The Power of Mobile Authentication in the Voice Channel

MSMatt Smallman

I always think that a lot of how I characterise traditional security mechanisms is very effortful, like the security comes from the work you have to do.

It's like, I guess it's like Bitcoin mining or something like that. We prove who we are because we're prepared to work hard. But the truth is that when we work hard, we're quite fatigued by that process. And I've certainly seen from real-world clients, even though they may have the best natural language understanding and the most feature-rich self-service solutions beyond that

when they try to apply the traditional security mechanism, we'll talk about a few of those in a minute, customers are just tired by the time they get to the end of it. And they're not prepared to give the benefit of the doubt to these solutions that some of them really need.

Because whilst they are really good, they're not perfect and they're not humans, and people know that, and therefore they have a higher level of expectations. So traditional security processes tend to add a lot of friction to that process. And I think there's even some more specific examples, like, so I think, Sean, you were telling me the other day, like, if you try to ask for someone's mother's maiden name in a natural language understanding solution, there is an almost infinite number of permutations, combinations and pronunciations of that, and therefore it's nigh on impossible to do it successfully. I dunno if you've seen any other examples, Kane or Sean, that just don't translate, that work for an agent or face-to-face, but just don't translate across.

SMSean McIlrath

Addresses and phone numbers and things like that become very complex when you add in the more variables that you can in there. That's ideally why, like, a lot of folks in the past, while they do multi-factor authentications, stick with the last four social security, for example, in the US. It's more simplistic, but it's not necessarily more secure.

And I think what we all wanna move towards is a more secure but a more simplistic experience as the user there.

KSKane Simms

Yeah, although we've taken great strides forward as far as the technology. Natural language understanding is improving, speech recognition is improving greatly.

OpenAI's Whisper model is great, but it's not perfect.

And these speech models are not perfect. And so if you're gonna use things like information-based authentication, like your, you can probably hear my dog barking in the background. My dog's called Winston. A friend of mine's got a dog called Bo. Now, if your dog's name is part of your security questions, and the dog's called Bo, a speech recognition system might perceive that as Bo as in B-O, might be Bow and Arrow as in B-O-W, or it might be Bo as in Beau Nash, the old philanthropist from Kent, which is B-A-E-U. And so if you are trying to match a password, you need to spell that word correctly. And so a speech recognition system doesn't have a clue which version of Bo matches your actual password. And so it's really challenging to authenticate.

And Sean's alluded there to letters and numbers. That's traditionally difficult for speech recognition systems, 'cause if I say A, am I saying hay, as in the bale of hay, or hi, as in hi, hey? Or am I saying the letter A? And so these challenges are inherent with the technology, and you can't really break away from it. And the other examples is, you've alluded to biometrics earlier on. Now in a dream scenario, that is the perfect use case. Someone calls up. They just say what they need.

The act of saying what they need runs it through a biometrics authentication system, proves who they say they are. And they don't even need to go through any kind of authentication whatsoever, 'cause it's done based on the sound of the voice. But the challenge there is you need to know the proportion of returning customers.

Because they need to be onboarded into the biometrics platform. And so the first time you go through that, there's friction involved in that as well. And so it doesn't seem to me, at least, and obviously we're gonna talk about some potential solutions to this problem, but at the moment, everything that is being tried still has that element of friction.

And the last point I'll make is that you alluded there, Matt, to people's expectations. And although people know that we're talking to bots and AIs these days, the fact that these things are talking to us, we cannot help but anthropomorphise them. We cannot help assign physical and human traits to them.

Everybody calls Alexa her. Everybody calls Siri he or her, whatever voice they've got. And so we cannot help but assign human traits to these things, which raises our level of expectation even further, because we expect that when we have a conversation, the other person understands us, and when we say what we mean, people understand it as well.

And so there's lots of challenges inherent in that channel. One's technology-based, and the other one is human behaviour and attitudes and expectations.

MSMatt Smallman

And it's a, yeah, no, I'm not gonna try and say the word you said about making people human, 'cause I'm gonna trip over it. But I think you're absolutely there.

There are three things that I think about. One is the effectiveness of it overall. And we talked about those challenges with recognition rates and this, so how successfully can we complete it with confidence? And we know that some of these traditional methods are really challenging to complete that way.

