, your bank's use of voice ID puts your assets at risk, depending on how it is implemented.

Here are claims of safety with voice ID from a couple of banks:

Fraudsters and hackers may be able to steal or guess your security number, but they can't replicate your voice. Voice ID is sensitive enough to detect if someone is impersonating you or playing a recording. It can even recognise your voice if you have a cold or a sore throat. - a bank

Safe - your voice is like your fingerprint and unique to you - another bank

Generalising voice recognition as the first bank claims requires that the algorithm's precision be reduced. The second bank's claim of safety does not address your 'record and replay' scencario.

The following report claims that even a twin's voice can be used to fool the algorithm:

BBC reporter fools bank voice-ID security - BBC News

| improve this answer | |
  • 1
    "[...] Voice ID is sensitive enough to detect if someone is [...] playing a recording [...]" - really? how would this be possible? that sounds like complete bullshit to me. – Aganju Oct 20 '18 at 18:51
  • @Aganju That’s the claim. The BBC reporter’s success suggests problems with the security of Voice ID. – Lawrence Oct 20 '18 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.