Whither voice biometric security after the UK Department Work & Pensions drops anti-fraud trials?

An interesting story last month on Silicon.com, that the UK Department of Work & Pensions has abandoned its trials of voice biometrics as an anti-fraud tool.This is not a snap decision, as Silicon.com reports that the DWP has spent at least £2.4m on trials since May 2007. This is one of the largest payment organisation’s in the UK, so its decision is of interest to most organization who need to validate customer identity and handle payments. Voice biometrics has had a lot of interest from the financial services industry, so the DWP’s decision may well lead a number of banks to study it closely.

What makes it especially interesting is that fraud is such a huge problem for DWP (the DWP’s own estimates put their annual fraud losses at £5.2bn per annum) and voice biometrics has promised so much to reduce fraud. Indeed, as anti-fraud has been one of the major pitches of the voice biometrics industry, why on the surface might it have failed at the DWP?

The first part of this is to understand what types of problem voice biometrics are good at tackling. In my experience, voice biometrics are a useful tool in identity validation. Passwords tend to test “do you know what you should know?”. By comparison, biometrics can test “…are you who you say you are, even if you do know your password?”. There are valid arguments about biometrics accuracy, but provided they are not used as a single factor authentication when taking a voice sample over a poor quality public telephone line, I believe that they remain a valuable addition to the security toolkit.

I have to admit that while I haven’t worked directly with DWP, I do have some knowledge of the issues they face from work with local government and other government departments.
Identity theft is the sort of fraud that voice biometrics is ideal for tackling, but traditional identity theft in the form of impersonation is relatively low. This is partly because although the amount stolen in benefit fraud is large the value of individual claims is relatively low and identity theft impersonation is generally uneconomic.

A much bigger problem (where voice biometrics could perhaps play a part) is false identity. The problem here is that once you let a false identity into the system through one channel, then it can ‘validate’ itself through other channels and become very hard to detect. Preventing false National Insurance numbers being created is crucial and this is perhaps an opportunity for voice biometrics, at least to prevent serial fraudsters creating multiple identities themselves.

The biggest problem, though, for the DWP is the complexity of the system and the massive fraud figure of £5.2bn (2.1% of all expenditure) is as much a reflection of error as it is of more exotic types of theft. This error can be genuine on the part of claimants, or deliberate, but either way it is the complexity of the system and the lack of real time information that prevents its resolution and detection.

Surprisingly, this was the problem that the DWP tried to tackle with voice biometrics, basically trying to use tone & emotion detection and similar mechanisms to detect claimants lying. I have to admit some doubt here as to whether this is a practical application in real time. In the world of call recording it has long been used as an application that can detect calls where customers (or call centre workers!) have become angry, but this has not tended to be a real time application. The other problem is the inbound call to DWP. At the risk of stating the obvious, claimants of benefits are more likely to be stressed than average and especially so when talking to the DWP. Furthermore, most of the demographic who regularly deal with the DWP are likely to be calling on mobile phones rather than landlines (so poor call quality) and be may well not have strong English language skills (so will be more hesitant, accented and less standard).

My suspicion is that the best way for the DWP to tackle fraud would be to use more process simplification and back this up with analytics rather than try and fix the front end with technology. Once that’s done, voice biometrics could have a very valuable anti-fraud role to play, but as the solution to the right problem.

Bank Leumi introduces biometric password re-sets for online banking

An interesting story about Bank Leumi on Finextra just before Christmas.

It seems that Bank Leumi will be using voice biometrics for password re-sets for online banking. There are a couple of interesting things about this.

The first is that password re-sets are an absolute pain for helpdesks and similar types of contact centre. Depending on whether this is an internal helpdesk for an organisation or an external facing one, password re-sets can be anything from 50%-70% of the call traffic. The two follow on problems from this call volume are that password re-set is an expensive thing for IT technicians to be spending most of their time on and that they represent a significant potential security risk.

It is this security risk that is the other area of interest. Passwords authenticate you based on what you know, not who you are. Re-setting a password changes that, as it potentially makes the password available to an identity thief. The blog has covered a number of examples of identity theft (this theft from Barclays in 2008 using the identity of Barclays own chairman being a particular case in point) and the vulnerability is obvious.

In theory, biometrics removes some of this risk as it is focused on who you are and not on what you know. In practice things are not so straight forward and this is partly why biometic adoption has been more limited than might be expected. For more detail on the limitations, here's been some good posts on Finextra see "Biometrics - what's that all about then?" by Dave Griffiths and "Who's in your Wallet?" by Jarvis Kandik from 2008.

In Europe I've tended to see biometric deployments mostly for internal password re-sets. A good example that I know of is AIB and VoiceVault who have piloted password resets for staff. The key thing here is that the staff are in a controlled, secure environment and so the biometrics is effectively only one part of a multi-factor and multi-layer authentication.

This is what makes the Bank Leumi example so interesting. I haven't before seen biometrics used directly for consumer authentication for something as sensitive as banking.