The second is how much effort needs to go into doing it, how many repeats and all the rest of it. And then to what extent that sets people up for the interaction that follows. And I think your anthropomorphising comments, if I got that right, just plays to that. If they have to go through too much effort, they're not prepared.

Like, it's almost like they've written the service off as incompetent, and they want to speak to somebody else. So that then reduces their level. So even those people who are successful, if they were successful but it was hard for them, they are less likely to engage with these solutions and all of the efficiency and service or benefits that those solutions provide to the enterprise.

So it's really clear that traditional authentication methods are a big constraint for applying these technologies. I think, Sean, you were telling me about one-time passcodes and some of the challenges you've seen trying to implement those within a.

Technology decisions, theoretically, they're a lot easier. They're just numbers. But I think you were telling me the other day about some challenges there.

SMSean McIlrath

Yeah, I think there's a lot. Something just came to mind as I was thinking about it from, like, a past use case as well. But we often talk, and we're talking right now, about the machines, right?

Or the systems, right, doing the verification and not humans, but in actuality too, like at the root of security, I mean, you know this, Matt, better than anybody, like that humans are the biggest threat vector that you have really in any sort of security solution. And we found in a lot of the situations, depending on the customer care environment, that just verifying the identity of users is actually a very stressful thing for the agents in there.

So the more that piece can be automated, it's a better experience for everybody, 'cause just like Kane's example going through the different words that you might interpret it, humans are gonna have the same problem. It's not really just a machine-based problem, like you've got different dialects, acronyms.

You have that experience. So the faster and the more confidently the agent can actually have somebody verify to do their work, that also decreases the stress on their part. We've seen in the past with more automated but secure solutions to do the verification of identity.

KSKane Simms

There's one point, sorry, Matt.

I think another complication to add on top of what Sean was saying there, which is spot on, is that even the one-time passcodes, they seem fairly straightforward, but the issue is you're introducing another step in the conversation. Every step in the conversation adds a potential for that person to get frustrated, as you've alluded to, Matt, and just hang up.

So what you want is you wanna reduce the friction as much as possible. And even though, technically speaking, you're not asking them to change channel necessarily, because a lot of people are calling the contact centre on their mobile, sending a one-time passcode to their mobile and then reading it back is not a big issue.

But the issue you add is a conversation design issue, which is if I start reading a password out, and it says, read me the password I've just text you, and I start saying stuff like, 1, 7, 5, or actually no, no, it says if that's a six, 6, 7, 9. What the hell number is that? A human would understand that, but you can't write enough rules or process enough dialogue management to be able to make sure that you cater for all of those conversational nuances.

Google found in 2016 that there was 7,000 ways that somebody can ask Google Assistant to set an alarm. And so the amount of twists and turns with somebody making mistakes and stuttering, and actually, no, scratch that, I'll say it again. And you're just introducing far more friction than is necessary into the conversation, which introduces the risk of people getting fed up and hanging up.

MSMatt Smallman

So another two great points, and yeah, Sean, I completely missed that.

Yeah. The agent side of this as well, I think. To some extent, and as Kane said, agents are better at handling some of the ambiguity around these processes, but the stress that goes on them for doing that and the expectation that leaders sometimes have that they will spot the one fraudster from all of this messy noise out there

means that they don't really necessarily always give the benefit of the doubt to the customer. And I often see examples when I'm side by side with people in call centres of agents just, like, wanting to get through security. They're not really listening to the customer and their needs and trying to understand what they're really calling about, what emotional state they're in, what is their unwritten, unspoken needs, as well as the spoken needs. They're just, like, getting through security, because if I get that wrong, I'm gonna get a compliance failure and I get a black mark and I'm gonna be on a warning and I'm gonna be out the door. So it's a great point, Sean.

So thanks very much for making that.

MSMatt Smallman

Just as we think about how we transitioning to look at mobiles, like, there's a truth, though, in that SMS, as you were saying, Kane, like we are all calling call centres. We're calling everyone on our mobile. Our lives are sitting on our mobile.

I think I saw some recent stats, like the 80% of callers to contact centres in one business area were calling from a unique mobile number that was potentially already recognised by, I wanna say, so people are using their mobile, and there are some incredible pieces of technology on there that we could be using for security.

