Make The Case13 chapters

Implementing Voice Biometrics: Realities vs Myths

The truth about implementing Voice Biometrics today, as industry experts bust common myths. Ideal for decision-makers reassessing the technology.

Implementing Voice Biometrics for caller authentication in enterprise contact centres not only streamlines agent workflows by reducing time spent on security procedures but also offers a robust defence against fraudulent activity and eliminates significant points of friction for customers. A decade ago, when some of the world's largest corporations began embracing this technology, they paved the way for quicker, easier, and more secure customer interactions. This naturally sparked interest among other organisations keen on following suit.

However, for many reasons, implementing Voice Biometrics on top of legacy call centre technology stacks took a lot of work, and for many, the benefits were not worth the effort. This often left organisations struggling to make a viable case for adoption, causing many to stall before they could even take the first step. Matt Smallman, who formerly led Contact Centre Strategy and Change at Barclays, and Brett Beranek, General Manager of Security & Biometrics at Microsoft, were at the forefront of these initial efforts and have been leading the implementation of Voice Biometrics ever since. In this session, they bust common Voice Biometrics myths and explore why, with today's advances in both Voice Biometrics and call centre technologies, now is the optimal moment to reassess the value and feasibility of Voice Biometrics for your organisation.

In this session, they debunk three prevalent Voice Biometrics myths:

  • Complexity: Dive into how current advancements in contact centre technology have significantly simplified the integration of Voice Biometrics, making it a seamless addition to your call centre operations.
  • Performance: Understand how modern Voice Biometrics systems require just a few seconds of audio to authenticate callers with unparalleled accuracy and reliability.
  • Cost: Discover how the rise of cloud-based Voice Biometric solutions has led to a pricing model that aligns directly with the value delivered, making it an increasingly cost-effective option.

If you've considered Voice Biometrics in the past or previously ruled it out for your call centre, now is the time to reevaluate your stance.

Transcript

34 min read

Matt Smallman

Okay. Good afternoon everyone, and thank you very much for joining us this afternoon. It's just gone one minute past four, so I think it's time we make a start. My name is Matt Smallman. I'm the author of Unlock Your Call Centre, which is just positioned just here, and the founder of the Modern Security Community.

My work day-to-day is helping organisations improve the usability, efficiency, and security of their call centre security processes. And today we're hosting a session where we're gonna talk about the realities of implementing modern Voice Biometrics security solutions. And why do we need to do that?

Well, in my conversations with organisations and call centre and contact centre leaders across the world, it's become really clear to me that many people's perceptions of this technology may not be up to date with the current best practices.

0:49 Introducing Brett Beranek

Matt Smallman

And therefore I'm delighted to be joined today by Brett Beranek, who's joining us from Montreal in Canada.

Hi, Brett.

Brett Beranek

Hi, Matt.

Matt Smallman

Who is the lead for Biometrics and security at Nuance, was Nuance and now Nuance, a Microsoft company. So Brett, why don't you introduce yourself and just tell us quickly how you found yourself in this field to start with.

Brett Beranek

Yeah, absolutely. Thanks, Matt. Thanks, Matt, for having me on the webinar.

I am truly thrilled, and before I introduce myself, I will give a little plug for your book. So I was very thrilled when you published it. And I've made it mandatory reading for any employee that joins the Security and Biometrics team, 'cause I just find it's very well written and very comprehensive.

So great work, Matt. So I lead the Security and Biometrics business here at Microsoft, formerly Nuance, part of the AI contact centre group. And I've had the pleasure of directing the product strategy, the R&D strategy and the go-to-market strategy for the voice biometric product line at Nuance, now Microsoft, for the last 12 years.

I'm an expert in the biometric space. This has always been a passion of mine. Started a little over now 20 years ago in this space. And I'm really thrilled by today's topic because I think it is apropos. 20 years ago this was a science project, and now it's a very mature field.

And hopefully we can answer some of the questions that have come through so far. Matt, I know you went out and reached out to the community and you've received a lot of feedback, so hopefully you can bust some of the myths that still persist in this space.

Matt Smallman

Thanks, Brett. I think we're just having a bit of trouble with your audio again, so I dunno if anyone on the chat can just let me know whether they're experiencing the same issue as me or not.

But we might try and get that fixed, if it might just be my dodgy headset. Brett, just before we jump in, like, how did you find yourself in this field? Like, at university, wait, is this the thing I want to do, Voice Biometrics? Or how did you stumble into this occupation? I think you were telling us about your aspirations to be a Mountie. I think I heard that correctly.

