As the implementation of voice biometrics has become increasingly popular as a form of identification and authentication, researchers are challenged with determining how users’ voices change over time. New research shows that voices age significantly, even in the short term, making positive authentication more difficult with just voice biometrics alone.
One obstacle making the measurement of voice aging difficult is that every speaker’s voice ages uniquely and at a different rate. There is no universally accepted factor that can be applied to a known authentic recording to compensate for aging.
“Voice biometrics aren’t accurate enough on their own. You have to add other factors like spoofing detection and phoneprinting,” said Dr. Elie Khoury, a principal research scientist at Pindrop, who has conducted a long-term study on voice aging. Khoury delivered an eye-opening presentation on his results at the RSA Conference on February 17.
Biometrics have gained popularity in both consumer and enterprise applications for a number of reasons, specifically their trusted persistence. Most fingerprints and irises don’t change much over time, so these traits can serve as accurate long-term identifiers. But voice is different. Small changes in a user’s voice can have a direct impact on scoring models and result in false acceptances or rejections.
In a two-year study of 122 people — native speakers of English, Dutch, French, German, Spanish, and Italian — Khoury found that the expected error rate (EER) of positively identifying a given speaker increased significantly over time. In fact, the EER nearly doubled over the two-year the study. And it’s not just one trait that changes in a speaker’s voice, either.
“There’s a change in the pitch and the speed of the speech. When you compute the score, it will decrease slowly over time,” Khoury said. “That’s what’s risky for voice biometrics. The score should remain as high as possible for a match. Aging can make false detection or rejection go up over time. And the pitch will change multiple times during a lifetime.”
There also a number of additional factors, besides age, that can contribute to variances over time, including the emotional state, stress levels, health, and vocal effort of the speaker, all of which can have an effect on accurate identification, Khoury said. Compensating for these factors is the challenge for researchers looking to improve the accuracy of voice models.
One way to do improve accuracy is to change the threshold for acceptance, based on the amount of time elapsed between tests. Khoury said updating a model frequently can help account for voice aging. He studied more than 400 recordings of Barack Obama’s public speeches from the beginning of Obama’s first term through the end of the second and found that recalibrating the biometric model significantly reduced the effect voice aging had on the score.
“You can update the model with each new recording, but that’s risky if someone is able to attack the system and compromise the model,” Khoury said.
View the on-demand session:
In an age of such aggressive attacks, voice biometrics alone will not offer the multi-layer approach organizations should implement to fully secure their call center. Phoneprinting provides universal protection for all incoming calls to the contact center, allowing contact center agents to identify unknown attackers on their very first call while also creating a robust intelligent blacklist of known attackers. Contact centers are empowered with the technology necessary to stop fraud loss, reduce operations costs, protect brand reputation and compliance, and improve the customer’s overall experience.
Last week, Pindrop joined nearly 35,000 attendees at the NRF Annual Convention and EXPO in New York City. According to speakers from the event, retail brands will need to focus on their customers, their technology, and their leadership in 2017. Customer priorities are constantly adapting as available technology changes. These new innovations and technical capabilities will continue to transform the retail experience for customers, and brands will need to hone in on how to administer an experience that is not only timely, but also secure. According to Vishaal Melwani, CEO of menswear retailer Combatant Gentlemen, “there will be more emphasis placed on the omnichannel experience as companies continue to look for fresh ways to connect with consumers through the intersection of offline and online” in 2017.
While the retail experience is becoming increasingly omnichannel, retailers are still neglecting the phone channel, the weakest link in security, as a common point of access for customers. Despite the intent to administer positive customer experiences, contact centers agents often fall victim to the methods that enable fraud attacks. Today, Caller ID is freely spoofed and knowledge-based authentication questions (KBA’s) are easily bypassed. Criminals either socially engineer the answers, find them online, or purchase them on the black market. Fraud efforts are becoming increasingly aggressive in their attempts to fool contact center agents into processing fraudulent card-not-present (CNP) transactions.