And I think that's a great point to start bringing Tim into the conversation, to look at some of the more specific challenges with SMS OTP, and particularly what Vonage and Ericsson are doing, and the industry as a whole really doing, to improve that. So thanks very much, Kane and Sean, and we'll come back to you guys in a second.

Hey, Tim. How you doing?

THTim Holve

Good, good. How are you?

MSMatt Smallman

Good. I think in our conversations previously, we've obviously, like, there's some things that we can all see related to SMS OTP that happen on the surface that we as consumers experience on a day-to-day basis. But I know there's more behind the scenes than just these usability challenges and potentially security challenges. What are some of the other challenges that you see from your position as a provider of these types of services and within the networks and supporting organisations?

THTim Holve

Yeah. So there is that convenience, it's disruptive, and the whole point with conversational AI and natural language conversation.

And some of the issues with SMS go into just the error of the code. A code in a separate channel introduces error. And the delivery, just getting that SMS delivered sometimes in international countries, doesn't happen. In fact, we had one customer who the conversion rate was not very high.

It was about sixty-five, mid-sixties per cent, just trying to get conversions, and it was big-box retailer. So that's revenue to them. And not only do they wanna eliminate friction to keep the sale going, but they want to make sure that it happens and not lose transactions, because that's revenue to them.

And we actually found out in some of the stats that we looked at for them that 13% of the failures were just due to error in the code, either the user put the code in wrong, or the SMS wasn't delivered, or it timed out, or something like that.

MSMatt Smallman

Interesting. And I think we've also seen SMS authentication process being used as a vector for fraud in their own right, haven't we?

I think there's, is it? Yeah.

THTim Holve

Yeah. Yeah. SMS, that it's just, it's on the rise since Covid-19, actually. Something called SMS toll fraud, where there's, call 'em virtual imaginary numbers, or they could be attached to, say, not a mobile phone, but some other software phone in a computer, where you really want someone who's calling in from a mobile number to be that person who

me, this is my number. I have a SIM card that identifies me. So using the SIM card to authenticate, that's a real number. It's registered on the network. It's been given entitlements by the carrier. And yeah, that's really Tim, is important. And so that's very helpful to getting rid of these fake numbers that are creating lots of fraud.

And you really wanna make sure that you're talking to the right person and someone's not trying to impersonate me and call in on my behalf.

MSMatt Smallman

Which was really, and it's been very timely for this session, actually. I dunno if you saw, but the US Cyber Safety Review Board published their findings of a deep dive of the Lapsus$ hacking attacks.

And they were pretty scathing about the dependence on SMS OTP for multi-factor authentication and just how easily that had been socially engineered, particularly through carriers and through telcos enabling SIM swaps with very little protection. And I think, 'cause we're gonna get on to it, I think it's important to make a very specific technical description when we say SIM swap.

That's not about changing the SIM, because the SIM, and we'll talk about this a little bit more in a second, is a very specific cryptographic component that sits within the mobile phone, either electronically or physically. And SIM swap is actually about moving the number to another SIM, not any changes to the SIM itself.

MSMatt Smallman

So, I know, Tim, you've been really close to some of the advances. Like, we all hear about 4G and 5G networks. And to some extent I think this is just an excuse to sell me a more expensive handset, but actually there's a lot of fundamental change happening under the covers.

I dunno if it is worth you sharing what some of the security implications of that are for our audience?

THTim Holve

Yeah, I mean, the security implications are great because you're reducing friction. Once I've given consent to, hey, check my SIM card when I call you, or when I'm in an app and I'm in there and I wanna do something, I've already registered and the app's gonna remember me, the company's gonna remember me, I've given consent to the company.

So for me it's great because it frictionless and it's more secure. We've finally gotten to not security by what someone knows, right? The information about you, but who you are, right? This is who I am, not what somebody knows. So it's not just information people can social engineer to get from me and pretend to be me, but they have to actually be me.

MSMatt Smallman

And I think that's a really important distinction between, SMS OTP purports to be like a possession-based authentication mechanism, 'cause you are thought to be in possession of that phone number. But in practice, phone numbers belong to the phone networks, and they are ultimately in control of the carrier in the telco.

Whereas a SIM card is actually in your possession. The cryptographic component of your phone is generally in your possession. We can do other checks to make sure it is actually in your possession at the time. But it's a very big difference, but can be very subtle and lost in translation if we're not careful about how we explain this.