Brett Beranek

That's right. Yeah. I wanted to be an RCMP officer. For those of you who are not familiar with Canada, it's our version the FBI, but they do wear these nice uniforms and ride on horses from time to time.

And I realised that I could apply both my passion for crime prevention and my passion for technology in a different way. And that's how I ended up in the technology field. So, decided to focus on biometrics, and here I am at Microsoft helping organisations fight fraud and improve authentication.

Matt Smallman

I think one other before we jump in. What would you say has been your biggest, most greatest professional achievement in this field? What gives you most satisfaction?

Brett Beranek

Yeah, Matt, and my response I think will be very logical with my origin. So whenever I see a customer of ours that is using our technology identify fraudsters, and then work with law enforcement to identify the individual and ensure their arrest and prosecution, that just gives meaning to what I do.

And I think it gives meaning to the entire team that is working on this product. And it motivates us to wake up early in the morning and work long hours and make sure that our customers have the best technology in their hands.

Matt Smallman

Awesome. That's great. And I said I won't embarrass you, but a mutual friend of ours, Dan Miller, shared, I think, a webinar you must have done like seven, eight years ago with him, which has a much younger-looking version of your face on the front page.

But I think at that time, we were close to a hundred million voice prints enrolled. And I think the projection was by 2020, 2021 that we'd be looking at close to half a billion. How close are we? Have we exceeded that?

Brett Beranek

We've definitely exceeded that number. And I can only speak to the data that we have here at Microsoft.

But what we've seen is very large organisations as well as small organisations adopt this technology, and I used to use the term democratising the tech. And I feel that over the last couple years, as the technology has gotten into the cloud and has been accessible to smaller organisations, we've definitely seen increased adoption.

It's allowed a lot of consumers across the world to use the technology to authenticate. But sometimes it's also used in the background without them even being aware, from a fraud prevention perspective.

Matt Smallman

Awesome. No, I think that's great. Great to hear that there are just so many people using the technology, and not just for authentication.

So we're gonna jump into our main topic areas, and we'll try and weave in people's questions as we go. But if you have other questions, you want to throw them in the chat, particularly on the website. I have this up on my screen so I can weave them into the conversation as we go on.

6:11 How hard is it to integrate Voice Biometrics to the call centre?

Matt Smallman

So the first area we were gonna talk about was complexity, really. And when we talk about all of these subject areas, we're gonna look a bit at what was true, what's true now, and what does that really mean for organisations thinking about implementing this technology. And the first is around integration complexity, and I personally, I didn't have any grey hairs before I started

thinking about implementing Voice Biometrics. I think got too many just now. But I certainly remember, a decade or more ago, when putting in my first implementation of this, we had to buy extra routers because the routers we had didn't manage port spanning, and we had to reconfigure our entire network just to be able to listen to calls for passive voice biometric authentication.

We found some weird oddity where, like, a third of our calls were routed through a server that happened to sit underneath someone's desk in Jersey for some reason. And a whole bunch of complex, challenging integrations that made testing and delivery really challenging. And I'm just not sure that, that certainly hasn't been my recent experience.

I dunno about you, Brett. What's true today for complexity of integration?

Brett Beranek

Yeah. Yeah. And that's one of the surprising things for individuals who are not familiar with this space, is that the most complicated aspect of deploying biometrics in a contact centre historically has been, how do you get the audio?

How do you get the audio from the contact centre to the Voice Biometrics solution? And Matt, your experience back in the day is unfortunately indicative of how many organisations have to tap into audio, right? Which was with hardware, right? So it required acquiring new devices, right? Whether it was routers or SBCs, right?

Whatever that hardware component was. But you needed to find a way how to send the audio. And then once the audio was sent over, there was a need to actually integrate to the contact centre platform. And that was the second challenge. And so many organisations were several months into the journey of deploying Voice Biometrics without actually having performed a single biometric transaction.

Right. And that created a lot of frustration. And so the good news is that today that is gone, with contact centres that are in the cloud. So CCaaS solutions, sending audio to a third-party solution such as a voice biometric platform, is as simple as flagging it with an API call, right, or initiating an API call.

And fortunately organisations like Microsoft, but also others in this space, have created out-of-the-box integrations to the major CCaaS platforms. And so really that audio, that data is flowing bi-directionally, instantaneously, out of the box. So you can start using the solution just with a couple of clicks.

Instead of getting heart palpitations trying to figure out how to acquire and deploy hardware in physical contact centre locations, which sometimes can be quite challenging.

