Make The Case14 chapters

The Business Case for Better Authentication and Fraud Prevention

Mark Bramley, who led Voice Biometrics for one of the world's largest banks, on how to make the case for change, both financial and emotional.

Making the business case for implementation, particularly in challenging economic times, can be difficult. Whilst the security, customer experience and commercial benefits of modern security methods such as Voice Biometrics and Network Authentication may be apparent for some they won't be for everyone.

In this session we discuss the best practice for making the functional and emotional case to implement Modern Security in your customer-facing channels, including:

  • What are the real financial benefits?
  • How to quantify non-financial benefits?
  • How long does it take to implement these technologies?
  • How long does it take to realise the benefits?
  • How to make the emotional case for change?

Transcript

33 min read

0:00 Introducing Mark Bramley

Mark Bramley0:00

So despite these beautiful young looks, I've worked in financial services banking predominantly for just over 40 years. And predominantly focused on either frontline teams or teams supporting contact centres and digital channels across those organisations. You can imagine over those 40 years, seeing one hell of a lot of change through that period to what a lot of people experience today.

I was provided with an excellent opportunity last July to take a bit of a break. And to take a bit of a sabbatical, just to reach out, spend time with the family, and now looking forward and getting back into the saddle again of helping organisations to improve performance and customer experience.

Matt Smallman0:53

That's awesome. Thanks, Mark. So I mean, security, authentication, fraud prevention, that's just one of the many bows in your quiver, I think is the right analogy. But before we delve into today's topic, can just tell us a few things that you've seen change over that time that you've been in the contact centre space.

Mark Bramley1:13

We've specific focus on security and identification. Yeah. Yeah. Yeah.

1:19 Why is contact centre identification and authentication so challenging?

Mark Bramley1:19

I think if you look at it historically, when we're talking about financial services, banking or other industry segments, quite often contact centres were built as a cost play. And to reduce costs away from other distribution channels, whether big branches or retail outlets.

And the experience of the processes that worked for those physical channels and face-to-face were adopted into contact centres. Now, they would be knowledge-based, whether it would be static information that organisations use, held on customers, date of birth, place of birth, mothers' maiden names, or dynamic information. It may be transactions and products and usage of accounts with those organisations.

But they became more and more difficult for customers to answer correctly. And be able to get straight into completing what they contact the contact centres for that day. Now we've gotta remind ourselves that most customers don't find banking or dealing with insurance companies or health companies exciting and a massive enjoyment part of their life, they want to get the business done and get out the way and get on with something more important with the money that perhaps they've got in the banks. But failing those knowledge-based authentication processes created a lot of angst and frustration, a lot of increased cost for organisations.

And also didn't make it easy for customers, not just to service those customers, but to find opportunities to build the relationships. What it does, though, is make it easier for fraudsters to get a lot of that information, especially over the recent years with the advent of social media, et cetera, where fraudsters are able to obtain information quite easily, and to try and break the weakest point of dealing with employees, answering those customer enquiries.

Organisation have tried to handle that with other authentication tools, more sophisticated passwords, whether it's been random digits from a numeric pass string, which is not easy for customers to remember, but even where customers have been able to choose passwords being alpha, but easy to remember, not the best things and the easiest things for customers to use as security tokens.

So, with those legacy processes, there has been a lot of opportunity and progress made in making it easier for customers to confirm who they claim to be, whilst at the same time reducing operational costs, improving fraud risk management and other benefits that we'll probably talk about over the next 30 minutes or so.

Matt Smallman4:01

That's right, and that is the point of today's session really, is these problems exist, and we'll come back to that in a second, just where they've come from. And there are many people out there, ourselves, probably have one on this call, to be honest, who want to do something better, but actually making the case for doing that better can be challenging.

And that's what we want to talk about today. We want talk about how I describe it as both the rational, functional, commercial, economic case for change, but then also more subtly and actually almost as importantly in some organisations, the influencing the emotional case for change. How to win supporters to improve that situation. So that's what we're gonna delve into in a moment.

And just to summarise for Mark's thoughts, cuz they echo a lot of my own, I mean, I am slightly younger than Mark, just a little bit, but I think even Mark, when he started in banking, like call centres were a thing, they already existed in some degree or another. There were people delivering service remotely by the phone. There was never a point at which someone, in our living memory, I know what would be a good idea, let's create a contact centre. How are we gonna design it to optimise all of these different challenges?