According to Aite Group, an independent research firm, 72% of executives expect call center fraud loss to continue to grow, with $4 billion in counterfeit card fraud moving into the phone channel. These fraud attacks increase operational costs, decrease customer satisfaction, and jeopardize brand reputation as customer data is repeatedly lost to fraud. Retailers’ existing security systems are not robust or secure enough to handle the increasing volume of data filtering across web-enabled devices and processes. A digitally-influenced retail experience may enable brands to conduct business from a variety of access points, but it is also putting their enterprises under siege. By adopting next-generation security measures, including data loss prevention methods, cloud-based solutions, and contact center protection initiatives, retailers are sheltering sensitive digital content and lessening their exposure to fraud.
Businesses of all sizes need to assess which data is most at risk from a cyberattack and ensure their security solution protects against potential threats. Learn more.
Aite Group, an independent research and advisory firm focused on business, technology, and regulatory issues, interviewed 25 executives at 18 of the top 40 largest U.S. financial institutions based on asset size in order to provide an evaluation of the current state of fraud. New research proves that contact centers are being attacked more than ever before. Aite’s Senior Analyst, Shirley Inscoe, joined Pindrop’s Director of Research, Dr. David Dewey, to discuss the growing threat of fraud in the contact center during this session.
With the rollout of EMV chip cards, fraudsters have redirected their attacks to the contact center for data mining and account takeover. Sixty-one percent of fraud can be traced back to the contact center, but it doesn’t end there – fraud is a cross-channel problem. Many enterprises fail to identify the contact center as the root cause of fraud loss, enabling fraud in others channels, such as debit card, credit card, and check order takeover. Meanwhile, fraudsters are capitalizing on this misdiagnosis and targeting the contact center as the weakest link in security.
Contact center fraud loss is expected to double from $393M to $775M by 2020. As chip cards continue to gain momentum in the United States, organized fraud rings will continue targeting the phone channel, replacing traditional counterfeit card fraud. Current authentication factors in the contact center often fail due to the data fraudsters acquire through social engineering tactics in order to reset account credentials. Armed with data, organized fraud rings probe agents at enterprises for the information they need to access customer funds, and the point of least resistance is often the contact center.
Organized fraud rings are using automated attacks, specifically robotic fraudsters, targeting interactive voice recordings (IVRs), to keep their cost down while still managing to dramatically increase market coverage. Despite the intent to administer positive and timely customer experiences, contact centers agents often fall victim to the social engineering methods that enable fraud attacks. Fraud attacks increase operational costs, decrease customer satisfaction, and jeopardize brand reputation as customer data is repeatedly lost to fraud. Contact centers will continue to enable cross-channel fraud until technology solutions are implemented to thwart it.
Analysts at Aite Group have identified five key security and service steps that legacy solutions are failing to perform. These are the features that are keeping Caller ID, KBA, and voice biometrics from being viable anti-fraud and authentication solutions for the contact center. With 61% of account takeovers traced back to the contact center, this $400 million problem needs immediate resolve.
Protecting personal data in the contact center relies on a best-in-class security solution that benefits both the organization and the customer through:
- Universal Coverage. Customers must be authenticated and fraudsters must be identified on their first call. This prevents fraudsters from being able to enroll as illegitimate customers and alleviates customer privacy concerns.
- Accuracy. The right solution accurately differentiates between legitimate and illegitimate customers. Legacy solutions, such as Caller ID verification and KBA, fail to provide the accuracy needed.
- Speed. Contact center agents must be informed about the legitimacy of callers before they provide access to personal data. KBA takes a long time, which frustrates legitimate customers and offers fraudsters many chances to collect data.
- Low Friction. Customers want service that requires little effort on their part. Most voice biometrics solutions require an enrollment process, which leads to longer call times and lower customer satisfaction.
- Foolproof Technology. Fraudsters are currently using voice distortion, spoofing, social engineering, gateway hacking, and more to circumvent traditional security measures. The right solution needs to withstand these attempts to break through protection.
How do the largest global contact centers stop fraud and protect their customers?