Matt Smallman

Just to reiterate that, I think it comes back to democratisation points, like finding the audio in the network used to be some sort of black art where only a few of the high wizards of networking were able to identify where it was, using packet sniffers and all sorts of stuff to try and figure it out.

Whereas today most developers will be able to read the documentations of the API and make it work with a bit of trial and error in a few hours, with very little need for extra support or extra skills and experience beyond what an engineer would normally have.

Acquisition of audio, as you say, is pretty much a solved problem now.

Read the full transcript (34 min read)

10:06 How easy is it to implement the right Business Processes for Voice Biometrics?

Matt Smallman

One of the areas that seems to be less solved, however, is the business processes. And I think for me, that's certainly the area where the biggest challenge I see in implementation is like, okay, so we know the underlying technology works.

We can get the audio and we can run biometric transactions on it, but figuring out how to fit it in our business processes, our agent desktop, how we manage consent, how we ask consent, which customers we're gonna ask. All of that extra complexity still exists, doesn't it?

Brett Beranek

It does. But, unlike organisations that deployed Voice Biometrics several years ago, there's a lot of knowledge out there, whether it's with individuals like yourself, Matt, who have that experience and they can share it with others, or coming from vendors such as Microsoft that have worked with several customers.

There's no need to start from scratch and ask fundamental questions about how to enrol, how to collect consent, because many others have gone through this process and many others have solved this. So I know back in school it was forbidden to look at somebody else's paper and get heavily inspired from what they're doing.

But I think in the business community that we should be doing that, we should look at what our peers have done. And yes, maybe tweak it. Maybe augment it, right? Adapt it to how things operate within specific organisations, 'cause, full transparency, there are differences, but there's no need to start from scratch.

So, Matt, I know that you've been very instrumental in helping organisations, right? Getting them on the right path. And I think it just makes a ton of sense to tap into that knowledge.

Matt Smallman

My book's gone out shot, but there's a starter for 10 in the book, but I think that's absolutely true.

I remember, pull up a sandbag and listen to a story for a second. But back in 2010 or so, when we first talked about implementing this technology in the UK, we had to engage with regulators. We spent several months doing customer focus groups to figure out whether they would actually use it, what was the right way to ask them, how did they want to, how it be approached about the service.

And whilst that was really valuable and it did help us implement the technology at that point, it was against a different cultural context, but also an unproven technology. So it was worthwhile at that point. But certainly in my more recent work, whilst we often start with a blank sheet of paper, because that's probably the best way to do it for most organisations, actually, we do find ourselves coming down to one or two very, very similar patterns.

So I would completely reiterate the copy with pride ethos there, that, yeah, the patterns exist, and now it's about customising those patterns rather than starting from scratch. That's a great point.

13:15 How much audio is really needed to enrol and authenticate a customer with Voice Biometrics?

Matt Smallman

Moving on then, conscious of time. The other area that people often think about is performance.

And I think about performance in a couple of different dimensions. So the first area we're gonna talk about is core performance of the underlying biometric engine. And I remember, it's not my history lessons here, but there was a lot of scepticism originally about this technology.

It wasn't good enough. The failure rates were too high. It wasn't accurate enough, it wasn't secure enough. And those to some extent were valid maybe a decade ago. And to get it to a performant level required quite a lot of work. And there was a certain degree of chicken and egg. Like, I need to get some audio from my customers in order to figure out what they sound like so I can be sure the system's secure.

But I can't really ask my customers for audio until I've got them something to use. So we used to see quite long periods of friends and family testing or limited pilots, where we were capturing audio in order to tune and calibrate the model so we could be confident enough to launch it to the general public.

But I just don't see that being the case anymore in the more recent implementations I've worked on. How has the technology improved, Brett?

Brett Beranek

So, Matt, the technology has improved in leaps and bounds. And when I started studying Voice Biometrics, the state-of-the-art technology was able to authenticate somebody with freeform speech, right?

So the conversation that we're just having right now, with 15 seconds of net audio, which, if you're rambling like I do, it's maybe 30 seconds before you get to that 15 seconds of net audio, because we always have some pauses, right, in our speech. And enrolment required easily 60 seconds of net audio in order to create a voice print.

So that worked for a handful of organisations, right? The organisations that were willing to make the investment to change their business processes to get to that data. But it was very hard to adapt this to all organisations, especially to organisations that needed to apply this in self-service channels, right?

So in a contact centre, right, in the IVR, technology was challenging, at least if you were using the freeform speech. And so, Matt, you'll remember a lot of organisations try the active Voice Biometrics technology that required the individual to speak a specific phrase.

