How does HSBC's voice activated banking service work? [video] | Hacker News Reader

How does HSBC's voice activated banking service work? [video]

bbc.com

27 pointshugopascal31 comments

What if I have a recording of the account-holder's voice? Could computers be programmed to mimic voices after hearing a sample? What are the fallbacks - presumably old-fashioned verifications which might be subject to social engineering?

The cost of occasional fraud is probably priced in already. Thats how credit cards are handled.

In the UK, if you log in to your bank account on the phone, pass the required verification checks, and say you want to transfer all your available funds to your long lost aunt's account in Russia, then your money is transferred, irretrievably. It's going to be up to you to prove that the bank's verification is faulty, so good luck with that.

In practice, I should imagine fraud protection would kick in and prevent the transaction.

Exactly. A transaction like this would likely trigger multiple risk indicators and require manual intervention by the bank/3rd party before a transfer of this nature would be allowed.

Not saying it can't happen, of course, but it shouldn't.

I've had several much less dodgy transfers flagged up and recieved phone calls to confirm them. Though, that doesn't answer the question of what happens if they miss one. Could be 0.001% for them, but your whole life savings could be gone.

Depending on the bank the controls vary. For example Natwest require multiple factor to setup the destination bank account the first time you do a transfer and then less authentication on subsequent transfer. Multiple factor because you would need to know my online account number, online pin code, online password be in possession of my bank card, use a Natwest card reader that authenticates me using chip and pin. Yes it's a frustrating way to pay a mate £5 but does make it a lot harder to be attacked.

These sorts of services usually have limits on what can be transferred, or extra verification needed for transfers to new accounts etc

The service could present a phrase for the user to say, which prevents the recorded voice attack.

Against an insufficiently smart attacker. How about a computer that can learn to imitate any speech, perhaps by modelling the shape of the vocal tract (which is how modern speech synthesizers actually work, so it's not a huge leap).

Shouldn't security be multilayered? if I want to transfer money out of my account or I exceed certain limits then I need additional authentication.

Definitely, and the banks do have additional checks. The question is whether voice recognition adds significant burden to attackers. Or more likely, whether banks can claim that voice recognition is bulletproof and could never be subverted.

No one ever claims something can't ever be subverted. Right? Why would you even think that? Fraud is big business.

By the way, it looks like they're incorporating TouchId too:

http://9to5mac.com/2016/02/19/hsbc-touch-id-voice-recognitio...

No, it's not. Modern systems work using "statistical parametric speech synthesis", i.e., they're models trained from data. Someone did a fluffy piece about the vocal tract modeling approach recently, but that approach sounds awful. All of the notable systems in use and all the notable research is not in that direction.

> The service could present a phrase for the user to say

That might work, although it might be a bit like an audio-captcha (i.e. frustrating):

"Please repeat this phrase: Mary had a little lamb, its fleece was white as snow."

"Mary had a ... what did you say it was? Oh, a little lamb. OK, and its fleece was white as snow."

"Please repeat the exact phrase: Mary had a little lamb, its fleece was white as snow."

"Mandy had a lamb whose fleece was white as snow."

"Please repeat the exact phrase ..."

I can see certain types of user not thriving at this activity.

That's trivially solvable using a partial matching score.

A representative has just been interviewed on BBC Radio 2 and she claimed the system can automatically detect if it's a recording.

If it was anything like the interview I heard on the Today programme, the representative was claiming a lot of things. My inner cynic couldn't help but wince.

That isn't too say it's inferior to other mechanisms though.

Probably the same person but a shorter interview, no specifics were discussed. The answer went unchallenged.

Uh huh.

What the PR rep says is not what is true.

I suspect certain types of recording, i.e lossless wouldn't be able to be distinguished.

But your typical mp3, voice recording wont make the cut. It's quite easy to tell a recording apart from a spectrogram.

There are also ways around this the bank can employ, such as the use of spontaneity, which a recording cannot account for, i.e ask the user to say something random if there is a doubt.

Remember that telephone calls are sampled at 8khz. A lot of information will automatically be lost before the signal reaches the other party.

Agreed, this is the reason I don't really trust the claims here.

It's actually much worse if you are using a mobile phone, since the GSM codec will add even more artefacts before being passed via PSTN to them.

Add that to serious background noise and you are giving people to fake way more room than a crystal clear PCM WAV.

Your voice is already distorted by transfer medium, mobile phones are terrible, something like 4-8khz ...

We have software that can make a synthetic video of any person mimic another person's movements, in real time. I am sure audio is even easier.

We can put one person's skin and face on another person's motion capture, yes. We can't (as far as I know) make one person appear to have another person's gestures, unless the first person can mimic those movements quite well.

There's a lot of nuance in the spoken voice. Don't be sure audio is easier than motion. (Faking it well enough to fool a computer is easier than fooling a human, though...)

Obligatory Sneakers reference: https://www.youtube.com/watch?v=-zVgWpVXb64

In my opinion, this is a great move towards making mobile banking more usable. Compared to carrying around a hard token or having a 20 random character password, biometrics offer good user experience without compromising the security too much. There are plenty intelligent ways of performing liveliness detection, the most obvious being a challenge-response scenario.

That being said, no individual biometric is good enough to provide a good and consistent experience on it's own. Every one has situations and environments it fails in (noisy room, dark environment, etc.). That's why I believe only a combination of different modalities (facial, voice, etc.), can provide a robust and consistent solution.

For full disclosure - I'm the CTO of AimBrain and we're hiring: https://aimbrain.com/joinus

What's wrong with storing a digital key on the same device you use to access the bank? No hardware token needed.

This is most idiotic thing I have ever seen, sorry for hars language. Only thing I need is to record your voice in order to get access to you account. Are people going nuts or what ?! Same as face recognition have you ever try opening your friend Iphone with his picture? Try ...

I'm worried that they are being compared to a bank that has face recognition software to access their accounts.

You can fill most face recognition software with circles and a line drawn on paper.

Reply on news.ycombinator.com