Blog

Choosing your passphrase

If you have a speaker verification system (or plan to implement one) and haven’t decided on a passphrase yet, the following may be of interest.You’ve probably seen the advert where the little kid says “my voice is my password” to access his phone. For secure applications, this isn’t necessarily the best idea. Commonly spoken phrases, by their very nature, are easily predicted and susceptible to spoofing attacks by hackers. Similarly, using the same passphrase for all your applications (contact centre solutions, IVR systems, mobile apps etc) is akin to having the same password for everything. Not a good idea. Granted, it’s not quite as bad as having "Password" as your password. The biometric component of speaker verification adds a much-needed degree of added security. Of course, it’s unlikely that your corporate security policy would permit use of the same passphrase by every user, across multiple systems. Ideally, your speaker verification system should be flexible enough to allow users to choose their own passphrase.

What makes a good passphrase?

In a text-dependent system (i.e. one that is reliant on a specific phrase or sequence of words), you should be looking for a unique arrangement of words that takes about 2-3 seconds to utter. We recommend a phrase with a minimum of four syllables; something that is both easy to say, and easy to remember. This is enough to create a viable voiceprint when enrolment involves the analysis of several repeats of the same passphrase. From a security point of view, try to avoid a passphrase that might be easily associated with you as an individual. Social engineering is a popular identity theft tool, so avoid something predictable like your home address. In a text-dependent system, very few phonemes (the distinct, audible sounds that comprise a language) are needed, if you have enough samples. NB: although the English language has 26 letters in its alphabet, it has 44 phonemes. If you are enrolling via repetition, repeating the same sounds within the passphrase is not a bad thing, because we do not always pronounce them in the same way.

Enrolment vs. verification

If you are using a text-dependent passphrase for verification, it makes sense to use the same phrase for enrolment. However, if you are implementing a text-independent system, the ideal enrolment would involve attaining a greater degree of phonemic content (sounds), repeated in many different contexts. In the case of a text-independent system, enrolment data will need to be detailed enough to cover all the sounds expected to be encountered during verification. Recordings with lots of syllables will generally produce more precise models and better verification accuracy. It is rare for one party in a telephone conversation to speak continuously for more than 10 to 20 seconds. So, enrolment recordings should be comprised of multiple, shorter passages; captured throughout the duration of a conversation. Verification is then achieved during extended dialogue between the caller and an agent or through spoken responses to an IVR system, rather than by repeating a specific passphrase. If you are implementing a text-prompted system, where the response will also be recognised using ASR, several examples of each possible prompt will be required for enrolment. If your prompt is to be a random, 4-digit sequence of numbers between 1 and 9, enrolment should consist of repeating each number several times. Counting from one to nine and back again in separate recordings will suffice. Your choice of active or passive enrolment is likely to be determined by what is most practical at the time of enrolment. A passive enrolment, where enough audio is captured during a conversation, may be more natural experience but a less practical one. Multiple repetitions of a four second active passphrase or number sequence is a more artificial, but efficient process. Find out more information on speaker verification and authentication, check out our Look who's talking white paper.