And that wasn't the most customer-friendly approach to using the tech. And so fast forward to today, where we're using deep neural networks in order to enrol somebody in Voice Biometrics and validate their identity, we're able to authenticate somebody in easily a fraction of a second or one or two seconds of net audio, and enrol them with as little as five seconds of net audio, which makes the application of this technology in self-service channels viable.

And makes the application of this technology at the agent level, right, where there's a live conversation with an agent, so much more efficient. And so that has opened the applications for Voice Biometrics to beyond just the contact centre. And we're starting to see organisations expand it to mobile apps and a step-up authentication in the web and even in brick and mortar locations for in-person verification.

Which are applications that would've been extremely awkward 10 to 20 years ago with the amount of data that was required.

Matt Smallman

A couple of points to build on there. So first about the duration, and I still get this challenge today really about what happens if we don't have an authentication result by the time the agent needs to do something.

And I think from what you are saying, that just shouldn't be an issue anymore. We should always be able to get some form of results before the agent needs to do anything. Is that what you're saying?

Brett Beranek

That's exactly it. It's lightning fast. In fact, when there's an agent that doesn't get that virtually immediate green light telling them that this is the right individual, then instinctively that agent will know that the person on the line is not the correct person.

17:47 How quickly can we be up and running with Voice Biometrics?

Matt Smallman

So I was just gonna build on two issues.

So one I think was the tuning and calibration discussion, and this is often that chicken and egg debate. And I think we're in a state now where actually in many cases these solutions are good enough to use out of the box, and it's a case of validating the settings more than it's optimising or configuring them for your particular environment.

So would you agree?

Brett Beranek

Yeah, absolutely. And that has enabled organisations that have no internal expertise in biometrics at all to use this technology and not have to rely on outside experts, such as those that come from organisations like Microsoft, to tune and calibrate biometrics, which is a fine art.

And we call them speech scientists. These are individuals that take data, that perform tests, and that then analyse those tests to calibrate biometric engines. And so those individuals are still around. They can still be leveraged to achieve optimal performance. But for the great majority of organisations, the performance that exists out of the box is more than sufficient.

And so a lot of mid-size organisations that have deployed Voice Biometrics today are using the settings, the biometric settings that exist in the product, without any modifications at all. And that is a testament to how mature the system is and how the technology has become. Matt, you'll remember that back in the day, right?

So maybe a decade or more ago, using a biometric tool out of the box without any tuning calibration was akin to using a product that was providing virtually random results. And so vendors very,

Matt Smallman

I think it was probably career suicide.

Brett Beranek

Yeah. So vendors, I think, were very open and transparent about that, and that's why the use of speech scientists in order to perform that tuning and calibration was mandatory.

And so it's no longer a mandatory step. Now it's an optional step in order to squeeze out just a little bit more performance out of the algorithms. And, as I said, that the ROI on performing that step only makes sense for very large organisations who wanna squeeze out maybe an extra percentage point out of the system.

Whereas an organisation that may be performing hundreds of thousands of verifications per year, it just doesn't make a material difference to perform that step.

Matt Smallman

Awesome. And I think that was on my feature request list for probably most of the last decade, so thanks very much for delivering on that.

20:35 Do we need to decide between active and passive technologies when implementing Voice Biometrics?

Matt Smallman

Just on the other point you made about active versus passive, that was something that a lot of people got hung up on maybe five, six years ago. We often didn't get off the start line with projects 'cause we were having this debate about should it be active and go in the IVR, should it be passive and go with the agent? Should we try and do both? Is it too complex to try and do both?

Has that debate been finalised? Are we passive all the way? Passive everywhere, I think one of your colleagues called it a few months ago.

Brett Beranek

Yeah. I think there are only a handful of organisations that are still operating as they did originally when they deployed these solutions that are still using active Voice Biometrics.

But there's no need for active anymore given the efficacy of passive Voice Biometrics. So the ability to authenticate somebody with extremely short segments of audio in a very accurate and secure way makes that technology obsolete. So for new customers, for organisations that are looking into this technology for the first time and that are thinking about deploying it, it is indeed, that debate is no longer found.

Awesome.

21:43 How do you prevent synthetic speech and deepfakes compromising Voice Biometrics?

Matt Smallman

And here we go with the almost poisoned chalice topic of the debate when we talk about performance. Like, there's obviously the core biometric performance, and that was a focus for an awful long time. And then there were all these other things that came along with the engine, such as recording and playback and even synthetic speech detection, which were always something we talked about during implementation and did our risk assessments and determined that actually no one was gonna attack it in this way because the technology wasn't valid, the technology wasn't effective. And it just wasn't worth the customer experience cost of doing that. That clearly is no longer the case. And a lot of questions coming up from our audience about what Microsoft and Nuance are doing to keep ahead of that deepfake audio threat.

