HSBC will become the first bank in the UK to roll out voice recognition technology for its telephone banking system to every customer, and it has also embraced fingerprint scanners for its smartphone app. But how do they work and are they safe?
How does it work?
It works in two ways. The HSBC and First Direct apps for the iPhone will use the built-in fingerprint scanner within the iPhone 5S, iPhone 6 or iPhone 6S to identify the user – the same way that it is used to unlock the phone and to authenticate purchases through Apple Pay.
Over the telephone, the voice identification system monitors more than 100 unique identifiers in a person’s voice. These include the cadence, accent and pronunciation, as well as sounds that indicate the shape and size of the larynx, nasal passages and vocal tract.
Is it going to make my life easier?
HSBC hopes that voice recognition will remove the need to remember passwords, codes and some of the other identification information currently required for telephone banking.
The Touch ID integration will also speed up logging into the mobile banking app, while helping keep it secure.
How does voice recognition work?
The technology provided by voice recognition firm Nuance builds a so-called “voice ID” from a quick training session, which records and analyses the way people say words, the sounds of their mouth, tongue, voice box and breathing. When the person then tries to log in they are asked to say a few words which are compared to the voice ID.
Can it be fooled by a mimic?
The way a voice sounds to the human ear is very different to the way it sounds to a computer. It may be possible to sound like another person, but it will be almost impossible to recreate all of the 100 or so physical and behavioural aspects of someone’s speech and voice ID.
What if I’ve got a cold and my voice sounds different?
The Voice ID system is robust enough to identify an individual even if they have a cold because it analyses so many markers in a person’s voice. Your accent, cadence, pronunciation and physical attributes do not change even if you’re a bit stuffed up.
The same goes for when you have crappy phone reception, unless the call drops midway through.
What if I’m out on the street or in a noisy office?
Most smartphones have noise-cancellation technology built into them, which removes a significant proportion of ambient noise. The rest is dealt with by Nuance and its Voice ID system, meaning that noise is likely only to be an issue if you’re trying to log in when standing next to an air raid siren or similar.
Do other banks use it?
Other banks, including Barclays, have been using voice recognition for a limited number of customers for a couple of years. Barclays’ system, for instance, is only available to a subset of wealthy customers. No breaches through the use of voice recognition have been reported.
Is your fingerprint safe?
For an iPhone with Touch ID sensors under the home button, the fingerprint is stored securely within an encrypted section of the phone. When the user touches the home button, it compares the fingerprint to those recorded within the phone and then either grants or denies access. The fingerprint is never sent away from the phone or given to any company, not even Apple.
Can you use a dead finger?
No, your fingers are safe as long as the criminal knows the phone works.
The Touch ID sensor uses two methods for reading a fingerprint. It uses a capacitive sensor, which detects the small electrical charge given off by your skin – the same technology a touchscreen uses to detect taps. But it also uses a radio frequency scanner to read the fingerprint on the living tissue a couple of layers beneath the top layer of your skin. This layer can only be read when living, hence a dead finger won’t work, unless it’s kept alive somehow.
Can you hack the Touch ID sensor?
The short answer is yes.
The long answer is that it takes equipment and materials costing more than £1,000, the skills of a crime-scene investigator and a perfect, unsmudged full print from the correct finger you want to replicate. It is not something your average criminal is going to be able to pull off.
What about other biometrics?
Voice and fingerprints are just two forms of biometric identification. Other technologies that are currently in use and in development include:
- Heart-rate recognition, which uses the unique beat pattern of each person’s heart.
- Vein-pattern recognition, which detects the unique pattern of your veins under your skin, typically in your hand, wrist and arm.
- Iris recognition, which uses a camera to photograph the pattern of your iris.
- Retina recognition, which works in a similar way to vein-pattern recognition but within the eye.
Most biometric systems beyond voice and fingerprint have yet to be adopted on a wider scale because they are not as user-friendly, fast or reliable outside of controlled environments.
Other recognition systems have been developed that analyse our use of technologies such as a keyboard, mouse, touchscreen and other input devices. Small variations in the speed, pattern, pressure and usage of these tools can be used to identify an individual, although none have yet been implemented for something quite as serious as banking.
I’ve seen action films where they pull someone’s eyeball out and use it to unlock a vault …
Yeah, that’s not going to happen. Apart from the fact it’s quite difficult to remove an eyeball without damaging it, retina scanners typically need blood flow through the retina to work. Iris scanners also typically include the ability to detect whether the iris is moving – and it wouldn’t if it was disconnected from the body.