An introduction to voice biometrics

I know who I am, but can I prove it? A person’s identity sits at the very core of their existence. I don’t mean from a metaphysical point of view, but from an everyday, practical perspective.Our ability to prove our identity governs everything from our ability to go on holiday to accessing our place of work or simply paying our bills. Our identity is a power thing. It has great value. Which is why is has become a valuable commodity for criminals, cyber or otherwise.  It’s no surprise that data breach statistics for the past five years reveal identity theft is the motivation behind over 60% of stolen records. In a security aware environment, the burden of ’proof of identity‘, naturally, becomes more onerous. That burden becomes greater still when we introduce distance into the equation. A single reference point is no longer enough to prove who we are in many applications. Multi-factor authentication has become the new standard for everything from remote access to business applications to caller identification in contact centres. Two-factor authentication typically comprises something you know, such as a password or a PIN, and something you own (a mobile phone or a pass card). With the emergence of mainstream biometrics, multi-factor authentication now involves something you are! Fingerprints have been used as a form of identification since the very end of the nineteenth century. One hundred years later, facial and iris recognition technologies came to the fore, but there are impracticalities associated with all those methods of identification. If biometrics are to be used for mainstream identification purposes, they need to be used in conjunction with ubiquitous technology. What’s more ubiquitous than the telephone? After all, two-thirds of the world’s population, or 4.8 billion people, own one.Despite living in a multi-channel world, the majority of contact centre engagements are still via the telephone. It just makes sense to leverage voice as a means of user identification and verification. Our voiceprint is as unique as our fingerprints. Instead of swirls and ridges, it’s everything from our physicality and idiosyncratic articulatory movements to our dialect or regional accent that makes us sound different. Our voiceprint is the result of a detailed statistical analysis of all those variables. It is stored as characters encoded in a manner similar to one-way encryption. So, from a security perspective, it’s not possible to recreate (or reverse engineer) a spoken reference from a discrete voiceprint file. Establishing a voiceprint can take the form of a prompt and response session with a customer, using a pre-determined set of phrases that cover the primary sounds of speech. Alternatively, a profile can be built up over time, during the course of a natural conversation. Once created, a voiceprint is used as a biometric reference that has significant implications for fraud prevention. Passphrases can be lost or stolen. Whilst it’s possible to lose your voice, it’s much harder to have it stolen. Find out more information on speaker verification and authentication, check out our Look who’s talking white paper. Download white paper

The kiss of life for speaker authentication

I heard two people talking in the pub the other day. One asked, “what was the name of the person you first kissed?” I’d like to point out that I wasn’t eavesdropping; I just couldn’t help overhearing.The point is, it reminded me of the list of security questions I was faced with recently when signing up to an on-line service. I don’t remember all the questions on the list, but I do remember not having an answer for any of them! I thought at the time, if I can’t provide an answer now, how am I going to remember the next time I face an interrogation. I’m sure you’ve all had a similar situation, when you’re on the phone to your bank or insurance provider, and you can’t remember the answer to your security question. There must be a better alternative. Well, there is. Voice biometrics offers a solution through the deployment of automated speaker verification. We’ve probably all got an IVR horror story, whether it’s Alexa getting it wrong or the phone not recognising who you’re trying to call. However, the technology is here to stay. Contact centre managers are always looking for ways to maximise the self-service functions of the IVR front-end. Incorporating identification and verification (ID&V) as an automated process within the IVR is an idea that has matured, because of what it offers compared to agent-led ID&V. If speech technology, in the form of automatic speech recognition, was the revolution that overthrew dual-tone multi-frequency input, automatic speaker verification (ASV) is the evolution that will supersede agent-led ID&V. Verifying by voice will become as commonplace as navigating your way through an IVR menu, but it will be less stressful.There are several benefits to be gained from deploying an authentication system based on voice biometrics, not least of which are speed, convenience and security. Furthermore, speaker verification is completely natural and instinctive for the user, which means that security no longer comes at the expense of convenience. Customer engagement is important. A poor experience has a negative impact on both customer loyalty and agent morale. For every customer frustrated at having to remember the answers to random questions there is a customer service agent equally frustrated by repetitive workflows and barriers to excellent customer service. A return on your investment in ASV should be both rapid and sustainable. If you consider a range of contact centre metrics, including average handle time, cost per call/transaction, adherence to schedule, etc. the impact of reducing time spent on agent-led ID&V is obvious. Eliminating the Spanish inquisition at the beginning of every call by using ASV means more time spent engaging with callers. A reduction in call time results in a reduction in cost per call. For high volume contact centres, the potential for cost savings is significant. With identity theft and fraudulent account access on the rise, adding voice biometrics as a part of multi-factor authentication significantly lowers the risk of unauthorised user access. If you weigh up the costs associated with fraud remediation, the return on investment in ASV is even greater. To discover more about speaker verification and authentication, check out our VoiSentry product sheet. View the product sheet

Making the most of voice biometrics

So, you’ve made the decision to invest in voice biometrics to help improve customer experience and mitigate the risk of fraud. How can you make the most of your investment?Step one is to have a robust enrolment process in place. Ironically, this starts with being able to confirm the identity of everyone you want to enrol in the first place. Once you know who you’re talking to you’ll need to decide how you will capture the individual voice samples needed for the voiceprint. Enrolment is an important part of a robust voice biometrics solution. You need to make sure that the reference samples are as “clean” as possible, with little or no background noise. The most common use of voice biometrics is in telephone engagements, so it makes sense to use the phone to capture voice samples. The phone in question can be a mobile, landline, VoIP or even a softphone using a laptop or PC microphone. However, because quality and clarity are important, you should avoid using a speakerphone. Speakerphones are designed to pick up ambient sounds and create echo, both issues that will interfere with creating a suitable voiceprint.

