HSBC’s voice recognition ID system used by half a million customers for secure access to their bank accounts has been breached by a customer’s twin mimicking his voice.
When it was launched last year HSBC’s head of retail banking claimed the new system was secure, insisting that “just like your fingerprint, your voice print is unique”.
But when BBC Click reporter Dan Simmons set up an HSBC voice-ID authenticated account, his non-identical twin, Joe, was able to fool the system and granted him access to his brother’s account.
HSBC said it is to review security on its voice-access systems following the breach. Unlike traditional password systems, which lock users out after repeated attempts fail, Joe Simmons tried seven times to mimic his twin’s voice before HSBC allowed access.
The bank said it will in future only allow users three attempts to access their accounts using voice ID before blocking them.
The HSBC system asks users to say “my voice is my password” into the phone, which is then matched to an original recording of the person’s voice, allowing access to their account.
According to the BBC, the breach did not allow Joe Simmons to withdraw money, but he was able to access balances and recent transactions, and was offered the chance to transfer money between accounts.
“What’s really alarming is that the bank allowed me seven attempts to mimic my brother’s voiceprint and get it wrong, before I got in at the eighth time of trying,” he said.
Voice ID is currently being rolled out to 15 million HSBC customers. At launch, HSBC said: “The technology is now the ultimate way to bank safely and securely, without the need for passwords. With a couple of choice words, banking with HSBC is as easy as being yourself.”
But in a statement issued after the breach was made public, HSBC said: “The security and safety of our customers’ accounts is of the utmost importance to us and Voice ID is amongst the most secure methods of authenticating customers.
“The introduction of this technology has seen a significant reduction in telephone fraud, and has proven to be more secure than PINs, passwords and memorable phrases. Our VoiceID system does allow us to make changes to different security settings, and following a review we have made changes to make it even more secure.”
Embarrassed HSBC officials have suggested that the BBC Click experiment, while real, does not open the door to fraudsters. One said: “This is not how fraudsters work. This was a twin sitting with his brother. He would just as likely know other security data such as mother’s maiden name, pet’s name and so on.
“In a real situation you would not have a fraudster sitting next to you. If he or she tried recording your voice saying ‘my voice is my password’ it would not work either, as the system is able to detect synthetic voice characteristics.”
Barclays introduced voice recognition software for all its 300,000 wealthiest clients in the UK in 2013. A year later the bank said the technology had been so successful that it would be rolled out to 12 million retail banking customers.
Barclays said it had been “incredibly popular” with wealthier clients, with the time taken to verify their identity falling from 1.5 minutes to less than 10 seconds.