They have existed for a long time and they have evolved in response to the fraud environment, in response to their customer demand and the availability of technologies. So it's not necessarily anyone's fault we ended up in this situation. It's just a recognition of the evolution.

And then those techniques that Mark talks about, they, and I always think back to this crazy conversation I must have had almost a decade ago, sitting in a conference room when someone says, how do we make knowledge-based authentication harder? Should we ask another question? And the inability to really articulate whether that improved security and at what cost. And I think that's where we've seen a huge change in the last few years. And some of the technologies we're gonna talk about later in this session have become really key to solving that challenge.

So let's dig into the challenge then. So, just in your background, Mark, what is it you've done to improve the authentication, identification and fraud prevention situation in the organisations you've worked in?

Mark Bramley6:12

Yeah. If you were bringing up to date, in the last few years, and I've been really privileged to have the opportunity to focus initially on the customer experience and how can we make it less friction and easier for customers to do the business with the organisation, but at the same time giving them the peace of mind and increasing belief that their money, their data, their personal data is safe with the organisation.

And it's important to think about the interaction with the customer from start to finish at each part of the flow of the conversation, whether that's within an automated self-service channel, whether that be an IVR or a digital channel, or when the customer engages with an employee of the organisation.

Read the full transcript (33 min read)

7:04 Why do you need to focus on the whole welcome experience?

Mark Bramley7:04

So, focusing on contact centre and voice, if we think about when a call initially hits the organisation, the welcome, how does a customer know they've dialled the right number? What sort of drop-offs are you seeing them understanding that then the customer have been able to identify themselves, claiming to be Mark Bramley. So what's the identifier that they can use to enable the right customer profile and authentications to be pulled with the organisation.

Now, historically, they've been difficult. It's been awkward sometimes with customers to actually get to the authentication step, not being asked to input the 16 digits from your credit card or sort code or account number, or your passport. More and more these days, those things aren't ready to hand and customers don't remember a 16-digit credit card, so customers are dropping out of that stage. It's important to know that, but even when the customer then get to the authentication stage, how can you make it easier for them?

And Voice Biometrics has absolutely been a key development in that. So over recent years, I've had the pleasure of working with some good partners as well as across organisations and in different markets and countries and territories around understanding the opportunity to improve the ID step.

So whether that's just understanding the call identifiers, CLI, or for our American friends, the ANI, whether issues and other sophisticated tools, like Network Authentication, which I know have been subject to conversations within Modern Security Community, to then we'd be able to call back the right voice authentication information, a voiceprint, to confirm authentication.

It's also making sure that those authentication tools can be used in the natural language, whether it's natural language talking to an IVR or with agent as well. So I've deployed those kind of solutions now across probably nine or 10 different countries, multiple languages and accents as well.

To drive those benefits.

Matt Smallman9:14

Oh, great. We are definitely gonna dig into that in a second, but I think you made a really, really important point there around, like, it's very easy to jump into these cool and sexy, well, depending on your positioning, technologies like Voice Biometrics and things like that.

But actually, if you don't know who the customer's claiming to be, there's no chance of you being able to authenticate them. So I think that identification step is often missing in people's thinking about this. It's very easy to race to authentication, like making identification easy for people puts them in a better position to then authenticate.

And then I think the other thing you said, which was really interesting as well, is just almost moving some of these things from being very active and in the way of the interface with the customer to being passive and out of the way. So customers don't call an organisation to prove who they are, that's not the purpose of their call. The purpose of their call is to have their problem solved, and all of this stuff that we make them do is getting in the way of ultimately what they want to do, which is to have their problem solved. And because they've selected the phone channel most often, that's by a human or albeit we have self-service capabilities, but they're potentially seeking that human-to-human interaction as well.

So I think some really, really important distinctions there made.

So let's talk about the hard, rational, financial, economic case. Like, how do you go about convincing people to spend, like, cuz some of this stuff is not necessarily cheap, it's getting a lot cheaper, but it's work to be done, and there is never a shortage of stuff to spend money on in large enterprises.

So how do you go about making that rational, hard financial case?