So the new set of standards that are emerging through GSMA and CAMARA, which I believe Vonage and Ericsson are part of, are really interesting, and they really rely on exposing the security components within the underlying network. Like I always say, the phone company's always gonna make sure they get paid.

Yep. So they're not gonna allow anyone on their network who they aren't sure they are who they claim to be. And they're not gonna allow 'em to make calls

THTim Holve

or they know exactly who's real and who's not.

MSMatt Smallman

But previously all of that had been wrapped up in their internal systems and wasn't necessarily purported to the same standards, but now what we're doing is we're exposing some of those components, some of the underlying infrastructure, in a more standardised way to the world as a whole.

Yes. With requirements for customer consent. Yeah. With requirements to aggregate it. But I think that's a really, really important and significant change. And I know there are some early path products that you guys have on the market. I think one of them, one I was most interested about, was the Silent Authentication, which I think is worth talking about for a minute or two.

THTim Holve

Yeah. Silent Authentication. That's the first wave of identity management, I guess you could say, where it's tied to a trusted device. Like anything, depending on the level of authentication you get into, multi-factor can be a number of things. Right now it means only 2FA and OTP.

But if you guys say a transaction gets higher, you can start to use other network capabilities where not only is it, yeah, that's a real number belonging to a real SIM card, that this is actually Tim calling, but is Tim in the right location for this transaction? Right. Let me check with the network to see, has the SIM been changed in the last two months?

Or could there be a possible SIM swap, so you can start getting information like this, having multi-factor authentication and use more than one vector to actually confirm the identity and really take the burden off the agent or the person who is trying to get through security.

MSMatt Smallman

Yeah, because the thing I really liked about Silent Authentication, as we looked at it a few weeks ago, was how I can actually be confident that, like, I can set up a code and be confident that, because the carrier tells me that, that IP packet with that code in is actually coming from that device.

And it is coming from an on-network device that is asserted to be the one I want to speak to. And that in many ways removes all of the requirement for the SMS to be delivered, for the SMS to arrive, for the user to transcribe it, for them to correctly key it in, and for you to correctly check it back against it.

It can all happen silently in the background. Now, I know there's some constraints with the technology today, so you need to be on network, and it is in many cases therefore dependent on an app-based usage, because we can make sure the device is on network. But I think for me, it's just the first sign that carriers and device manufacturers and network infrastructure providers are serious about extending their internal security architecture in a way in which enterprises can use it.

And I'm really looking forward to the next few years as some of these standards and ways of working and device manufacturers incorporate them, such that in the future I'd love to be in a position where, and I think we're not far from it now, where number A is purporting to call me, and because I can prove that I am me, I can check that it really is number A that's calling me. And if number A agrees, I can effectively get a fingerprint from their SIM cards such that the next time number A calls me, I can know it's the same person who called me again.

And in many ways, that moves us away from, what in security and authentication and fraud prevention, we've had a very probabilistic period. It moves us to a far more deterministic period, like that is the same SIM card that Tim Holve called me on last week. And therefore the chance that that is Tim Holve are very high. And therefore, I don't need to ask him his date of birth. I don't need to ask him his mother's maiden name. I can move straight on to solving his reason for calling with some of the great tech that we've talked about with Kane and Sean a minute ago.

THTim Holve

Yeah. And you.

In this scenario, there's no user action really required. You can just ping it and determine it. But I think, as fraud has really become a worry, I think it's a great opportunity for a lot of these companies to use something like that. And then during that process, start to show them, I'm using your SIM card to authenticate you and verify it's really you and the number.

And give them a, because you just wanna know, wanna be educated that my financial institution is really checking that it's me and reducing fraud, because I'm concerned about people impersonating me or stealing my identity. And so we can give a message saying, hey, I just authenticated you through your SIM card, or however it is that you're educating your user that we're taking steps to make sure you are who you say you are in getting the correct identity.

MSMatt Smallman

I think that's really interesting. It's parallels to where we were with things like Voice Biometrics maybe a decade or so ago, when the technology's there and it works, but we just have to figure out the business and customer processes that create the right experience, that get people through that.