And how should that be considered in the context of performance overall?

Brett Beranek

Yeah. Matt, you're, rightfully so, bringing this topic up because it is on everybody's minds these days. And so I was speaking earlier about the performance enhancements of Voice Biometrics, that is rooted in enhancements in deep neural networks.

And those same foundational technology improvements have also been applied to other technologies, such as the generation of synthetic voices, right? So deepfakes, Matt, as you mentioned them, which is the nefarious use of that technology. And so the good news here is that we've always considered this as a potential threat.

So whether a presentation attack used a recording or a synthetic voice, we were always prepared for that type of attack from a technology perspective. Now, most of our customers did not implement these algorithms because once they performed their risk assessment, they determined that there really was no need for them, given that there was no attacks using synthetic voice, given the immaturity of the technology.

About a year and a half ago, there are some vendors that launched their solutions online that allowed the creation of synthetic voices with very little audio input. And that provided a GUI that was quite easy to use, so you didn't need to be a programmer in order to create your synthetic voice.

And so that's changed the game. So we saw a lot of media attention on this topic. We saw some journalists synthesising their own voices to try to get into their own accounts.

And fortunately, even for organisations that were running older technology and that had not enabled these protective layers, the technology actually performed quite well, given that these journalists were unsuccessful in their initial attempts and had to try again and again, again.

Eventually they were able to get through. But that did create some panic for sure. And we've been working very hard to reassure customers that they have the tools at their disposal to address this attack.

And one of the best ways to stay ahead of the game, so to speak, right? So to stay ahead of the fraudsters, is to leverage a cloud version of the solution. And the reason for that is that the onus on updates and upgrades is on the vendor, right? Instead of on an internal IT organisation.

And so, Matt, I was talking about some customers out there that are still using active Voice Biometrics that they deployed maybe 10 years ago. Well, that exposes them to some risk, right? And I wanna be very open and transparent, but we are not seeing fraudsters use this technology at scale. We've seen a handful of cases where that's been attempted, but this is a threat that we need to prepare for. And we've been working jointly with organisations to move them to cloud so that they can have the latest and greatest technologies.

Which are available because our research teams are focused on staying several steps ahead of nefarious individuals, and, in our specific case, right, being part of Microsoft, we have access to the source algorithms, we have access to the source data that feeds the most advanced synthetic voice algorithms out there.

So that's, Matt, the most specific answer that I can provide to your question, which is that's how we stay ahead of this threat, by developing mitigating technologies before they're even released to the public.

Matt Smallman

Thanks for that. And I liken it almost to the antivirus days.

Like, at no point in time is this gonna be a solved problem. Both technologies will continue to evolve. It's about how to reduce the cost and complexity of implementing those patches and changes. And as you suggest, cloud is a way to do that.

The threat will continue naturally to evolve, and I think you're absolutely right to say that where we've seen attacks, they've mostly been in this colluded reputational risk more than they have been scale fraud. And in fact, our own risk assessment suggests that the biggest vulnerability from deepfake voices is not enterprises deploying voice biometric solutions.

It's enterprises who remain on knowledge-based authentication models, and whose customers are socially engineered at scale by synthetic voices to hand over those credentials. It's far easier to generate a thousand phone calls sounding like the person down the street asking you to give you letter three and four from your password, so I can put that in online or into another system, than it is to try and create a target-specific voice and fool a biometric system.

So yes, the threat does exist. It's moved from the theoretical to feasible. But actually in the overall threat spectrum, it's probably not as high as the current media speculation suggests.

28:06 Are deepfakes and synthetic voices a good reason not to implement Voice Biometrics?

Matt Smallman

So though I do know that it's one of the easy things that people throw out there as a reason not to implement Voice Biometrics. So what would you say to those people who are faced with their peers and colleagues in organisation who want to implement this technology, but people keep saying, oh, what about deepfakes?

What would you say to them?

Brett Beranek

Yeah. Well, one of the consistent responses that we've seen from organisations that have had to deal with this reputational issue, right, that have been the subject of some of these media articles, consistently, those organisations have emphasised that they urge their customers to stay with Voice Biometrics because that is the most effective way to protect their accounts. And so, every technology has vulnerabilities. The vulnerabilities associated with the alternatives, unfortunately, are significantly higher, right? So, passwords, PINs, security questions, SMS OTP, there are massive security holes in those technologies.