10:54 How do you make the financial case for change?

Mark Bramley10:54

In most cases, there'll be an operational cost opportunity. Most of that will be driven by either the time it takes customers to successfully authenticate today, or where there's failed authentication, they failed to authenticate and end up back on authentication questioning, knowledge-based questions, other solutions need to be employed, which is just elongating the duration of the call to start with, and also the customer get to that magical point. You mentioned, Matt, around what do I need to, well, I'm actually contacting you in the first place to complete today.

And then there'll be the fraud risk management opportunity. So by identifying either a fraudster earlier or stopping the fraudster, either reducing the number of fraud cases and or the average losses of successful fraud cases by the early identification given more insight and intelligence to colleagues within fraud risk investigation teams as well.

So most organisations' business cases will focus on those two major opportunities. And as we've already talked about, it's important to understand that today's position of the volume of interactions, where the processes are working, failing, time of each of those components, but then depending upon your organisation, what are those other opportunities which helps you justify the business case and that significant investment that you talked about.

So where customers are able to more seamlessly and painlessly authenticate, not only are you making it easier for them to complete their initial intention for calling and hopefully increasing self-service again with us within an IVR or a mobile application, you're also more confident in unlocking some of the real powerful insight and data that most organisations hold on their customers today.

Now, if I don't really know it's Matt who's calling me, how can I unlock the data about not just his product holdings, his behaviour, his propensity to buy, is there some financial assistance I can give in the background there? But by having that increased information and confidence that can route the customer, I can guide the customer to the right menus or employees to handle that.

So those sort of opportunities and increased sales and revenue, improved prioritisation of fraud referrals, all of these things will help you to reduce cost, but also increase sales and revenues and increase things like collections, recoveries as well, which are opportunities to build into the business case.

Matt Smallman13:38

I think that's really, really good point. In my experience, this is the triumvirate. Yeah. It's fraud, security cost, risk avoidance. It's the efficiency, call centre optimisation. And it's the customer experience, stroke, sales revenue side. And any case is gonna consist of all three of those, hopefully.

But usually one of those is gonna be either what I call the tipping point, like the thing that pushes it over the line, like cuz they all add up, and yes, the return on investment is there, but it needs something to drive it, to push it over the line. Because invariably, and I dunno if this is your experience, like those budget lines are held by different people, aren't they? So how do you get those people engaged? Excuse.

14:24 How do you engage all the different stakeholders to support your change?

Mark Bramley14:24

And again, it's making sure you understand the opportunity or the perceived pain point of the respective stakeholders within your organisation. So, talking to contact centre leadership teams, a lot of the focus will be reducing call volumes, reducing average handling times, reducing transfers, reducing failures, and resetting security credentials, for example. All of which are making it difficult for the contact centre teams to deliver where the performance metrics they're being held to account for.

If you're talking when your fraud colleagues in the focus will be more on the risk management, but also be appropriate fraud referrals they're receiving.

The Chief Finance Officer is gonna be interested in, well, how do I realise those hard pounds, shillings, and pence? That's gonna come from the business case. How I'm gonna make sure it's not just written on paper, but how do I bank those savings and how do you justify those? It's continuation of that going forward. And then when you start to talk about the increased opportunities, it's to be able to articulate and show through the data that even where a customer successfully authenticates and goes on to self-serve. If, for example, it's an organisation that's also heavily investing in an increasingly more mature and feature-rich digital capabilities, a finance team might say, why do I need to invest in the contact centres if my digital capabilities is gonna absorb the heavy lifting volume self-service interactions?

Why do I need to spend and invest in my contact centre with Voice Biometrics, for example? But it's making sure that people understand that the calls that continue to come into the contact centre will be more complex, potentially more valuable to the organisation and more attractive to a fraudster as a result, or a real moment of truth, where empathy and emotion is needed to help a customer through a difficult time: loss of job, partnership breakdown, bereavement. These are the kind of things that will still be handled within a contact centre.

Customers don't want to, having had a great experience in a mobile application, for example, using things like Face ID or other opportunities, to then be faced with knowledge-based questions. What was my friend's dog's colour of eyes when I was at school, 50 years ago type of approach.