MSMatt Smallman

So with that in mind, I think it's worth adding Kane and Sean back to our conversation to just think about how some of the technologies you've heard about and some of the other innovations that are taking place in the security space, how do you think that changes the call centre?

For the future, how do you think that changes security and authentication in the call centre? I dunno. Kane, let's start with you.

KSKane Simms

Definitely. Thank you. Yeah. I think the big thing from what I'm hearing is that, for me, it's all about customer experience.

It's all about the design of the experience. And whenever you introduce friction into that experience, you're setting yourself up for a potential failure, and enough points of friction across a customer journey is enough to make people give up, as you suggested earlier on, Matt. So anything that's gonna reduce friction for me is definitely where we need to be looking at, anything that's gonna reduce time and effort also.

And so these solutions are absolutely straight up my alley. I think that the potential to be authenticated without having to do anything, basically, that was the promise of Voice Biometrics. That is what, that was my hope, really, is that someone could just call up, say something that would authenticate them and then move on.

But if we can do it in the way that you've described, then that's great. Nobody makes a phone call to go through that pain of having to prove who you are. And to be honest with you, I've actually called some places where they're asking me for certain passwords or whatever, and I don't actually know what they are.

I can't actually get into my own account for this company 'cause I don't know what these passwords are. So I think, yeah, absolutely. Anything that's gonna reduce friction and streamline the customer experience absolutely gets my vote.

MSMatt Smallman

I love that. And I've used that many times.

No one calls an organisation to prove they are who they claim to be. They're called with a reason, a need, yeah, that they want the organisation to solve. And the first thing we do is say, well, prove who you are. Which is very disruptive to that customer experience.

THTim Holve

Yeah. My favourite one was, what's your address?

And you give 'em your address and you just figure it, that's enough, and you don't give 'em the zip code and they wait to, I need the zip code as well.

KSKane Simms

Yeah. Or you give them the address and they say to you, that's not your address. I'm like, that is my address. He's like, that's not the address we've got.

I think, well, you've probably got an old address. Yeah.

MSMatt Smallman

I think some of those challenges are real, but I do think the promise, or you talked, Kane, about it, like, we absolutely have organisations, and actually some of them are on this call today, who have implemented solutions like the ones you described in high-risk industries with long-running relationships where there is value in investing in the highest available forms of security.

Then things like Voice Biometrics and natural understanding, that, like, when they work together, it is a dream, but as you said, like, we have this, it's a cost associated with enrolling people. There are privacy implications with handling and managing that data. And many organisations, either it is not applicable for them or they don't want to, or it's just not worth the effort for them.

So for everyone else, though, they're, we've been stuck with these half, what I call second, transitional methods like SMS OTP or even PINs and passwords to some extent, where we're trying to move away from the stuff we did face-to-face, and we're trying to do that stuff where it's a bit more automatable and a bit more secure.

But in nearly every case we do that, we're trading away usability, and usability is the thing we can't afford to lose if we want people to engage with the first generations and even the following generations of the natural language understanding solutions and the voice AI that we've talked about.

KSKane Simms

I think so. Sorry, Matt, you touched on something there which is important, is that what we've done in the past is we've tried to, like, replicate the processes that people have. Whereas what we need to understand now is that there is far more potential in using technology to do things a lot better.

And, like, people have concerns about privacy. Everyone has concerns about privacy. Everyone has concerns about where's my data going? And all that kind of stuff. But what you'll find is that people are quite willing to give up data. They're quite willing to give permission for a company to use data, like data that's on their mobile phone registered to them, providing they get a benefit from it, providing they benefit somehow.

And in this instance, they benefit immeasurably because they cut out, like, it's painful enough having to call a contact centre. Like, unfortunately, we don't really wanna admit this, but people don't want to call your contact centre. It's the last thing people want to do in their day. And when they do do that, you add friction after friction point, after friction point, where they're waiting on hold for half an hour, and then they have to go through it, answer all these questions like an exam, and it's like all of this just to do something that they didn't wanna do in the first place.

So the question is, oh, would people opt into this, and would people share data? And I think you'll find that history shows people are willing to give up, or at least give permission rather, for companies to utilise their data in this manner if they can benefit from it. And I think if you combine conversational AI, which removes the wait times, with the technology we've been discussing today, which removes all of that conversational friction, for me, that's an ideal combination.

