An Introduction to Voice Biometrics

An Introduction to Voice Biometrics

VoiceTrust Whitepaper

Top 10 Call Center Trends for 2014

Page 2www.voicetrust.com



Table of Contents

Introduction: The State of Fraud and Identity Theft .............................................3

What is Voice Biometrics? ...................................................................................3

How Security is Compromised Today ..................................................................4

Security Risks of Various Authentication Methods ..............................................6

The Three Biggest Adopters of Voice Biometrics ................................................7

Solutions for Fraud Prevention and Strong Authentication .................................. 8

The Benefits of Voice Biometrics .......................................................................10

About VoiceTrust ...............................................................................................12




Introduction: The State of Fraud and Identity Theft

Identity theft and fraud are on the rise, with at least 44 million personal records compromised around the world in 2012. Over $50 billion is lost each year because of identity theft, with banks, insurance companies, and healthcare providers being the most heavily affected industries. Organizations still use passwords, security questions, and PINs to authenticate their customers. This approach offers weak protection against fraudsters that use stolen personal information to gain unauthorized access to accounts. Voice biometrics is being used to counter this threat with strong authentication to combat fraud and makes identity verification more convenient for customers. This whitepaper takes a closer look at voice biometrics, how it is being used across various industries, and why it offers more secure identity verification than knowledge-based authentication approaches.


What is Voice Biometrics?Voice biometrics verifies a persons identity by analyzing hundreds of voice characteristics, which are more unique to an individual than a fingerprint. It compares a persons voice with their voiceprint, a previously recorded representation of their voice, to confirm or deny their identity. Voice authentication is commonly deployed as an additional security layer, especially for organizations targeted by fraud rings including banks, insurance companies, and healthcare providers. It provides stronger authentication than a knowledge-based approach by verifying people based on who they are, as opposed to what they know.

How Widespread is It? Gartner estimates that there were at least 150 million voice verifications in 2012 in the commercial space, with even more across government and intelligence agencies.




How Security is Compromised Today


Fraudsters are becoming more sophisticated and multiple reports from security providers including Verizon, IBM, and Symantec show an increase in data breaches that compromise millions of personal records each year. The section below outlines the most common ways sensitive information is stolen by organized criminal rings to be used for identity theft.

Data Breaches A recent Verizon report confirmed at least 44 million compromised records and 621 data breaches worldwide in 2012. A variety of techniques such as hacking and malware are used to break into databases and steal personal information for identity fraud. Recent high-profile breaches include LivingSocial, LinkedIn, and EverNote where millions of names, email addresses, and passwords were exposed. The US accounts for almost 50% of the worlds security breaches followed by the UK at 8%. Financial organizations comprise an alarming 37% of all breaches carried out.

Sharing Credentials Over 50% of respondents admit they have shared passwords or PINs with family members, friends, or work colleagues. For example, family members commonly share credit cards to carry out financial transactions. Work colleagues share credentials to access shared files or specific accounts. Credential sharing compromises account security and allows any malicious user in possession of these knowledge factors a 100% success rate of conducting an attack.





Phishing Phishing tricks users into revealing personal information such as usernames, passwords, and PINs. It usually works by sending the victim an email masquerading as a trustworthy company or individual to lure them into providing information. Gartner estimates that 3% of targets fall victim to phishing attacks; the most widely used social tactic by a wide margin. Global losses from phishing are estimated at $1.5B in 2012.

Vishing Vishing involves a fraudster calling a person on the phone to deceive them into providing private information to be used in identity theft. It is a more sophisticated approach that commonly uses a spoofed caller ID purporting to be from a misrepresented organization. It has a lower success rate than phishing or brute-force attacks, but is often used when other methods are not successful.