Matt Smallman16:51

Yeah. And to give people listening some confidence in that, let's just try and drill down into some specific, and to the extent you're comfortable to be specific about them, like.

To what extent does better authentication lead to higher automation to people? Like, if it's easier for me to get authenticated, does that really increase, in your experience, the chance that that person is gonna use your self-service features versus just go to an agent?

17:21 Does better authentication drive greater self-service?

Mark Bramley17:21

Absolutely. So, in the same way that we talked about gathering the data to baseline the opportunity. So what are your volumes of interactions today? Where are the failure points? You need to also be seeing how successful customers go on to self-serve and be able to track those. It's also understanding what continued investment in channel migration an organisation is looking to drive going forward.

But gathering that data and then tracking it after post launch. From my experience, what I've seen, the more you can take the pain away of being able to prove who you are, providing that beyond the authentication you've got a well-designed, for example, IVR, ideally with natural language, conversational IVRs rather than touch tone, customers will go on to self-serve. In the same way that customers have become more and more comfortable today self-serving through a mobile application. And even then, when the call needs to be transferred on to a contact centre agent, you've saved probably 50% of this call time by the fact that customer's done some self-service and now they just needed to speak to an agent about something a bit more complex to conclude.

So there's a real good experience there. And from that immediate transfer, whether it's from the mobile app or from the IVR to a human being, rapport builds pretty immediately, you're able to fulfil the customer's additional need. The customer's more likely to be receptive, to listen to have you got some time about a new service and new product, and why are you using the mobile application. That is such a more enjoyable conversation, not just for the customer, but for our employees as well, to build that engagement and drive more value out of that interaction. Where the customer just wanted a balance transfer or something to start with.

Matt Smallman19:11

A couple of really good points there. I'm just gonna try and unpack a few of them.

So, one is the propensity really to stay, I think you covered it pretty well. Like, easier, simpler authentication experiences leads to customers having a higher propensity to service themselves because there's less friction. I think that's fine. And that's been your experience in multiple geographies.

The second point I think is that, for me, really important and how I fell into this technology, is that getting authentication out of the way enables the colleague to build rapport, and one of the many positive benefits of that rapport is the ability to sell effectively, the ability to build a relationship, to build confidence and trust that ultimately either extends the current relationship or enables share of wallet to increase, for example.

And that's been your experience as well? Yes.

Mark Bramley20:05

Yeah. Well, whether it's been share of wallet through sales, or customers are experiencing financial difficulties, collection language. Most customers are wanting to get some assistance and will be more open to opening up about the financial circumstances to find an opportunity, which improves revenue by reduced bad debt charge, for example, helping loyalty so that when they're through that financial difficulty, they're gonna be more loyal to the organisation for purchasing new products when financial times are better for that individual.

Yeah, and it's remembering those moment of truths, where a human being probably got a part to play still. But let's not make it difficult to be able to guide a customer to get to the right skilled employee in an organisation to handle that without multiple transfers thereafter, as well. All comes back to easy, simple, secure identification, authentication as well. Get that wrong, you're whistling in the wind regarding your longer-term strategy. There was another phrase I was thinking about, but I won't use that.

Matt Smallman21:10

I'll bleep it out later. It's okay. I hadn't even thought about the financial distress situation, that's a really interesting one. The final point, just from your previous statement, just to unpack, was the colleague, the employee, agent side of this, and, just, do you wanna expand upon that?

How does a different or improved authentication experience, what does that do for the colleague experience?

21:32 How does better authentication impact the colleague experience?

Mark Bramley21:32

It's a massive improvement. Always recommend, find some time, protect some time, to listen to interactions, listen to calls between your customers and your employees.

And if you can do that sat side by side as well, so much the better. Just plug in the headset. Not just to listen to the tone and values in the call, look at the body language, when an agent receives a failed verification, security reset question, they know straight away they've got straight customer just wants to get something done, they've already had a failure point, and there's just no value and enjoyment for any human being in that conversation, whether it's a customer or agent.

Quite often, it can be a tipping point as well, because if that's all agents are, high volume of calls, interactions, and avenues that day after day after day, together with other pain points maybe in your organisation, it can play into employee engagement, retention, and having the opportunity to learn new skills to promote value to those interactions as well.

