Security Considerations in Voice Authentication

Security Considerations in Voice Authentication

February 11, 2019 by Chantel Strickland

Voice activated shopping services, maps and knowledge banks are everywhere.  It’s extremely convenient to ask a machine to order an extra bag of potatoes while your hands are busy slicing the last Yukon Gold. Unfortunately, the news is also full of stories about toddlers ordering a bouncy house with the use of this technology.  The question is whether this level of convenience can be combined with security1.  

Convenience Versus Security

Advocates of voice authentication believe that security and simplicity really can coexist.  Some of the biggest names in banking have starting to embrace voice recognition, giving the method some serious credibility.  HSBC, Chase and U.S. Bank, among others, are using this type of authentication to gain access to customer services or even check a balance on your Alexa2.

What Are Biometrics?

Voice recognition is a form of biometrics.  Instead of asking you for something you have like an identification card, or something you know like a password, devices using biometrics ask you for something that you are.  This is something unique to you as a human being that no one else has.  The key is finding a way to measure it.

Most of us are probably already using some kind of biometric authentication.  Anytime you use a fingerprint to access your smartphone or login to your laptop with facial recognition, you’re allowing yourself to be authenticated with biometrics.  By analyzing the patterns in your fingertips or the shape of your face, with an exceptional level of detail, machines are able to determine whether it’s really you3.

How Does Voice Authentication Work?

Voice recognition is similar to fingerprinting and facial recognition because, at the core, it is a machine analyzing over 100 unique features of your voice to identify you.  In order to build an individual identifier, the device learns the exact ways that you form your words, the sounds generated by the movement of your mouth, the way you breathe, along with dozens of other characteristics2.

By now you’re probably ready to sign on the dotted line, but is it really safe?  After all, we’ve all seen the YouTube videos of teenagers fooling fingerprint scanners. Several methods of circumventing these technologies have surfaced as mobile devices and payment systems begin adoption of alternatives, but at nearly the same speed updates are released to patch those issues and progressively more sophisticated gadgets emerge from the outliers.

Doesn’t Fingerprint Scanning Do The Same Thing?

There are a few things separating fingerprint scanning and voice recognition that might just help you decide for yourself.  Fingerprint scanning requires specialized hardware.  Voice analysis only requires the existing microphone, meaning it is more cost effective for the manufacturer and, as a result, cheaper for the end user.  Studies have shown that voice recognition, while less accurate under specific conditions, can actually be more accurate than fingerprinting when employed properly with a short, pre-determined passphrase.

Moving At The Speed Of Business

Perhaps the most compelling argument for voice authentication is the ability to use it as a multi-factor option almost simultaneously.  Imagine that you’ve just typed in your username and password on your work computer.  Odds are that your organization has already implemented some kind of multi-factor identity management like a token on your phone.  You now have to wait for a text message to appear so that you can type another set of numbers before time runs out.  With voice authentication, you could have said your passphrase, typed your credentials and already been working 3 minutes ago.

It might be time to make the switch.  Biometric identification methods are already sweeping the payment card industry, mobile computing and end user services.  With comprehensive, end-to-end security requirements becoming a deeper concern for providers and customers it is more important than ever to develop simpler, more streamlined methods of defending against attacks and theft.  Voice authentication may be the answer to making these multiple layers of protection accessible to the widest possible audience.

1Weir C. S., Douglas G., Carruthers M., Jack, M. (2009). User perceptions of security, convenience and usability for ebanking authentication tokens,”Computers & Security, 28(1–2), pp. 47–62. 
2Gibbs, S. (2016, February 19). How safe is voice recognition and fingerprint ID? [Blog post].
3Goodner, S. (2018, November 26). Wondering About Biometrics? Here's Everything That You Should Know [Blog post]. 
4JPMorgan Chase (2019, February 1). Security as unique as your voice [Blog post]. 


Softjourn is a global technology services provider that finds custom solutions for our clients’ toughest challenges. We leverage our domain expertise in Fintech, Cards & Payments, and Media & Entertainment (with a special emphasis on ticketing), to apply new technology that brings our clients' growing needs to life. Contact us to discuss how we can make your idea a reality!