And so for a specific consumer to not use the technology, they're putting their accounts at risk. And, but then for an organisation not to implement this technology, they're putting all of their customers at risk. And so that's the response that I have to organisations that are hesitating because of this threat.

And I wanna reassure 'em that this is a threat that is top of mind for us and that we have a mitigating strategy for. And so it is, Matt, I like your analogy with antivirus. We have the antivirus software to prevent this type of attack. It just needs to be turned on, and that's something that many organisations are doing right now.

29:58 Is it expensive to implement Voice Biometrics?

Matt Smallman

Awesome. So I'm sure we'll get back to this in the questions. But I'm gonna move on 'cause we had one other topic area we wanted to pick up on, and that was cost. And to a certain extent, cost is a function of complexity. And I do remember a conversation where it basically, like, it was a million dollars to start a project, and that was just in third-party professional services fees.

That was just to start, acquire the audio and figure out all the bits that needed patching to here and there. And then there was the perpetual licences, and then there was the, what am I gonna need at peak volume? How many thousands, millions of thousands of transactions am I gonna need to do? And the sticker price was enormous.

Now for some organisations that made economic and commercial sense, because it mitigates a lot of fraud. It significantly improved customer experience. It saved a lot of agent handle time. And it was worth the investment. And many organisations have done it on that basis, but I just don't think that's true anymore.

When I look at the technology that's available today, you can switch it on in the console of some of these contact centre as service applications. It's not, and it's a consumption-based model. Yep. So it's about, huge upfront costs. I know. What does it take to get a solution up and running today, Brett?

Brett Beranek

Yeah, Matt, I'm glad that you bring that up. And maybe to add one other layer of cost. I've heard from a lot of organisations that went through this legacy deployment model that they had also a lot of internal IT costs, so it wasn't necessarily just the spend.

Matt Smallman

Yeah. Good point.

Brett Beranek

But I've heard organisations say that the amount of money spent on the vendor was actually the smaller portion of the investment.

The internal investment was sometimes a multiple of two or three, right, that spent on the vendor. And that has a lot to do with what we discussed before, right? So, Matt, two main things. Getting that audio in, getting the data flowing, and then figuring out all the business rules that had to be adapted for this technology, that drove a lot of cost.

And so, as we spoke about earlier, that is no longer a requirement. And so we've seen organisations, community banks, credit unions, organisations that have a handful of contact centre agents, and I do mean a handful, that have been able to deploy this technology successfully and achieve a return on investment within a year.

I had one executive, so contact centre executive at one of these community banks, and she shared with me that three months after deploying Voice Biometrics within their contact centre, they had prevented one fraudulent attack, which would've resulted in a fraud loss about a hundred thousand dollars.

And that delivered an ROI. So that gives you, without sharing the specifics of how much they spent, right, it does give you a scale of what this can cost for a small organisation. And so we're very far away from those figures, Matt, that you had shared earlier.

So cloud is one of those drivers. The subscription model, Matt, that you mentioned is one of those factors, right, that's driving down cost, that's eliminating that upfront investment. But also just the ability to use the technology out of the box is game changing. And we see organisations that, between the time they agree to move forward with this technology and the time that their customers are benefiting from the technology, it can be as quick as 90 days.

Which, Matt, I think that was completely unfathomable, right? Back in the days where hardware had to be purchased, and you could easily wait that time, that length of time, just to receive your hardware.

Matt Smallman

That was definitely true, but I think our rule of thumb was something like one third, two thirds, to third-party costs versus internal costs.

And was three years to achieve run-rate benefits. So three years before you could start banking, you were in positive benefit territory, because it probably took you eight, 12 to 18 months to switch on a service. And then another 12 months to start getting into positive territory in terms of how much it cost you to enrol and all the rest of it.

So, to positive benefits in 90 days. I won't drink to that because I don't have anything here, but I would definitely drink to that.

So that's really all we wanted to cover in terms of these three big areas. I think it's worth a quick recap on those before we jump into questions.

But I also had 43 separate questions from people, of which about a third were on deepfake, so we'll come to those in a second, before we do.

35:03 What is the reality of implementing Voice Biometrics today?

Matt Smallman

I think it's worth a quick summary of those three big areas.

We talked about complexity, principally about integration and business processes, that it's a solved problem. Yep. We know how to do this, we know how to plug it into pretty much everything. You don't even necessarily need a third-party professional services to do this.

Your developers should be able to do this using the instructions out the box, complex performance terms, what it takes to get a system up and running and stable and performant, largely available out of the box. Yes, there might be some benefits to fine-tuning.