According to a recent survey of 25 executives at 18 of the 40 largest US financial institutions, Phoneprinting™ is the highest ranked contact center anti-fraud solution. Pindrop’s patented technology analyzes 147 different factors in the audio of a phone call in order to create a unique signature that allows contact centers to accurately detect fraud. Avivah Litan, VP Distinguished Analyst at Gartner, describes phoneprinting technology and voice biometrics as “complementary technologies” that mutually benefit both contact center agents and security teams. This phoneprint allows a fraud analyst to create a unique signature for an illegitimate caller, while also determining the caller’s true geographic location, device type, and more. Unlike a phone number or a voice, this information is impossible for fraudsters manipulate. Phoneprinting allows Pindrop’s customers to catch over 80% of fraud calls with less than a 1% false positive rate.
Phoneprinting provides universal protection for all incoming calls to the contact center, allowing contact center agents to identify unknown attackers on their very first call while also creating a robust intelligent blacklist of known attackers. Contact centers are empowered with the technology necessary to stop fraud loss, reduce operations costs, protect brand reputation and compliance, and improve the customer’s overall experience.
1. What are the key challenges of authenticating callers into the call center and IVR channels?
Traditional contact center anti-fraud and authentication methods no longer stand up to the advanced tactics leveraged by today’s criminals. Most contact centers rely on caller ID, a facility that identifies and displays the telephone numbers of incoming calls made to a particular line, but these telephone numbers can be easily spoofed. Contact centers also rely on knowledge-based authentication (KBA), asking questions that only the legitimate consumer can supposedly answer, to identify a caller. KBA has an average failure rate of 10-15%, and this rate can sometimes go as high as 30%. Most of these failures comes from legitimate customers, not criminals. Meanwhile, over 60% of these criminals can successfully answer these questions because of data they’ve already stolen.
2. What are the most effective methods for securing the phone channel?
“We need to reduce our reliance on static data,” says Avivah Litan, VP Distinguished Analyst at Gartner. All of the data compromises from the last few years have resulted in hoards of data being stolen by criminals and put into databases that are being resold to other criminals. Enabling accurate identity assessment in the contact center relies on endpoint-centric measures, which look at the originating call and the originating phone that is making that call in order to assess the legitimacy of the user that’s calling. Litan describes phoneprinting technology combined with voice biometrics as “the strongest method for detecting fraudsters who call into enterprises.”
3. What are call centers most concerned about and how are their needs satisfied?
Contact center and fraud teams have a mutual interest in protecting customers, their data, and the overall security and reputation of an organization. Call center agents aim to provide high levels of productivity and consistent customer satisfaction. Security teams aim to eliminate weak call center authentication processes and reduce dependence on call center agents for screening out fraudsters. Phoneprinting combined with voice biometrics provides user authentication and fraud detection, enabling both contact center and security teams.
The wealth of information housed by contact centers can be leveraged by fraudsters for data mining and cross-channel attacks. In an effort to prevent phone fraud, many businesses implement authentication methods; however, most fail to administer the authentication required to provide a layered defense system. As social engineering and fraud technologies have become more advanced, standard authentication methods have proven to become less sufficient. “You have to assume the criminals can get through one layer [of authentication]; they can get through two, they can even get through three,” says Avivah Litan, Vice President with the consultancy Gartner. “But if you have multiple layers, up to five, and you’re continuously authenticating that user and continuously looking at their activities against their profile, you should be in pretty good shape.”
Multiple layers of security allow organizations to meet regulatory requirements and effectively safeguard customer data. Knowledge-based authentication (KBA), has served as a standard authentication method for years; however, 10-15% of KBA fails entirely, proving that authentication requires another layer of security in order to ensure data protection. A layered approach to authentication starts with “protecting the endpoint, trying to secure the browser, going all the way up to looking at the navigation, building profiles of users and accounts and looking for anomalies, doing that across channels,” says Litan. This kind of identity assessment analyzes endpoint and user data, metadata, and ehavior as it identifies linkages across and between entities.