MSMatt Smallman

Now, I dunno how to follow that. So, you're right. Absolutely right. Sean,

SMSean McIlrath

You've been saying a lot stuff like here too, and like, just try to simplify it back down. Right. Like, in a lot of ways, like knowing your address, your phone number, or your social security number, like anybody can know these things.

So, like, what I really love about the solution is at its core, it's more secure. It's gonna be something you have on you. I know plenty of people, including myself, that don't even carry wallets anymore because we have Apple Pay and different credit cards that are connected to our phone. So if it's secure enough to make financial payments from, like, in person, like without requesting your ID, it's definitely at a minimum gonna be more secure in a more automated fashion. Right. Kane struck on something there too, that without making it overly complicated, like, obviously the overall experience, some of the forkiness, if you will, for it is really just based on the technology being coded down many different paths to try to take users to, and then maybe something stitched together, and having something that can be automated along the journey can prevent you from

going through that, like I'm transferring to a different agent, or I'm now doing a different thing and I've gotta go do the whole verification thing again. I mean, there's no question that's upsetting. When you're like, even if you're getting good customer service, and it still happens today, annoying.

You know what I mean? Like that you're like, I just did this. And again, I just think there's a better way when you look at the devices and how you're associating with it, and like, I know that some of the things behind the scenes that companies will use too is not just the SIM cards and the verification there, but they've got identity graphs and they understand how those are associated with numbers, and that can now lead to better outbound experience.

'Cause I'm sure you've all had the conversation where it's like you get the cold call and you actually answer your phone and they're like, tell me your social security number. You're like, I'm not doing that. Like, this is crazy. You called me. So I think across the board there's an ability for these technologies to work together.

Like I was saying in the beginning, to simplify this experience. Like when we look at, like, the verification is tough for conversational AI and humans, honestly. Like, I would say that the humans don't quite have that figured out either. Like, we're literally talking about why it's not great in that situation.

So there's a chance for improvement across either function. And the service and the role of conversational AI is really to get you to where you need to go very easily and get your problem solved.

KSKane Simms

That's a great piece there, which is being transferred from one person to another and having to reauthenticate is a pain.

But yeah, when you get the phone call and you answer, and it's like, I'm calling from such and such, can you just confirm your address, please? It's like you should know that, you're the one calling me. Like, what is, like, I'll be interested in how this could be used also on the outbound front, as Sean was alluding to there, to get rid of all of that.

'Cause that's the first thing, as when you pick up the phone and someone's quizzing you about all this information without even telling you what the phone call's about. It's jarring. It's like, what's going on here?

MSMatt Smallman

Yeah. I think you're absolutely right, Kane. And when I look with my fraud hat on, the consumers are becoming the biggest vector for attack of every description, because they don't have the advantage of some of these technologies and the thinking that goes into security at the enterprise side. So actually, whether it be deepfake voices or SIM swap or number spoofing, that, like, consumers are so much more vulnerable than enterprises too, and they can give out all that information that can be then used to compromise the enterprise.

So, yeah, I agree. It'd be really interesting to see how some of this same tech can be switched round and put back to the consumer. How can I, as XYZ Bank, assert back to my user that it really is me calling? And therefore they don't have to worry. We don't have to do this mutual authentication dance that disrupts the whole reason for calling.

And there's many of the reasons why you just don't, like, you don't even answer it. I think in the US it's far more prevalent in the UK, but, like, most people I know in the US, like, they will not answer the phone from a number they do not recognise because spam calling and the like is so more prevalent, and STIR/SHAKEN hasn't really changed that in the way we thought it might.

Sorry, Sean.

SMSean McIlrath

I think there's also, I mean, again, I think this hits multiple areas, right? Like, it's a better experience for consumers either way, inbound or outbound, can definitely enhance that. But enterprises too, why it's not as prevalent, right? Like, in the EU is GDPR.

So, and I think this solution also helps solve for location. When we're looking at these types of things and can triangulate there, and really, again, like when you look back through, like, knowing that this is a live user, and that in theory, like, as a, say, like a telco calling out for outreach and stuff like that, like we have FTC compliance and regulations here that are quite significant in terms of penalties if you're calling the wrong people and they're not really opted into those types of things as well.