If all I'm dealing with is failure calls and interactions as a high percentage of what I'm doing, I'm not having a fulfilled role, I'm not looking for that next opportunity. I'm ignoring all the significant investments you may have made in your CRM, insights with all this sophisticated AI and bots and prompts on the screen about, speak to Matt about this, checking out about that, that compliance statement I've switched off cuz all I know is I've got customer, I could go on, but you just got to look at the body language and listen to the values in the call, will tell you the engagement opportunities for making it easier, taking effort out for employees as well.

Matt Smallman23:19

That's so fantastically well said. Yeah, no, I completely, my only anecdote to add to that was, maybe a decade ago when I first implemented Voice Biometrics, I was in a building in Glasgow. We were just on a weekend go-live activity, and it was rainy Monday morning, as it usually is in Glasgow. And someone stopped me in the lifts on the way out at seven o'clock at night and said, thank you for changing our lives, and it was like, and it was, I think it was a little extreme, but genuinely, no one comes into customer service cuz they want to interrogate people 40, 50 times a day.

They don't want to deny people service. But when our processes and procedures make them do that, that is, as you say, it's a very down moment for people, and accumulation of that has an effect. No, really, really well said.

We're gonna move on and look at how to make the emotional case then, like, so we know this is the right thing to do. Yes. We've got a financial business case that says it's the right thing to do. The contact centre operations are behind us, the security and fraud community are behind us, and potentially customer experience or revenue or sales teams are behind.

How do you actually go about, like, getting this thing above the investment line? I always talk about, like, there's only a fixed amount of money, and usually regulatory projects come above the line because they have to get done. And then there's a certain amount of revenue stuff that goes above the line. And there's actually, in most organisations, a small amount left to spend on what might be considered more discretionary projects. I would disagree that it's discretionary, but that's not how everyone sees it, so just talk to us a little bit about the politicking for a moment, if you wouldn't mind.

25:06 How do you get the business case over the line?

Mark Bramley25:06

Yeah. And first of all, avoid assuming that all those functional teams, colleagues, and different teams and accountabilities that you referred to are behind it to start with. Because your colleagues have already got extremely busy schedules, focuses, objectives to deliver. And they've always got other colleagues knocking on the door saying, I need your support for A, B or C. And how can I get a share of your marketing budget, please, to support my launch and then my enrolment and activation strategies thereafter.

So, first of all, as well as, as we've already discussed, sizing the opportunity, cost, fraud, sales, et cetera, as part of the financial business case, it's also then thinking about what's your organisational plans? What's your strategy? Because again, it's quite easy sometimes for colleagues to banking, financial services, health, telcos, et cetera, to focus on and get carried away with the next new kid coming down the track here. So, over the last decade or so, it's been digital. Yeah. Whether it's been browser-based banking, whether it's been mobile banking, chatbots, AI, et cetera. People say what legacy channels now, contact centres, which have been around a hell of a long time now, why do we need to invest in there? Why is it important?

Well, again, we've already touched on a few things around interactions and volumes as a percentage of your total interactions with the organisation through your contact centres might start to reduce. And hopefully it will do, as that investment in things like digital continues.

Don't forget, you want to be able to attract new customers so that customers understand they're going to get the same kind of service they're expecting, the channel they need to interact with at any moment in time, your existing customers get good type of service in respect of the channel and touch and that moment of truth again, when they need to speak to a human being.

There's some help and support or more complex purchase or investments. Whether it's regulated investments, I'll just purchase the house or another expense of. I'm going through a moment, supporting my son's wedding at the moment. All those kind of things are often gonna need to have some sort of to it. And again, if the first experience of coming back to the contact centre is poor, then they can't authenticate, then you can forget about how good your digital experience is in the last three years. Great relationship you've had with your customers and the product holdings that they have, they've now become susceptible to one of your competitors' marketing approach to actually jump ship at some point, because it's easy to transfer your bank accounts and other financial products these days compared to what it would've been 25, 30 years ago.

So making sure that it plays into the sweet spot of your strategy going forward and the value protection or additional value that could be added by these kind of investments as well.

Matt Smallman28:10

Again, some fascinating, we could talk about this all day, but there's some fascinating points there. Just, I think, and I was just reflecting on some clients I'm working with at the moment, and you are right. Like, if the role of the telephone channel is not clear in the context of the business's overall strategy, then you talking about ID and authentication improvements is just irrelevant, because no one knows what the channel's there to do just yet.