No singular authentication method used on its own is sufficient enough to keep determined fraudsters out. Creating a layered defense system makes it more difficult for an illegitimate caller to access desired information, such as a physical location, computing device, network, or database. If one barrier is broken or compromised, the fraudster still has at least one more barrier to breach before successfully accessing the desired information. This system ensures that each layer defends the previous layer, making it more difficult for a fraudster to circumvent the security of the entire system.
Fraud poses a substantial risk to the integrity of federal programs and weakens the public’s trust in government. Though government agencies have made great strides in online security over the past few years, they have neglected to implement similar protections for the phone channel.
Fraudsters commonly use the call center as a first step in launching a fraud attack. By impersonating a citizen over the phone, fraudsters are able to gather private financial or personal information. Agencies that hold significant amounts of personal data, like the IRS and Social Security Administration, are particularly at risk.
Today, too many government agencies are relying on outdated Knowledge Based Authentication (KBA) questions as their primary form of security over the phone channel. These questions are ineffective at stopping fraudsters, as recent data breaches have flooded the black market with the answers to these questions. Even when the fraudsters don’t already know the answers, they can use social engineering techniques to bypass security measures.
So what can government agency call centers do to more effectively solve this problem? Pindrop solutions are designed to analyze all aspects of the call to assess the true identity of the caller and detect indicators of fraud. Built around patented Phoneprinting technology, Pindrop analyzes 147 features of the call audio to determine the caller’s true location, device, and risk. Pindrop combines Phoneprinting with reputation analysis, voice biometric blacklisting, and a private enterprise consortium, which allows sharing of threat intelligence across industries.
Government agencies are using Pindrop to avoid data breaches and protect citizen information in the call center, as well as for forensic investigation and analytics. To learn more about how Pindrop is helping government agencies, check out a recent interview with our VP of Public Sector, Eric Forseter in Meritalk.
Aite Group, an independent research and advisory firm focused on business, technology, and regulatory issues, interviewed 25 executives at 18 of the top 40 largest U.S. financial institutions based on asset size in order to provide an accurate evaluation of the most effective technology solutions to protect against fraud. On Tuesday, Aite’s Senior Analyst, Shirley Inscoe, joined Pindrop’s Director of Research, Dr. David Dewey, for an online discussion of the growing threat of fraud in the contact center.
Top 10 Takeaways
- As EMV continues to gain momentum in the US, organized fraud rings will move to the phone channel, replacing traditional counterfeit card fraud.
- The contact center is the cross-channel fraud enabler. Current authentication factors in the contact center often fail due to various data fraudsters can acquire through social engineering tactics.
- The majority of financial institutions (72%) expect contact center fraud loss to continue in an upward trajectory.
- The root source of fraud, the contact center, is often misdiagnosed due to fraud enablement in other channels, such as debit card, credit card, and check order takeover – online fraud that exists from reset credentials being reset by the contact center agent.
- Fraud will move downstream toward smaller institutions and credit unions as phone fraud solutions are integrated into larger firms.
- Organized fraud rings are using automated attacks, specifically robotic fraudsters, targeting interactive voice recordings (IVRs), to keep their cost down while still managing to dramatically increase market coverage.
- In the U.S., Contact center fraud is expected to double to a $775 million problem by 2020.
- 61% of account takeover losses trace back to the contact center.
- For every 1-second authentication is reduced, an organization can save $1 million annually.
- Of the 23 different technology solutions reviewed by leading executives, Pindrop’s phoneprinting and voiceprinting technologies hold the highest combined ranking on industry awareness of the product, overall product ranking, and likelihood of recommending to colleagues.
75% of Tuesday’s webinar attendees confirmed having seen a recent rise in fraud. Contact centers will continue to enable cross-channel fraud until technology solutions are implemented to thwart it. Ensuring optimal protection against fraud in the contact center requires multiple layers of security that provide high coverage, high accuracy, high speed, and low friction without being easily fooled by fraud techniques, such as spoofing, voice distortion, and social engineering. Pindrop’s technology provides multi-factor authentication through layered intelligence scores, reason codes, and risk factors.
