The role of voice biometrics in a multifactor authentication solution

1
The role of voice biometrics in a multi-factor
authentication solution
SpeechTek February 21, 2007 Chuck
Buffum cbuffum_at_rsasecurity.com
2
Voice biometrics in the call center

• Why is this worth our attention?

What applications are the best fit?
How should we measure success?
How well does it really work?
Who has already done this?
3
Why?

• Identity theft is a serious problem
• Fraud losses
• Damage to corporate brand
• Erosion of customer confidence

and too easy in call centers

• Increasing government/regulatory pressure
• Increased protection of phone records (Verizon,
  HP, etc.)
• Restrictions on use of full SSN
• HIPAA, SOX, USA Patriot Act

and the FFIEC guidance
4
What applications?

• Business transaction calls are where the fraud
  occurs ()
• Telephone banking
• Order entry
• Loyalty rewards redemption
• Either automated (IVR) or agent handled

• Account info calls are where the identity theft
  occurs (Bad Press)
• Customer service
• Account/order/payment status
• Profile/password management
• Either automated (IVR) or agent handled

• The vast majority of typical call volume

5
Multi Factor Authentication (MFA)

• What you know
• Account number
• Mothers maiden name (MMN)
• Last 4 SSN
• Zip Code
• Date of Birth
• Challenge/Response questions
• What you have
• ANI
• Who you are
• Voiceprint
• What you do
• Behavior patterns

6
How does MFA fit into my call center?
Plug in
Front end
IVR
MFA Server
IVR
MFA Server
Answer call Collect store ANI Collect store
account Present main menu - if low risk
transaction, continue - if high risk
transaction, invoke MFA
Answer call Send ANI
Collect ANI Request account
Collect ANI Collect account Fetch
voiceprint Fetch ANI match Request voice
utterance
Play prompt Recognize account Send result
audio
Collect account Fetch voiceprint match Fetch
ANI match Request content info (zip)
Play prompt Recognize record Send result audio
Play prompt Recognize zip Send result
Match voiceprint Generate auth score Send result
or request content
Collect zip match Generate auth score Send id
auth result
Go to main menu
Continue to high risk transaction Or collect
content for more auth.
7
Measures of success?
Business Goals
Key Metrics
Critical Success Factors
FA/FR Reduced fraud/ID theft Enrollment
rate Customer satisfaction Length of
install Call duration ROI
Multi-factor auth. Compliance reporting Convenien
ce Effectiveness Utilize installed
kit Comfortable dialogs Fair
price Quantifiable benefits
Improved Security Customer acceptance Minimal
disruption Affordability
8
Realistic performance (your mileage may will vary)

• Contributors to voiceprint error rate
• Richness of enrollment
• Richness of verification utterance
• Environmental noise
• Phone-channel mismatch
• Change in voice (severe cold)
• Contributors to authentication error rate
• ANI spoofing
• Content acquisition
• Recorded audio
• Observed field performance
• Voice biometric 4-8 EER (1 FA, 7-15 FR)
• MFA 1-5 EER (
• Customer acceptance very positive IF dialog is
  short and familiar

9
Happy early adopters

• US Bank
• Marriott
• Washington Mutual
• First Horizon
• Visa
• Harvard Pilgrim
• Deutsche Bank

• Southern Pacific RR
• Ameritrade
• Air Canada
• Wells Fargo
• RBOS

10
Summary

• Voice biometrics is a key technology in a MFA
  solution
• Voiceprint technology works and is effectively
  deployed
• Most call center applications are appropriate
• It should be in your planning horizon
• If you respond to the carrot (ROI better
  customer protection)
• Or the stick (emerging regulatory compliance)

11
Thank you!