I have seen quite widespread use of biometrics outside of Europe and the US and especially for areas like welfare benefits. I got a fair amount of comment to my blog post "BBC Moneybox on Speech Recognition for banking " back in February with examples of biometrics in use from the Philippines (interstingly using PerSay, as does Bank Leumi).



Depending on how the Bank Leumi deployment foes, I may need to revise my last post on the subject "Where are Speech Biometrics in Europe?..... and the Your Call Blog "....!

Man in the middle fraud in call centres

Never one to post only on up to the minute stories, the blog was quite interested in the Finextra report a fortnight ago on "man in the middle" fraud in call centres. I just haven't had a chance to write on it until now.

Traditionally, man in the middle fraud has been more associated more with the web channel than the telephone channel (see for example "Man-in-the-middle phishing kits circulating freely on the Web" or "ABN Amro compensates victims of 'man-in-the-middle' phishing attack" from Finextra), so it's interesting to see the attack take place in the telephone channel. It's also interesting that the attack described in Finextra is very low tech compared with the programing knowledge required for the phisihing attacks. The telephone version of man in the middle is described as,

"....where a fraudster calls the victim claiming to work for their bank, warning that their account may have been breached or compromised. The criminal then puts the customer on hold and calls their bank, connecting the two while remaining on the line.

The bank then requests authentication information, such as social security number, passwords and other personal information. Once the personal information is provided, the fraudster quickly ends the conference line and informs the customer that the issue has been resolved.

Meanwhile, with the personal information gathered during the call, the fraudster can take over the customer's phone banking relationship and transfer money out of their accounts."

The interesting thing for me is that for this type of attack to be successful, it highlights how weak the process side of some banks can be. This attack depends on the banks authentication process revealing (a) all of the customer's authentication data each time and (b) not ensuring that customers have multiple levels of authentication. Most banks I've worked with probably wouldn't be caught by this kind of fraud, so I'm interested to see that there are banks out there that still lag so far behind.

It's far less sophisticated than some of the the attack I've seen recently, where fraudsters have built fake IVRs to pretend to be the bank and used VoIP diversion to fool customers into thinking they are calling a local number (see posts like "Contact Centre impersonation arrives in the UK") and probably far less likely to succeed. Similarly, targeted social engineering attacks are also more likely to succeed as these tend to rely on bypassing security procedures rather than attacking them head on.

I would argue that deception based attacks around identity impersonation (such as the one on Barclays discussed in the post "Security, Call Centres and Fraud") seems to be where the real threat remains, but I'm not so sure that the man in the middle approach is where the real threat lies. My suspicion is that combinations of phishing and contact centre impersonation will remain the fastest growing threat for some years to come.

Phishing fraud steps up a new level with fake bank IVR & contact centre

I normally focus the blog on Europe, but this story from Australia shows a very alarming new level of fraud. In this case fraudsters have targeted Commonwealth Bank of Australia customers with a fake IVR and call centre.

The story ( fully available at APCmag.com here ) is very worrying. It shows that fraudsters are graduating from e-mail phishing to a far more advanced form of fraud. While the e-mail is still the basic trigger for the fraud, a sophisticated use of VoIP (Voice over IP) and IVR systems is a new development. While most consumers are now knowledgeable enough of the risks of fraud to avoid clicking on e-mail links, phone numbers are much more trusted. This fraud relies on customers trusting local dial codes and the familiarity with entering information into the touchtone IVR system. APCmag describes the fraud as:

"An email sent out on 26th May included a phone number in Brisbane to call to unsuspend blocked Maestro cards, but as of today, the number is disconnected. However, another email received this morning has an 08 area code number that is still in operation. According to ACMA, the number is a GoTalk VoIP number, which anyone could have registered over the web using stolen credit card details. (We've tried contacting GoTalk to notify them of this problem but were not able to immediately reach our regular media contacts.)

We called it, and were alarmed that the computer on the other end recognised the fact that we were keying in bogus numbers — an indication that at a bare minimum, it is doing algorithmic validation of the numbers being entered, and in a worst case scenario is operating a live payment gateway system to immediately siphon funds from accounts."

At the moment, most consumers would see a local phone number and trust that to mean that their call was really going there. Few would understand the potential of Voice over IP to route the call anywhere in the world. Fewer consumers still would understand that an IVR system that answered a phone call and asked for identity verification and card details might not be what it seems.

Like most frauds, this is a clever exploitation of some basic technology, but an exploitation in a brand new way. It may be a one off, but I suspect it may represent a new development as the fight against e-mail based phishing becomes more successful. To date, security in call centre has been focused on internal threats and social engineering attacks (see my posts like "Security, Call Centres and Fraud" and "Call centre worker gaoled for data theft"), but no-one has yet impersonated a contact centre on this scale before.

In my view, it looks as if the ease with which IP protocol allowed websites to be impersonate will become a danger for voice.