MSMatt Smallman

No, fair point. So, no pressure, Tim, but productising these new set of, the range of services and the stuff that's available, is a huge opportunity. I think we've talked about, I'd go to questions from our participants right now. So if you've got any questions, please feel free to drop them in the Q and A or the chat feature.

MSMatt Smallman

I've got one that's come in already, and it's really about, when organisations are thinking about implementing new security methods, what are the things they should be thinking about? And I know, Kane, you've already half talked about the user experience. That user experience is important. What other things should enterprises be thinking about, or organisations be thinking about, when changing their security processes?

KSKane Simms

I mean, I'm the first to confess, I'm not a security expert. So in terms of, like, if I was gonna go through a process of putting this kind of stuff in place, I'd be calling on someone like you to be talking on us.

Matt, my concern. Yeah, there you go. My concern from, and Justin, our CTO, would certainly be a lot more eloquent in his response, but my concern as the strategist in design, it is first and foremost the customer experience. And you are always at pains to push through a solution that works for the customer.

Because the issue with things that work for the customer is because sometimes they are a nightmare to implement for a business. They always say that good design goes unnoticed, and also good design is harder to implement because you have to reorchestrate and re-architect a whole bunch of backend systems.

The one thing I would say from an automation perspective is that if you are wanting to use the AI technologies that myself and Sean have been speaking about, then the main thing, and Sean could probably speak to this as well from an Artificial Solutions point of view, but the main thing is, when you're selecting that kind of technology, that you've got a platform that's open enough to be able to implement these kind of things within the conversation.

Because it may be that during the conversation, you might not want to authenticate someone straight away. Someone might call about one thing and you can just get on with serving them for that use case. But then later on their needs develop and now they have to be authenticated. So you need to have technology that's got the ability to pull that authentication capability into it.

And so you want, definitely, from the AI automation perspective, an open platform that allows you to integrate and all that kind of stuff. But for me, as I said, first and foremost, the main thing is considering the customer experience and doing something, even if it might mean that you have to do a bit of hard work in the background.

Doing that work is a net benefit because it improves the customer experience. You want the most frictionless journey possible.

SMSean McIlrath

I fully agree with Kane on that. I mean, it's experience, not really bias, just doing, basically working with conversation AI solutions for about 15 years now.

I think to me, like, in many cases, like, the solutions are totally fine within the cloud services for speech-to-text, text-to-speech, NLU, like these features. The problem is really accuracy and certainly security in terms of the verification of things. And that's where we, from my perspective at my company, we come in and basically enhance the accuracy across those native services, which, in a very simplistic fashion, is that the machine can only understand eight outta 10 words that you're saying in general and figure out the intent.

It's really hard for you to get whatever you need to have done, and the workaround for that limitation, and also with security, is that you just keep creating very complex workflows, which is why you are in that keypad experience, even if it's not keypad dialling, where it's, where do you want to go?

It's just keep routing you down basically a maze to try to isolate by probability what you need to do, and that doesn't really work super great.

MSMatt Smallman

No, great. I mean, yes, there's almost an absolute insecurity. But really security is a function of adoption. Like, if people don't use it, then the security value is pointless.

And adoption in nearly every consumer-facing security method is a function of usability. And as Kane says, like how effective we can make it use, like, we are probably, despite everyone's best wishes, we are probably never gonna turn off passwords or mother's maiden name and the like, because at some point there may require a lowest common denominator authentication.

And yes, we'll have to dress that up in lots of things and do lots of fraud prevention around that. But if we want to improve that aggregate level of security in enterprises, we need consumers to adopt more secure methods. And that is a function of their usability, and SMS OTP is not a particularly usable method in the phone channel.

In the voice channel, whereas using the phone that they actually are already calling on, the cryptographic properties contained within it, is a bit of a no-brainer. So we just need those services to be exposed to us, and we'll be off to the races, figuring out what the usage and the optimal patterns should be.

So, unless you've got anything you want to add to that, Tim, I think it's probably time we drew this conversation to a close. Thank you so much. Everyone who's joined us live today and who's watching this on a recording, thank you to Sean for your contribution, to Kane, and to Tim.

I'm really excited about the potential of mobile authentication and the use of the mobile device to make these voice channel journeys far more seamless. So again, thank you very much, and we will see you all next time. Thanks.