Brute Force Most authentication methods today rely on knowledge factors such as PINs, usernames, and passwords to verify your identity. A 2012 study by DataGenetics examined over 3 million passwords and revealed the security flaws with knowledge-based authentication (KBA). More than 10% of the passwords were 1234 and people commonly used their birthdays as their 4-digit PINs. This makes it too easy for malicious individuals to compromise these accounts in the call center or online.




Security Risks of Various Authentication Methods

Biometrics such as voice, iris, fingerprint, and face offer the strongest form of identity assurance and are superior to knowledge-based authentication approaches. The table below provides a comparison of security vulnerabilities against fraud for voice authentication, physical tokens, and knowledge factors such as security questions. The ratings below correspond to how often vulnerabilities in each authentication method are compromised:


Voice Biometrics PIN & Password Security Questions Physical Tokens

Data Breach / Theft Low Medium Medium High

Credential Sharing Low High High Medium

Brute Force Low High High Low

Social Engineering None Medium High None

Hacking Low Medium Medium Low / Medium

Phishing Low Medium Medium Low

Vishing None High High Low

High: More than 25% of the time

Medium: Between 5%-25%

Low: Less than 5%

Voice Biometrics Provides Stronger Authentication

Voice biometrics clearly provides stronger authentication than PINs, passwords, and security questions as illustrated in the table above. It integrates as an additional security factor for fraud prevention and risk management, or can be used as a standalone solution depending on requirements.

Source: Opus Research




The 3 Biggest Adopters of Voice Biometrics


Financial Services Banks and insurance companies are the most heavily hit by identity theft and lose billions of dollars each year as a result. According to a Verizon report, 37% of all breaches in 2012 affected financial organizations. Three quarters of executives at 19 of the top 40 U.S. financial institutions say that organized criminal rings are the primary fraud threat in their call centers. They are using voice authentication to combat fraud, protect customer and data privacy, and provide faster service in the call center while maintaining higher security and risk management standards.

Healthcare There were 17 million breaches of patient information in 2011 according to the Department of Health and Human Services. The economic consequences of medical identity theft was over $40B in the US alone. High-profile breaches including almost one million compromised personal health records at the Utah Department of Health in 2012 continue to make mainstream headlines. Healthcare providers use voice authentication to protect private health information and ensure compliance with regulations such as HIPAA. Healthcare providers are looking to secure access to electronic health records with voice biometrics. Physicians and patients are able to remotely access medical records with their mobile device or computer, using their voice as a password for a more secure and convenient process.

Government Voice authentication is being explored by governments to prevent identity theft and corruption in payment programs such as pension funds and social assistance programs which has the potential to save billions of dollars worldwide. It saves citizens from a visit to a government kiosk each time they need to prove their identity because they can authenticate from their phone. This lowers lineups and improves back-office efficiency, protects citizens from identity theft, and make governments more cost-effective.




VoiceTrust Solutions for Fraud Prevention and Stronger Authentication

VoiceTrusts voice authentication solutions offer a stronger and more convenient way to verify user identity and is being deployed in an increasing number of scenarios across industries. The following overview provides some of the more mainstream applications today.


Call Center Authentication Voice authentication helps call centers prevent fraud and verify the identity of their customers 20 seconds faster on average according to Gartner. US call centers stand to save billions of dollars with widespread adoption, considering they spend $12.4B per year on customer verification alone. Almost 75% of financial call centers were hit by organized fraud rings in 2013 according to a recent Aite Group Research report. The added layer of security that voice authentication provides is one of the most effective ways to combat this problem. Customers appreciate faster service and not having to remember PINs and passwords, helping with customer experience metrics such as Net Promoter Score.

Financial Transactions and Payments

Voice authentication makes remote financial transactions and fund transfers more secure and immune to identity theft. The payment industry loses more than $11B because of fraud each year and affects issuers, merchants, and governments. Voice biometrics makes the payment process more convenient to buyers who no longer have to remember multiple passwords, PINs, and security questions for each transaction. High-risk payments and transfers are protected with multiple authentication factors including voice and mobile phone tokens to prevent fraud.




