Whither voice biometric security after the UK Department Work & Pensions drops anti-fraud trials?

An interesting story last month on Silicon.com, that the UK Department of Work & Pensions has abandoned its trials of voice biometrics as an anti-fraud tool.This is not a snap decision, as Silicon.com reports that the DWP has spent at least £2.4m on trials since May 2007. This is one of the largest payment organisation’s in the UK, so its decision is of interest to most organization who need to validate customer identity and handle payments. Voice biometrics has had a lot of interest from the financial services industry, so the DWP’s decision may well lead a number of banks to study it closely.

What makes it especially interesting is that fraud is such a huge problem for DWP (the DWP’s own estimates put their annual fraud losses at £5.2bn per annum) and voice biometrics has promised so much to reduce fraud. Indeed, as anti-fraud has been one of the major pitches of the voice biometrics industry, why on the surface might it have failed at the DWP?

The first part of this is to understand what types of problem voice biometrics are good at tackling. In my experience, voice biometrics are a useful tool in identity validation. Passwords tend to test “do you know what you should know?”. By comparison, biometrics can test “…are you who you say you are, even if you do know your password?”. There are valid arguments about biometrics accuracy, but provided they are not used as a single factor authentication when taking a voice sample over a poor quality public telephone line, I believe that they remain a valuable addition to the security toolkit.

I have to admit that while I haven’t worked directly with DWP, I do have some knowledge of the issues they face from work with local government and other government departments.
Identity theft is the sort of fraud that voice biometrics is ideal for tackling, but traditional identity theft in the form of impersonation is relatively low. This is partly because although the amount stolen in benefit fraud is large the value of individual claims is relatively low and identity theft impersonation is generally uneconomic.

A much bigger problem (where voice biometrics could perhaps play a part) is false identity. The problem here is that once you let a false identity into the system through one channel, then it can ‘validate’ itself through other channels and become very hard to detect. Preventing false National Insurance numbers being created is crucial and this is perhaps an opportunity for voice biometrics, at least to prevent serial fraudsters creating multiple identities themselves.

The biggest problem, though, for the DWP is the complexity of the system and the massive fraud figure of £5.2bn (2.1% of all expenditure) is as much a reflection of error as it is of more exotic types of theft. This error can be genuine on the part of claimants, or deliberate, but either way it is the complexity of the system and the lack of real time information that prevents its resolution and detection.

Surprisingly, this was the problem that the DWP tried to tackle with voice biometrics, basically trying to use tone & emotion detection and similar mechanisms to detect claimants lying. I have to admit some doubt here as to whether this is a practical application in real time. In the world of call recording it has long been used as an application that can detect calls where customers (or call centre workers!) have become angry, but this has not tended to be a real time application. The other problem is the inbound call to DWP. At the risk of stating the obvious, claimants of benefits are more likely to be stressed than average and especially so when talking to the DWP. Furthermore, most of the demographic who regularly deal with the DWP are likely to be calling on mobile phones rather than landlines (so poor call quality) and be may well not have strong English language skills (so will be more hesitant, accented and less standard).

My suspicion is that the best way for the DWP to tackle fraud would be to use more process simplification and back this up with analytics rather than try and fix the front end with technology. Once that’s done, voice biometrics could have a very valuable anti-fraud role to play, but as the solution to the right problem.

Bank Leumi introduces biometric password re-sets for online banking

An interesting story about Bank Leumi on Finextra just before Christmas.

It seems that Bank Leumi will be using voice biometrics for password re-sets for online banking. There are a couple of interesting things about this.

The first is that password re-sets are an absolute pain for helpdesks and similar types of contact centre. Depending on whether this is an internal helpdesk for an organisation or an external facing one, password re-sets can be anything from 50%-70% of the call traffic. The two follow on problems from this call volume are that password re-set is an expensive thing for IT technicians to be spending most of their time on and that they represent a significant potential security risk.

It is this security risk that is the other area of interest. Passwords authenticate you based on what you know, not who you are. Re-setting a password changes that, as it potentially makes the password available to an identity thief. The blog has covered a number of examples of identity theft (this theft from Barclays in 2008 using the identity of Barclays own chairman being a particular case in point) and the vulnerability is obvious.