And then finally cost. Cost may not even be an object anymore if you can get to payback in 90 days. What used to take three years could now easily be done in six months, it sounds like. And I've seen some implementations like that as well. So I would agree with that.

We're gonna jump into questions then.

Matt Smallman

One of the big ones we haven't really touched on here, because it's outside the technology domain, but it's about privacy and consent. So in a similar way, 10, 12 years ago, when we were first implementing this technology, we had to explain to regulators what exactly biometrics were and how they might be used, and what they should be worried about about them.

And we were largely leading the debate. I think in many jurisdictions, it's become certainly clearer what the regulations are and what needs to be done, but in some ways people also see that as a barrier to adoption and a challenge and a reason why they might not deliver significant benefits or of many be much benefit as they think they might for the organisation.

Brett, do you think that privacy regulations and obtaining customer consent is a barrier to voice biometric adoption?

Brett Beranek

I don't, and I think I was quite a lone voice 12, 13 years ago when I was trying to convince organisations that providing notification and collecting consent was a good business practice.

Back in the day, as, Matt, you mentioned, there were very few jurisdictions that had these requirements. And so we did see organisations that took these best practices that we had communicated back in the day and implemented them, and now they're in a position where they don't need to make modifications to their deployments.

But we also saw organisations that were a little bit more aggressive in their approach and decided to not follow that path. And then, as regulations evolved, had to change the way that they deployed. And Matt, I think you're aware of some of those cases in the UK where

organisations had to, unfortunately, right, delete some voice prints and then re-enrol individuals, right? Because of that. So, all that to say is that, no, I don't believe it's a barrier. I think organisations should feel very comfortable with the fact that there is a harmonisation of requirements pretty much across the globe, whether you're in Europe, you're in the UK, you're in the United States, you're in Canada, many other countries, some of the foundational requirements, and privacy as to keep your system transparent and open and provide notification that it's in use.

And then for the purpose of enrolment, right, creation of biometric prints, collect consent. And I think one of the reasons why organisations feel that it could potentially slow things down is that probably in the back of their minds, they're thinking that they need to send a 12-page legal document to somebody that needs to take out a pen and sign it, and then mail it back to the organisation.

That is not the case at all. Regulators have been very flexible. They've understood the need to be able to collect consent and provide notification in the channel that the customer is operating in. And in a phone channel, that means using a voice, right? So providing an affirmation, right?

Saying yes. Saying, okay, yeah, go ahead. Right? That's all that you really need to be able to showcase that the individual has agreed to this. And in self-service channels, it's even easier. So whether you're in the mobile app or in the IVR, right, having somebody press the okay button on a touch screen or verbalising their affirmation, right, just saying yes, is very quick, very efficient.

And so we have not seen organisations that collect consent have a negative impact on their ROI. The great majority of consumers out there embrace this technology, they see the benefits. They understand the benefits, that this is enhancing the authentication process, but also protecting them and protecting their accounts from fraud.

And that's something that is universally sought after. And so, again, long response to your question, but I do not see this as a barrier at all.

Matt Smallman

So first off, I completely agree with you, and we did a session with a lawyer a few months ago where we went round this same subject.

It's just the right thing to do. It's rude and a bit weird to do this without asking people. You just should do it anyway. Whether you have to dress it up in quite as many legal terms is something to debate with your own lawyers, but that will vary by organisation.

I think some of the challenge, though, here is that it's seen as an extra cost of implementing this type of authentication security technology versus others such as SMS OTP or push notifications or device-based authentication.

And actually, whilst I agree to some degree, really, you should also see it as a function of training. Yeah. It helps customers to understand the service they're about to use and makes them better users of it, because they feel engaged in the process rather than forced to do something. So I know it can appear like an incremental cost of this compared to other forms of authentication and security, but I'm not sure that's necessarily a fair comparison.

And when you do have that consent, the opportunities that that creates over those other methods are quite significant. I dunno if you've got anything to add there, Brett.

Brett Beranek

Yeah, Matt. I do. So enabling OTP, right? So enabling SMS OTP, that requires an overt step from the customer, right?

They need to provide you with their cell phone number. So there is a cost to the consumer, and there's a cost to the organisation to drive that behaviour. And yet you're left with a credential, or a step-up authentication method, that is at most temporary, because people change their phone numbers, people change their devices, and so it is not a lifelong credential.

And so one of the beauties of biometrics, it's that you can keep on using this biometric credential for decades. And so once you spread that cost over the lifespan of that credential, the lifespan of that relationship with a customer, then it really becomes completely negligible.

