Voice as Identity: Rising Use of Vocal Biometrics

Jersey Telecom telephone operator at switchboard, 1975, by Joseph A. Carr. From Wikipedia, used under CC BY 4.0

We may be becoming more familiar, and even more comfortable, with using biometric identifiers for authentication or security keys. A common usage of a type of biometric information – fingerprints – already exist in small and large scale applications: ranging from unlocking a person’s smartphone [1] to immigration clearance at an international airport [2]. In Canada, a new type of biometric information, voice data, is being used as a way to identify people, and businesses are beginning to implement this way of authentication. Voice data can be useful for replacing other forms of identification that could be hard to remember, such as social security numbers or bank card numbers, as it only requires a person to speak.

Voice Print Sample, by United States Department of Commerce. From Wikipedia, used under CC0 1.0.

Several Canadian companies have begun using voice biometrics to identify customers through the phone, including Royal Bank of Canada [3], Toronto Dominion Bank [4], Bank of Montreal [5], and Rogers Communications [6], to name a few. Each of these examples, they all seem to operate in a similar fashion. A customer enrolls into the voice recognition program with the company, or is offered the chance to enroll by a company representative. As they converse, the customer’s ‘voiceprint’, or vocal biometric data, is recorded by the company and used as a basis of comparison for future cases of authentication. No other forms of identification are required after a customer has verified their identity through a voice recognition program. None of the examples listed say much in regards to the details of how the voice recognition process operates, nor do they provide details about whether each company developed and owns their own kind of voice processing data, or whether it is outsourced to a third party vendor for authorization.

Drawing from my own experience as a client of one of the examples listed, I don’t remember ever providing my consent to enroll in the voice recognition program, but I found out I was by accident in a service call unrelated to the program. I was surprised, curious, and unnerved at finding out that this was the case. I aim to update this article once I have contacted that company to ask about records related to my provision of consent to enroll in the voice recognition program.

How can you check if you are enrolled in these voice recognition programs? If you suspect that a service provider or company you do business with has enrolled you into a voice biometrics program without your consent, you can call them to inquire about the existence of voice biometrics for that organization, and whether your voice is found in their voice database.

So What?

Voice biometrics may provide a positive effect for both the customer and the company using it: the customer doesn’t have to worry about remembering information and the company can reduce time spent verifying the identity of a customer through the telephone. However, the convenience provided by voice biometric programs also bring security and privacy risks. One such risk of the reliance on voice for identification is that since no other forms of identification that were previously required (e.g. address, date of birth, social insurance number) are needed after a customer has identified themselves through voice, an unauthorized agent may be able to use samples of a person’s voice to bypass this type of verification.

The CBC has reported on cases in which fraudsters attempt to call potential victims and asking if they can hear them, in an attempt to get the victim to respond “yes,” which is subsequently recorded as voice sample [7]. These voice samples would then be used to sign the victim for a purchase or service that the fraudster will use, with the victim being sent the bills afterwards. New technology is taking the potential for voice identification fraud to occur, as companies like Lyrebird, from Montreal, are able to transform source audio sample from a person’s voice into any requested phrase or tone of speech [8]. Yes, this is real technology that is being developed right now, and it can mimic your voice, provided the software can learn from a sample clip of the source. As a good precaution, do not answer any calls from phone numbers you do not recognize.

However, the more traditional ways of customer verification, such as providing your social insurance number, date of birth, or address, carries its own set of risks as well. You may have been provided warning that your telephone calls may be subject to recording for training and quality assurance purposes if you have called a service provider about an issue before [9]. The storage of these recorded conversations that contain sensitive and identifiable information means that you rely on the companies that provide you with services to also safely house and store those conversation recordings from unauthorized entry.

Discussion Questions

• Have you enrolled in any voice biometric programs with a company you do business with?
• Do you think the convenience provided by voice biometrics outweigh its potential risks and dangers?
• What do you think about software made by companies such as Lyrebird that can potentially mimic your voice?
• What do you think about companies that store recorded conversations potentially containing sensitive and identifiable information of customers?
• What suggestions do you have to prevent your voice from being used as a sample clip for voice mimicry software?

You can submit an original comment or reply to another reader’s comments in the discussion forum below!

Disclaimer: The views and opinions expressed in this article are those of the author and do not constitute legal or financial advice.

Always do your own research for informed decisions.

edited by: Elyse Hill

Additional Sources

• Lyrebird Homepage [Lyrebird]
• Vishing or Voice Fishing [RCMP]
• Baidu AI Can Clone Your Voice in Seconds [Medium]
• Technologically Advanced Phone Scams [Kaspersky Lab]
• Prisons Across the U.S. Are Quietly Building Databases of Incarcerated People’s Voice Prints [The Intercept]