When people get it right and they understand that this is not necessarily a high-volume transactional channel, it's increasingly a relationship, a trust, and advice channel, then the discussion around how should that feel for customers and what our best identification authentication strategy should be comes to the fore.

So I think you're absolutely right. If you are trying to float, and in terms of advice to people listening, if you're trying to float and get a sponsorship behind an initiative that talks about improved identification and authentication and is not rooted in a clear vision for what the channel as a whole is doing, then it's unlikely to be successful.

So, really good point. I'm just gonna take the opportunity to say to people who are joining us live that you can put your questions into the chat or the Q&A session. And I'll put those to Mark as we go on. I think we've covered an awful lot of ground there. I think just.

What would be great is just to hear a bit about your experiences of doing this in different cultures and different regions, because I think that was another thing that struck me about your experience.

So how does it vary between, like, are Anglo-Saxon type markets all the same, or is there variation between those, and then beyond that, what's different? What changes?

30:09 How do you need to vary your approach for different cultures, languages, regions and markets?

Mark Bramley30:00

I don't believe they're all the same, first of all, market something, language, et cetera. A lot of it will start with just what's the general understanding and knowledge of things like biometrics and network authentication, et cetera, in the market. Are customers already aware of these things or not?

Will it help to inform also what the understanding of the organisation that you're supporting has all of these kind of things as well? Whilst you may start offering one particular market, and in my experience, won't come as a surprise, as a UK guy, we know what was in the UK, then most customers are aware of biometrics, and sometimes just a continued explanation of what biometrics is.

But what was a real eye-opener for me, going through my early experience building the solutions and working with chosen partners, was the lack of understanding in the organisation and the need for people to be courageous and real belief in the investment made.

Example would be having sufficient audio across different segments of your caller or your customer base, not just on language and accents, but behaviour, et cetera. And having sufficient volume to do all the tests and calibration of the various models. I won't go into all the ins and outs of how background models, everything works, that subject for another call, another time.

But I always remember the first time, just going back to Glasgow, you were referring to earlier, when we're doing some testing. And a Glaswegian accent successfully being authenticated on a Yorkshire, as in Mark Bramley's accent. And to the human ear, there's just nothing that at all.

Now, of course in the early testing you've got some fine-tuning, calibration, but as soon as that was heard about in the organisation, the Chinese whispers started to flow through phone calls from senior executives saying, why I'm wasting money on this, it's ridiculous. And the time investment needed, not just in opening up frontline colleagues and their leaderships, they're able to explain things like biometrics to customers.

You need that to go all the way up through the chain of command to executives and board members, cuz they're the ones that's gonna get questioned by the press, et cetera, if there's some noise about it there. But once you're designed for a market, for example, UK, then going to, and in the UK it's changing, thankfully, compared to when I was young man.

Basically speak English and we provide services in English, but we had a multicultural population of different languages. But as soon as you do jump, for example, to the Far East, all of a sudden you're handling calls in different languages, Mandarin, Cantonese, Bahasa, expat English, which is different to first-language English in another market as well.

And to be able to design and gather sufficient audio for Arabic and all different languages in Spanish to make sure that works is a challenge, but also your colleagues in those markets may have not really heard about biometrics before, beyond the fingerprint, for example, in crime series.

So how do you build that confidence in your frontline? Don't just assume that the markets and training and education is done in one country is gonna work. It's different from the UK to the US, for example, despite how we may think we're the same, it varies hell of a lot. So don't underestimate that internal challenge

of helping your colleagues beyond just a CFO to sign off the cheques and do the investment, the technology resources to integrate and build, of people's commitment to support you, but to also buy into and trust, to explain to customers, as well as the opportunity upside of support your digital campaigns and everything else.

Matt Smallman34:18

Some really interesting points there. And again, just to try and unpack slightly. So I think, and to some extent what you say is true even between companies. And fortunately, having worked for a couple of large banks, I can tell you in most cases the actual solution is the same. But the way in which it gets from being an idea to implemented and how effective it is varies enormously. And that's a function of those organisations' culture and way of doing things. So when you expand on that globally, and then you take different levels of core understanding of the sorts of technologies we are talking about, I can just imagine there's an exponential increase in the variations of the stuff that you have to do in order to make that change.