Consistency is key

If possible, stick to the same type of device for creating all your voiceprints. If this isn’t possible, train the system to use all the different devices users may employ for enrolment. Once a caller has been successfully enrolled and verified, it’s best practice to update the speaker’s model. The decision to update or not will be based on several factors; including verification results, the desired level of security and any additional risk factors. If necessary, authentication by other means should be conducted prior to updating with the verified audio. You may think that getting each user to record their voice for enrolment in a soundproof room, using a professional quality microphone, will give the best results. However, that will not be representative of real-world use of the system, where users will be calling in over the phone. Biometric voiceprints are a special category of personal data, as defined in the General Data Protection Regulation (GDPR). This means you cannot capture audio data from your callers, for the purpose of creating voiceprints, without obtaining explicit consent from each user. Getting that consent provides you with the opportunity to give specific guidance to each user. As callers are participating knowingly in the enrolment process, training the user to interact with the system will have a positive impact on future authentication results. You should be explicit with your instructions and encourage behaviour that achieves the best results. Adapting your IVR to provide prompts to guide callers through the enrolment process is essential. Also, providing users with a quick reference guide to the process makes a lot of sense. Provide enough detail on the process, so users understand the need to capture a good voiceprint and what good looks, or rather sounds like. Users should be encouraged to speak naturally, at a conversational pace. Voice biometrics analyses multiple components of a person’s speech, including pace. So, speaking at your usual pace is necessary to ensure the system better differentiates correct users from impostors. By acting on these tips, you will increase the effectiveness and efficiency of your speaker verification solution and ensure both you and your customers realise the anticipated benefits. Discover how iTel is leveraging voice biometrics for authentication in a workforce management application. View I-Tel case study

How to leverage voice biometrics to boost the value of your solutions

The regulatory landscape and the cost of fraud are making organizations increasingly aware of the need for strong authentication, and what that means.

Biometrics are being adopted by organizations across a broad range of verticals to secure the voice channel. In many cases, however, how to take full advantage of voice biometrics is not clear to either the organization implementing the technology for the first time, or the OEMs and system integrators who are delivering it.

Voice is widely expected to grow as a preferred method of interaction for a range of use cases, not just in the contact center. Examples include workforce management applications like time and attendance for industries such as utilities, engineering maintenance, or environmental management; correctional facilities; healthcare (including telehealth); and finance. The EU’s new PSD2 regulation requires two out of three authentication factors to be used for strong customer authentication for financial transactions over a certain amount. Voice biometrics is ideally suited for use in such a multi-factor authentication scenario for authenticating or verifying identity over the phone.

Voice biometrics can be deployed for any service delivered over the phone that requires authentication to deliver five major advantages, including improving the customer experience (CX), fraud risk mitigation, enhanced brand reputation, improved workforce morale, motivation, and staff retention, as well as higher success in a range of contact center metrics and key performance indicators.

In Aculab’s “VoiSentry – How voice biometrics can boost the value of your solutions” webinar on May 23, 2019, you will learn about:

• The case for change – how biometrics addresses the challenges of knowledge-based authentication (KBI)
• Core concepts – the essentials for understanding the technology
• Case study examples – how voice biometrics delivers results
• Designing for customer adoption – how good design overcomes end user challenges
• Beyond the ROI – how to position voice biometrics to your customers

 

The webinar will feature SymNex Consulting Founder Matt Smallman, who works with customer centric organizations including Fidelity Investments and Lloyds Banking Group to help the maximize the impact of voice biometrics. He has been featured by the BBC, the FT, and the Wall Street Journal after leading the ground-breaking implementation of voice biometrics at Barclays Wealth division. Smallman will be joined by three experts in voice biometrics from Aculab.

Register for the webinar here.