Thank you for listening!
Contact center fraud attacks have increased substantially in recent years due to the EMV transition and data breaches. Despite the intent to administer positive and timely customer experiences, contact centers often fall victim to social engineering methods that enable fraud attacks.
Fraud attacks increase operational costs, decrease customer satisfaction, and jeopardize brand reputation as customer data is repeatedly lost to fraud. Aite Group, an independent research and advisory firm focused on business, technology, and regulatory issues, interviewed 25 executives at 18 of the top 40 largest U.S. financial institutions in order to examine the current condition of the market and determine the most effective technology solutions for solving cross-channel fraud.
Current State & Fraud Loss Prevention Highlights
- Contact center fraud loss is expected to double by 2020.
- 61% of fraud can be traced back to the contact center, but it doesn’t end there. Fraud is a cross-channel problem.
- Contact center security vulnerability severely burdens a business.
- The right technology solution provides security without minimizing customer satisfaction.
According to Aite, guaranteeing optimal protection against fraud in the contact center requires multiple layers of security. Since contact centers have been under attack more than ever before, several types of security solutions have been created to solve the problem. Of the 23 different technology solutions reviewed by leading executives, Pindrop’s phoneprinting and voiceprinting technologies hold the highest combined ranking on industry awareness of the product, overall product ranking, and likelihood for referral.
Join Aite’s Senior Analyst, Shirley Inscoe, and Pindrop’s Director of Research, Dr. David Dewey, for an online discussion on the growing threat of fraud in the contact center and the best practices for detection and prevention.
Contact Centers: The Fraud Enablement Channel
September 13, 11:30 AM – 12:30 PM
On Tuesday, Pindrop released its annual Call Center Fraud Report. SC Magazine spoke to Pindrop’s research director, David Dewey about the drivers behind this year’s increase in phone fraud. According to Dewey, new US chip cards make it harder for fraudsters to reproduce phony cards, so the bad guys are crafting social engineering attacks that target call centers in order to make malicious transactions.
Dark Reading spoke to both Pindrop’s David Dewey and Chris Hadnagy, CEO of Social Engineer LLC. Hadnagy confirmed the Pindrop report findings, pointing out that voice represents the next big attack vector. Organizations should expect to see an increase in call center fraud and multi-vectored attacks.
Fox5: ID thief: here’s how to stop me – He would research his victims’ birthday and other personal info already online. Then he’d call merchants who use overseas customer service reps. When he would get the security answers wrong, they’d be more likely to cut him some slack.
Finextra: The Transatlantic State of Phone Fraud – Pindrop’s VP and GM of EMEA, Matt Peachey sat down with Fintextra to discuss the 2016 Call Center Fraud Report released by Pindrop Labs. The report has uncovered a loss at £0.51 to fraud in call centers in 2015.
Pindrop: Pindrop’s 2016 Call Center Fraud Report Reveals 45% Increase in Phone Fraud Attacks – Pindrop today announced research indicating increases in phone fraud incidents and costs in multiple areas in its 2016 Call Center Fraud Report. Researchers at Pindrop Labs analyzed over 10 million calls to major enterprise call centers in the US and UK.
Forbes: The Day I Was Almost Defrauded By ‘The IRS’ – I thought I would know the signs. I have spent years teaching graduate students about fraud schemes, developed fraud training seminars for corporations around the world, and have even conducted prison interviews with convicted white-collar felons.
Security Magazine: Call Center Fraud Attacks Have Increased 45% Since 2013 – Strong online and mobile security, coupled with the rollout of EMV chip cards in the US means cybercriminals are changing tactics, exploiting the weakest link in the organization: the call center. The rate of call center fraud attacks has grown 45 percent since 2013.
FindBiometrics: Call Center Fraud on the Rise: Pindrop – Pindrop, the developer of call analytics security solutions, has released a new report indicating alarming trends in call center fraud. Composed by Pindrop Labs researchers using Pindrop’s Phoneprinting technology to analyze more than 10 million call center calls in the US and UK