In theory, biometrics removes some of this risk as it is focused on who you are and not on what you know. In practice things are not so straight forward and this is partly why biometic adoption has been more limited than might be expected. For more detail on the limitations, here's been some good posts on Finextra see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik from 2008.

In Europe I've tended to see biometric deployments mostly for internal password re-sets. A good example that I know of is AIB and VoiceVault who have piloted password resets for staff. The key thing here is that the staff are in a controlled, secure environment and so the biometrics is effectively only one part of a multi-factor and multi-layer authentication.

This is what makes the Bank Leumi example so interesting. I haven't before seen biometrics used directly for consumer authentication for something as sensitive as banking.

I have seen quite widespread use of biometrics outside of Europe and the US and especially for areas like welfare benefits. I got a fair amount of comment to my blog post "BBC Moneybox on Speech Recognition for banking " back in February with examples of biometrics in use from the Philippines (interstingly using PerSay, as does Bank Leumi).



Depending on how the Bank Leumi deployment foes, I may need to revise my last post on the subject "Where are Speech Biometrics in Europe?..... and the Your Call Blog "....!

Phone Banking vs Facebook banking

I was very interested to see two good stories on Finextra today.

The first was that around half of Facebook users want to be able to bank through Facebook. The second was that 91% of British adults had concerns about fraud on their phone accessible bank accounts.

It seems to me a pretty bizarre set of contradictions. Facebook is a very nice application, but I'm pretty dubious that banking through it is a good idea. There are issues over some of the Financial Services advertising (see the BBC "Facebook users warned about ads") and I'm not convinced that data privacy issues are fully resolved, or in line with the standards set by banks (again the BBC with "Facebook 'violates privacy laws'" and "Facebook faces privacy questions"). It may be that as Facebook matures these issues will be resolved to everyone's satisfaction, but I know many remain dubious about entrusting their details to an organisation that has already had to apologise for how it has used them.

By contrast voice technology is far more mature and security concerns should be on a different level. There are weaknesses but they are more to do with processes than the underlying technology. A good example was the case I covered at Barclays (see "Security, Call Centres and Fraud") where there was nothing wrong with the technology, but the processes were not as robust as needed to be against identity theft. At this point (although the research is funded by Nuance a speech technology vendor) I'm inclined to agree with the article that speech recognition and biometrics could make a difference where pass words have been stolen or an identity otherwise compromised. Certainly it had the potential to make a difference in the Barclays case.

The scary thing about Facebook is that if a Facebook banking application were to be compromised, the chances are that the fraudsters would have access to so much personal information that any future identity recovery could be very difficult. By contrast the telephone channel at least offers the prospect that even if your identity was stolen you would only be authenticated by who you are, not what you know.

Call centre worker gaoled for data theft

An interesting article on Finextra about the recent theft at a Royal Bank of Scotland call centre.

This isn't the first, and certainly won't be the last, example of security breaches from staff. There's been a lot of recent focus on the risks of external attack and how biometrics can help deal with this but the internal threat has been neglected. I've posted on the external attack on Barclays ("Security, Call Centres and Fraud"), when fraudsters stole the identity of their chairman for a credit card application, and there's been some good posts on Finextra (see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik both last month).

In fact, inside threats are perhaps as serious as the risk of external attack. In 2006 HSBC lost £233,000 after it's Indian call centre suffered inside attack (here for the BBC report). Last year the BBC also reported how HSBC and HBoS had been targeted by an organised gang which both penetrated the banks and laundered the proceeds of their crimes.

An internal threat is nothing new - fraud from dishonest employees is something that banks have had to deal with almost from the start of banking. What is new is the level of the threat and its organisation. As an example, Strathclyde Police (who cover the west of Scotland where many call centres are located) believe that organised gangs have infiltrated perhaps one in ten of the call centres there (full report here).

In the end, as I've argued with biometrics, the criminals will be beaten by process, not technology point solutions. If the defences against external attack are strong, then criminals will seek to get on the inside. The correct response is not to strengthen the exterior with biometrics (though I'm not sure biometrics do strengthen it), but instead to make sure that staff are vetted, exceptions or unusual activity is identified and monitored and good management is in place.

Process is not terribly exciting, but it will be the element that determines whether technology defeats criminals or not.