AI-powered voice cloning technology is now so powerful that it is breaking sophisticated customer authentication systems, including those of several UK banks.
A BBC investigative journalist demonstrated the risk by successfully bypassing a bank’s voice ID system using sophisticated voice cloning software.
Shari Vahl of the BBC branch “You and Yours” came up with the idea after playing around with voice-cloning technology and being startled by its sophistication, noting colleagues struggled to tell the difference between the two voices.
She then wanted to see if it could convince security tech instead of just human beings and tested whether it could access her bank account’s voice ID system.
Vahl used a recording of her AI clone saying, “My voice is my password,” when calling up Santander and Halifax and being asked for her voice ID. Both attempts to access her account were successful.
Just in case the BBC studio-quality speakers, which Vahl used to play the AI voice, were a factor in her success, she also tried it at home using an iPad-quality speaker. It still worked.
This breach, achieved by replicating the nuances of a voice—including tone, pitch, and emotion—highlights the limitations of many current biometric security measures.
As voice cloning tools become more accessible, including through commercial services and the dark web, the threat to voice authentication systems grows.
OpenAI warned businesses about this earlier this year, asking them to phase out voice-based authentication. It also stalled the development of its Voice Engine solution, a voice cloning tool that produces natural-sounding speech that OpenAI says “closely resembles” the original speaker.
“We encourage steps like phasing out voice-based authentication as a security measure for accessing bank accounts and other sensitive information,” OpenAI wrote in a blog.
The organization urged businesses to accelerate the development and adoption of methods for tracking the origins of AV content.
OpenAI also emphasized the importance of public education in better recognizing “deceptive AI content” and suggested exploring policies to safeguard the use of individuals’ voices in AI applications.
This landmark development in voice cloning effectively gives brands who use voice authentication two choices. They can either drop the process altogether and pursue alternative forms of authentication, as OpenAI suggests, or collaborate with vendors like Pindrop to reinforce their voice channels with tailored solutions designed to guard against this.
Pindrop provides advanced voice authentication and fraud detection solutions that analyze over 1,400 unique audio features to verify identity and detect threats in real time.
Leveraging AI and deep audio analysis, Pindrop aims to help businesses safeguard against increasingly sophisticated voice cloning attacks like those outlined above, intending to secure customer interactions and protect against identity fraud.
Five9 & Pindrop Announce an “Industry-First” Native Voice Integration
Only a few weeks ago, Pindrop and Five9 announced a native integration that entailed the latter embedding authentication and fraud detection capabilities from the former into its Intelligent CX Platform.
Five9’s “industry-first” telephony integration now offers users access to Pindrop’s Passport and Protect solutions, enhancing authentication and fraud detection.
Passport enables seamless multi-factor authentication by passively verifying callers during interactions, while Protect uses advanced speaker verification to analyze voice traits, ensuring only authorized individuals can access sensitive information or complete transactions.
Previously, the partnership relied on a bring-your-own-cloud (BYOC) model, with Pindrop integrating through third-party carriers. The new integration leverages Session Recording Protocol (SIPREC) for enhanced security, reliability, and improved redundancy via Five9 Telco.