Automated Password Resets

IT helpdesks use voice authentication to automate employee and customer password resets which comprise up to 30% of support ticket volume. This provides significant cost savings considering each manual reset averages $5-$15. Helpdesks are one of the first adopters of voice authentication technologies and often see an ROI of less than a year.

Voice authentication can also be used to reset passwords for online account logins such as Twitter or Google Business Apps. In this scenario the user receives an automated phone call and uses their voice to verify their identity. Voice fits well as part of the multi-factor authentication strategies that are becoming popular with online service providers.


Mobile Application Security Three billion people will be using biometrics on their mobile devices by 2018, generating more than $8 billion in revenue. Voice is a more accurate form of identity verification than the fingerprint scans in devices today and is a natural fit for mobile devices. Voice authentication provides an additional layer of security for logging into mobile, web, and desktop applications. It overcomes the weakness associated with passwords and saves users the hassle of typing long passwords and multiple security questions into their device. The financial sector is an early adopter in this area with various high-profile projects underway to protect access to consumer and business banking applications with voice.




The Benefits of Voice Biometrics


Voice biometrics authentication provides higher security and user convenience than other identity verification methods, especially passwords and PINs. The advantages provided in this section highlight why it is becoming a popular form of authentication.

Your Voice Cannot Be Stolen or Compromised A voiceprint is a representation of your voice characteristics and is stored in database file as a hashed string of numbers and characters. A compromised voiceprint cannot be used for authentication, has no value to hackers, and cannot be used to reverse-engineer someones voice. This makes it immune to data breaches and theft of credentials that compromise millions of identity records each year.

Layered Security Voice authentication fits into your existing security approach either as a stand-alone solution or as an additional layer of security. This makes it suitable for multi-factor authentication which is gaining rapid adoption around the world.

Users Find it Convenient Surveys indicate that consumers find voice biometrics secure and convenient to use. This is no surprise considering consumers are fed up with having to remember multiple PINs, passwords, and security questions.

Stronger Identity Verification and Fraud Prevention Voice biometrics has successful verification rates approaching 100% and has proven to be effective in industries where security is paramount such as banks and insurance providers.





Remote Authentication Voice naturally lends itself to remote authentication scenarios involving a mobile device or computer. No additional hardware is required unlike other biometric methods such as iris scans. The proliferation of mobile phones means billions of people around the world can be verified using this method.

Works In Any Language Voice authentication verifies a users identity within seconds and works regardless of language or accent. This makes it readily available to people around the world and has the capacity to make the world more secure for billions of people.

Flexible Deployment Voice verification can be deployed on-premise or in a variety of cloud settings (private, public, hybrid) to meet the security requirements of any organization. Every aspect of the authentication experience is configurable to achieve the perfect balance between security and convenience.

Immune to Voice Recording Voice authentication prevents replay attacks that use a voice recording to gain unauthorized access. The system can ask for random words and numbers to be provided in a different order to prevent fraudsters from successfully using a recording.



Contact Us

About VoiceTrust

We provide voice biometrics solutions that prevent fraud, eliminate identity theft, and make application logins more secure. Fortune Global 500 clients including banks, insurance companies, call centers, and enterprises rely on our solutions to verify the identity of millions of users. Founded in 2000, the privately-owned company is headquartered in Toronto, Canada with additional offices in the USA, Germany, and UAE. For the latest insights on security and user authentication please follow @VoiceTrust on Twitter, or visit www.voicetrust.com.


VoiceTrust Offices

Corporate HQ - Toronto, ON

Phone: +1 (416) 901-1333 Email: [email protected]

Canada - Montreal, QC


USA - Princeton, NJ


Germany - Munich

Phone: +49 (89) 127 16 0 Email: [email protected]

UAE - Dubai

Phone: +971 4 445 8238 Email: [email protected]

Documents

An Introduction to Voice Biometrics