I always, sorry.

35:01 How important is cross functional collaboration?

Mark Bramley35:01

Sorry, Matt, and it's so important, as we discussed early in the call, around engaging, involving functional teams from day one. So don't just get your contact centre people and IT people in a room with your chosen vendor and partner, get legal, get marketing, get compliance in the room, because regulation, legal and data compliance varies by market significantly as well.

So you need to be able to not only design in the solution that keeps you compliant, but also that your risk teams, colleagues understand what you're looking to achieve, strategy and customer experience wise. So they can help you to design something that is still usable and doesn't put customers off having to listen to five hours of terms and conditions before they can use their voice for authentication, for example.

So those kind of things are important to understand. There will be variation in markets and regions.

Matt Smallman35:56

And that actually leads very nicely on to a question we had, which was about people beyond those signing the cheques, often people who can block progress, like legal and regulatory compliance teams. I think both you and I were fortunate enough to implement solutions in a time before these regulations were quite as specific as they are now. And I think we did a reasonably good job on a principles base, but now there are tomes of regulations to adhere to.

It's very easy to object. So I'm just interested in your experiences, both domestically and then globally, with how you deal with both internal legal, risk stakeholders, but then externally, regulators, data privacy watchdogs, et cetera. What's been your experience there?

36:50 How should you work with internal compliance teams and regulators to address privacy concerns?

Mark Bramley36:50

Well, absolutely, start internally with your legal and compliance team, make sure they understand beyond the solution what we're looking to achieve, how it helps them improve the risk management as well as the customer experience and operational costs.

Listen, and take note and action upon the feedback you get from your colleagues there as well. So it's not just seen as a tickbox exercise for them to turn up to a workshop and then I tick the box and I can ignore 'em, because you'll have a problem when it comes to launch, get final sign-off, et cetera. Also, with those teams, they will have their connections with the industry bodies, the regulators, and the governments as well that you may need to influence, especially in the Arabic countries, for example, Gulf states.

So how can you equip your colleagues to represent you in those, or to join them in those meetings as well? I always remember my first experience of attending a Hong Kong Monetary Authority meeting and to explain to them how confident I was in Voice Biometrics and surrounding layered security framework being so much more secure than two-factor authentication, for example, in the contact centre.

And you just got to accept sometimes that you can't change culture and regulations, and the answer I got back was, I'd like to believe in Mark. It sounds great, but once you've got volumes of customers using, they come back and prove it to me, I'll listen to you. In the meantime, you've got to use two-factor authentication for enrolment, and you've just got to appreciate that with some countries and some regulations, you need to accommodate those things as well. But don't underestimate the role that your colleagues who specialise in legal data compliance regulations, et cetera, by their early engagement involvement, how collaborative they can help you in handling some of those. But it takes time and effort, and these are things you need to think about as you're building a team and your business case beyond just the pounds you might spend on the models you might have, with chosen partners and your IT solutions and all those kind of things.

You've got to think about the cost and time and effort of other things you need to make it a success, not just for launch, but also your model post launch as. Because you will need to do more data gathering exercises to recalibrate and learn and fine-tune how your solution works to become more effective and how it may change the different things.

As your organisation changes as well, different, new and changing regulations going forward as well that they may need to accommodate. So it's important that you think about what IT resources you'll need for those kind things or professional services from your chosen partner as well. Speech scientists to optimise the performance of your solutions once it goes live.

You don't just launch it and forget about it. Very dangerous if you do that.

Matt Smallman39:54

No, I mean it's interesting. I'm just reflecting on whether, I mean, you were a trailblazer in many of the markets in which you implemented this technology. You were first to market in many of those places, and to what extent have you opened the door for others, and they don't have to work quite as hard, or do they, should they work as hard anyway?

I'm interested in your thoughts.

Mark Bramley40:16

What, other organisations?

Matt Smallman40:18

Yes. Same thing in markets you've already deployed to.

40:22 Is it easier now that Voice Biometrics is available in many markets?

