Security Expert Responds To BBC Fooling HSBC Voice Recognition Security System

The BBC published a story today explaining how one of its reporters fooled HSBC’s voice biometrics security system.  The bank let the reporter’s non-identical twin access his telephone banking account when he mimicked his brother’s voice.  His brother was then able to access his account details and make financial transactions. IT security experts from Aeriandi, Positive Technologies and Intercede commented below.

 Tom Harwood, Chief Product Officer at Aeriandi: 

“Biometrics technology has been widely shown to significantly reduce fraud – but it’s not the whole solution.  And as this experiment has illustrated no security technology is 100% fool-proof. Technology advances have shown that it is now possible to cheat voice recognition systems.  Voice synthesiser technology is a great example.  It makes it possible to take an audio recording and alter it to include words and phrases the original speaker never spoke.  The good news is that there is a way to protect against phone fraud beyond biometrics – and that’s fraud detection technology.  Fraud detection on voice looks at more than the voice print of the user; it considers a whole host of other parameters.  For example, is the phone number being used legitimate? Increasing phone fraud attacks on UK banks come from overseas. Voice Fraud technology has been proven to protect against this as well as domestic threats.”

Alex Mathews, Lead Security Evangelist at Positive Technologies:

“Biometrics were introduced to try and overcome the issue of PINs or passwords that hackers were able to circumvent with alarming regularity. However, as the BBC report highlights, biometric authentication alone can also be fallible.  As is always the case with security, a layered approach is best.  Rather than relying on it as a sole authentication method, it should be used as an additional tool, in tandem with other security practices.”

“Of far greater trepidation is the need to protect biometric databases, which are increasingly considered a prime target for hackers. In 2015, fingerprints of about 6 million officers of US Office of Personnel Management were stolen. Large caches of personal information are always going to be a target for attackers and you cannot change your fingerprints after they are stolen!”

Richard Parris, CEO at Intercede:

“Another day, another corporation revealed as having hackable security systems. HSBC’s roll out of voice recognition technology in lieu of usernames and passwords was a promising step in in the right direction. Yet today’s news serves to highlight that not all biometric authentication is strong or resistant to potential attack. There are two types of biometric identifiers – physiological (based on characteristics inherent to the individual, such as a fingerprint or retina scan) and behavioural (such as typing rhythm or voice). In the case of the latter, behavioural characteristics can change over time, be learned or be mimicked. Therefore, using these as a gateway to accessing customer accounts is risky.

“Most security breaches happen at the ‘front door’ – at the user authentication level. To avoid becoming the next victim of attack, businesses need to change their approach to cybersecurity beyond merely adding more or stronger locks on the door. After all, you could have the valid keys or codes to gain access, but still be the wrong person having acquired them through illegitimate or criminal means. Instead, the priority should be proving the identity of the individual before giving them keys. This means looking at measures that incorporate three distinct elements – possession (something you have, such as a smartphone), knowledge (something you know, such as a PIN) and inherence (something you are, such as an iris scan). This allows businesses to verify that the person accessing the service is who they say they are, in addition to limiting the amount of times an individual can attempt access if any of these elements are missing or incorrect.

“Businesses are quick to think that hacks ‘won’t happen to me’ but it’s dangerous to rely on issues surfacing to highlight and fix underlying problems. A more proactive and robust approach would ensure that management teams aren’t left with some serious explaining to do and compensation to pay out.”