42:34 Question: Where outside Financial Service are the missed opportunities for Voice Biometrics?

Matt Smallman

So I think that leads on to another question that was asked in my call for questions earlier, which was outside banks and financial services, who are clear use of this technology. And it's, in my mind, it's a matter of time.

What other industries and sectors do you see an unrealised return on investment that they could get from implementing this kind of technology?

Brett Beranek

Yeah, so any organisation that is struggling with fraud within their contact centre is a clear candidate for this.

And so beyond the financial sector, we definitely see telecommunication firms gaining a lot of value out of this technology. And I would say that for the time being, it is an exception that a telecommunication firm is using Voice Biometrics, rather than the rule. And so that is unrealised value at the industry scale, even though there are a handful of telecommunication companies in various countries that have benefited from this for many years.

Now, the other key vertical is insurance companies, and that may be a little bit counterintuitive, but insurance companies tend to have very irregular calling patterns into their contact centre. So for many of us, we don't call our insurance company for a long period of time until we have some kind of issue.

And then there may be several calls in a row as we try to resolve this issue. And so we found that just on the authentication front, the insurance space is an industry where we have a handful of organisations that have realised the value, but where the majority of organisations in this space have not done that yet.

And then maybe another example is government services, and this really came to the forefront during the pandemic, where there were a lot of payments that were going out to citizens from various government agencies. And what came to the fore is that not having a proper way of validating identities is hugely problematic and can lead to a lot of fraud, and what we've seen as organisations across the world.

So whether it's the US government, Canadian government, many European governments have lost an incredible amount of money as payments were sent out to individuals that were not in need of these payments, or were outright taking over other individuals' identities in order to receive those payments.

So those are just a few examples of organisations that could benefit from Voice Biometrics, and my response was very much tailored to the contact centre space. Once you zoom out and you look at the use of this technology within digital channels, such as mobile apps and the website, it really can apply to any organisation that needs a step-up authentication, which is a lot.

Right. I could go down for several minutes, right, just listing all of.

Matt Smallman

We are coming up on time, so I'm probably gonna have to draw a line. Sure, sure. Draw a line there. I'm sure you could sell this to anyone. But I think I like those three sectors that you talk about.

And I would agree those, in terms of unrealised opportunities, telcos, insurance and public services, government services, as you say.

46:08 Question: What does Voice Biometrics and its applications look like in the future?

Matt Smallman

Final question then, as we're wrapping up, and I apologise, we haven't managed to get to everyone's questions. We've been talking a bit about what was true 10 years ago?

What's true now? And what's changed? If you could gaze into your crystal ball, or maybe you have the privileged insight that I don't, what does this technology and its application look like in 10 years? What are the final hurdles, the barriers you will have changed or you hope to be able to have changed and transformed in that time?

Brett Beranek

Yeah. Well, I have to be very careful what I say. Yes, I do have access to some privileged information in my role, but I will say the following, on the fraud side.

On the fraud prevention side, I do see technologies such as ChatGPT assisting with the task of hunting for fraud and identifying fraudsters and just going through case management. Right now it's a very manual process, and some organisations have done a phenomenal job, but some organisations don't necessarily have the staff to do that work.

And so I do see technologies such as, augmenting that side of things. And then specifically on the authentication side, I just see continuous improvement in the technology. And so I see it just becoming even more seamless and transparent, and which will just make the technology more ubiquitous than it's today.

Matt Smallman

That's a very, very succinct answer as we're coming up to time. So thank you very much for that, Brett. And I'm sorry we didn't get to everyone's questions, who came up, who answered. I think we covered most of the general topic areas. But I will have a look at those and see if we can come up with some offline answers for people.

So thank you very much for joining us, Brett, and contributing today's session. Thank you everyone who joins online, on LinkedIn, on YouTube, and wherever else this is being broadcast. Thank you very much for joining the Modern Security Community. As you can see, we are here really to talk about the application of this technology so it can improve customers' security, and the efficiency and usability of call and contact centre processes.

In our next session, which is scheduled for the, just checking my calendar, for the 9th of November, it's just me, I'm afraid, but I will be digging into the return on investments for modern security technologies as a whole, not just Voice Biometrics, really looking at what the cost of poor security and poor authentication processes in today's contact centres and call centres are.

And we'll be using some tools from the aforementioned book, including some new tools that we'll be deploying on the day. So thank you very much for joining us. I hope you can join us on the ninth November. You'll receive a recording afterwards. And once again, Brett, thank you very much.

Brett Beranek

Thanks, Matt.

Terms in this video