Twins spoof HSBC UK AI-powered voice recognition system

An experiment in which a BBC reporter and his twin brother were able to access one of their bank accounts raised significant concerns about the security of HSBC's voice recognition system. The reporter, Dan Simmons, enrolled in HSBC's voice ID service, which analyses over 100 vocal traits to verify identity. His twin brother, Joe, was able to successfully access Dan's bank account by mimicking his voice after several attempts, demonstrating a vulnerability in the system that was not designed to differentiate between identical twins. Introduced in 2016, HSBC's voice recognition technology was promoted as a secure alternative to traditional passwords, claiming that each voice is unique like a fingerprint. However, the incident highlighted that the system allowed Joe to attempt access multiple times, ultimately succeeding on his eighth try. While Joe could view account balances and initiate transfers, he was unable to withdraw funds. In response to the breach, HSBC acknowledged the limitations of its technology and stated it would review and enhance the sensitivity of its voice ID system. The bank emphasised that while twins may share similar voiceprints, the technology has significantly reduced fraud compared to conventional methods like PINs and passwords. Security experts have voiced concerns about relying solely on biometric identifiers for authentication, suggesting that additional verification methods should be implemented to bolster security against such vulnerabilities. System 🤖 HSBC Voice ID 🔗 Operator: HSBC Developer: Country: UK Sector: Banking/financial services Purpose: Identify individual Technology: Voice recognition Issue: Security

Date it happened

2017-05-01

Organisation involved

HSBC

Product, system or model

HSBC Voice ID

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.