Mark Bramley40:22

Yeah. 'Cause a lot of that initial pain, but enjoyment, I must confess, of helping regulators understanding new, different technology, just as importantly, customer behaviour and different pockets of cultures in some of those markets.

Not just the languages, the Bunak population, Malaysia versus the expat population. If you go to a place like Dubai, the numbers of peoples and cultures that are represented in such a small place, but so governed by the Gulf States, and everything else that goes around that, there's a lot of effort goes into just getting the permissions and customer buy-in and adoption of new technologies and new solutions.

So, yeah. I guess that does make it easier for followers. But isn't it good to either be first or one of the first to do that, because then you start to talk: how can I now use that one? My marketing colleagues and my brand build, my PR? How can I use that in my acquisition campaigns?

Not just to lead too much on authentication, but how you make it easier for customers to do business with you, to adopt the self-service channels and get access to the great products and services you've got, as well as making their data and their money more secure as well.

Matt Smallman41:45

Yes, I will personally never forget when your "let me in"

advert dropped on a Sunday afternoon. I think it was on a Saturday afternoon, and by Sunday morning, I was working for a competitor at the time, and the chief executive's email had already found its way into my inbox through 12 layers of an organisation. So thanks so much for that, Mark.

But, and thanks from everyone for opening those markets.

42:09 How can organisations promote their investment in better authentication?

Mark Bramley42:09

What's important to understand as well, I come back to your organisation strategy. So some of the organisations I've worked with and support launches and things on were right for them. It's an international customer base.

Different proposition segments and behaviours were always be right for everybody in the east, have a TV campaign that referring to, that was more about supporting acquisition programme. It was just multimedia campaigns, online, TV, radio, little things, eventually just clicking, so I'm gonna join that organisation.

Yeah, that made the organisation do that. Not all organisations can afford to do that as well. So what is gonna be your attraction campaign to your customers to adopt things like, for example, Voice Biometrics? And how can you use it for new customers, and what are your activation enrolment strategies for new customers as well as existing customers?

There's different ways to be successful, and don't assume that one size fits all.

Matt Smallman43:15

Well, yeah, that's a great way to draw us to a close. I'm just wondering if there are any final questions on the chat or in the Q&A session before I thank Mark. I mean, Mark and I could

we probably will, after this is finished, sit here for another hour chewing the fat on various subjects. So I'm eternally grateful to you, Mark, for joining us and sharing your experience and expertise with the community. Thank you everyone who joined us live. There are some relevant resources

on our website, on the Modern Security Community website. And one I would personally recommend, but Mark may not have seen, is what I call the Security Path Visualisation, which is a tool to enable you to get that current state, to understand what your ID authentication rates look like and how that leads on to containment. You can find that on our website.

Looking forward briefly then, in two weeks' time, on Wednesday this time, not Thursday, we have Opus Research, who'll be telling us about the latest findings from their survey of more than 250 contact centre executives. So some really interesting, I've seen the sneak peek, so really interesting stuff there.

And then following that, we're going to Voice Biometrics in detail season. So we have Voice Biometrics 101, which I'll be presenting. We'll then talk a bit more about the threats, particularly topical, from fraudsters attacking Voice Biometrics directly. And then we'll go even deeper and talk about the risk from synthetic voices, which I know is very topical for people at the moment.

So you'll need to bear with us. That's currently scheduled for the 18th of May, synthetic voices, but we think it's important to put down the foundations before that. So understanding what Voice Biometrics is itself, understanding the total universe of vulnerabilities, and then jump on to that.

So Mark, thank you so much for joining us. Is there anything you just want to add or say before we close?

45:13 Is the investment in improved authentication worth it?

Mark Bramley45:13

Just, the investment and the effort to a successful launch of these kind of solutions is worth it. Financially, your business case will come through if you get your activation and enrolment strategies right as well. But don't forget about the other opportunities beyond those initial costs and for fraud plays as well.

Massive opportunities to improve your customer experience, to build profitable relationships through that as well. Don't forget about the long-term opportunities as well. The effort's worth it. And have some fun with it along the way as well.

Matt Smallman45:48

From a man who knows and who has the scars and the medals.

So thank you very much for joining us, Mark. Thank you everyone who joined us live today. And we'll see you next time. Thanks again.

Mark Bramley46:00

Thanks everybody.

Terms in this video