How to Maximise Voice Biometrics Adoption

MSMatt Smallman4:53

Let's just look for minutes at two different approaches to registration in general, and they fall into two broad categories, and we'll talk about those in a bit more depth. Reactive, what I call reactive, is the most widely deployed today, where the registration process is initiated as a result of a customer contact, usually an inbound phone.

It can be completed through an automated or agent-assisted means. In the automated form, the IVR might complete nearly all of those process steps. In the agent-assisted means, it might be the agent who completes all of those steps, or it may be some hybrid between the two, where, for example, the service may be offered in an IVR, but capture and potentially consent are captured by an agent.

The disadvantage of this approach is, of course, that it inevitably delays the point at which value of Voice Biometrics can be realised until the next interaction; they have to call back in order to realise the value, which leads on to the second approach, which is called proactive, where we're attempting to register the user in advance of their point of need for Voice Biometrics for authentication.

This could be as part of an onboarding process. It might be through using a dedicated registration phone number and customer communications. It might even be using other channels, such as a mobile application or even online, in order to capture enrolments and registration before the customer needs to call.

Which all sounds very promising, but the challenge is engaging customers proactively; you're likely to struggle to engage them. Typical open rates on emails are in the 10 to 15% range, and click-throughs and actual activations from those are just a fraction of that number. If your organisation can get customers to do things in these processes, then it's likely that they're gonna have other priorities for it as well.

And I often look at the onboarding process as an example of this. Onboarding is a high-value business process and most companies will want to make sure that it has as few steps as possible because every step in onboarding is an opportunity for the customer not to take the product or service.

And therefore, adding a Voice Biometrics registration step into onboarding is likely to cause a reduction in the end-to-end success of the onboarding process; even if tiny, it's unlikely to be viable for many businesses. So that leads me to my third tip: whilst helpful, particularly if targeted, don't bank on proactive registration processes.

The majority of registrations are likely to come from reactive registration, particularly as that's where the pain point is and the natural incentive for the customer. So spend most of your time and effort optimising those processes.

MSMatt Smallman7:34

In another session, we talked in some depth about privacy regulations and how they apply to Voice Biometrics. So I'm not gonna go through that in too much detail, other than to bring up this slide, a version of which I've used before most of these regulations even existed. It represents the spectrum of options for approaching capture, enrolment and registration, ranging from, on the left-hand side here, not telling customers anything, making some small changes to terms and conditions, through, on the right-hand side, to actually waiting for written consent or even for the customer to explicitly ask rather than be offered the service.

Clearly, you can see that as we increase the optionality, the take-up rate is likely to fall down. Now, I always used to refer to this area on the bottom left as just plain weird, and usability testing has borne that out time and time again. So, regulations aside, there is a clear sweet spot in the centre of this chart for the design of your registration, enrolment approach.

And it usually sits, depending on the regulations, somewhere between an assumptive request, i.e. telling the customer what you are doing and waiting to make sure they have no objections, through to explicit consent, as is required in many European and US jurisdictions, where the customer must actively agree to the service.

So this is clearly the sweet spot, but I would reiterate my... Tip four really is respecting your customer's right to choose, even when the law doesn't require you to explicitly ask for their consent. If you don't ask them to use the service, they are likely to be lower advocates of it in the future and have less understanding as to how it might work.

The further you get down to the left of this chart, even if legally supported, the more likely you are to experience issues later with the service. So respecting your customer's right to choose is tip 4.

MSMatt Smallman9:26

Which leads nicely to the differences between offer and consent, and where consent is required. I find it generally most effective to split the offer and consent step processes up, with offer preceding consent, because the offer is the sales bit; it's when the agent or automated system describes the features, benefits of the service before the legal bit, where we need to formally agree something.

If consent isn't required in your jurisdiction, then you should still offer the service and give customers the opportunity to object, as we discussed. And this is just about being respectful of their right to choose, and ultimately makes them better users of the service. Crucially, and this is the crucial piece, the offer step, separating it from consent, particularly with agents, allows an opportunity for the customer to object before the legal term starts, and for the agent to handle that objection, which they can often do effectively.

So tip five is separating the offer and consent step. Except, and here is the caveat, in automated applications, where experience has borne out that asking customers more than one question related to Voice Biometrics in an automated system has a high propensity for them to say no to the second time. So trying to combine a brief offer and consent step as one single step in an automated application has proven to be the most effective.

MSMatt Smallman10:46

But that leads on to the next important point about... On the subject of wording, let's take a look at this consent disclosure. I think you can agree, obviously written by a lawyer. Pretty scary and probably confusing to most customers compared to a second option, written in plain English and followed up with a letter or email explaining their rights to deletion in more detail.

In most cases, as you need agents or an automated system to read out the disclosure verbatim, and actually needs in some cases to prove that customers understand it, it's far better to make sure it's written in English. So please make sure it's coherent. Here are some other examples of language that is likely to confuse, scare or negatively influence customers.

Whilst all these words might be technically accurate and well understood internally and by your project teams that spent a year or more implementing this stuff, I can guarantee that when you put them in front of real customers, they're likely to cause problems, and not just with your customers. If you have hundreds or thousands of agents to train in the enrolment and registration of this technology, then they are also likely to cause confusion.

Better than that. Words like... instead of Voice Biometrics, try 'Your voice is like a fingerprint.' And this is the top tip I give to everyone time and time again in usability studies and speaking to customers. For some unknown reason, everyone has an innate understanding of how fingerprints work.

And when you say, 'Your voice is like a fingerprint, we'll use it to confirm who you are,' or words to that effect, it instantly creates this connection in people's minds that allows them to accept how it works and gives them a level of understanding which enables them to make an informed decision.

Again, whilst enrol might be the technical description for the process of creating their template from the audio that can be used for subsequent authentication, it can be confusing and even for bearing to customers. Several clients of mine have tried many variations of this, and words like activate or register seem to have the highest level of recognition from clients.

And finally, the word consent itself has a number of negative connotations, or difficult connotations, in the English language and in current affairs. And therefore far better to use permission. They have effectively the same meaning. They are better understood and come with less of the overhead associated with some of these other words.

So tip six is, again, like two, using words carefully and, for a bonus, using them sparingly. As I said, I listened to thousands, now it must be, of agents enrolling customers, and I've lost count of the number of times I've heard agents talk customers out of taking a service when they initially agreed.

So you can hear in the background, you can hear the agent launch into their spiel. You can hear a customer agreeing, going, 'Ah-huh, yep, I could do,' in the background, and then by the time the agents finish their two- or three-minute spiel, the customer's decided it's not for them because of something they picked up on or sheer frustration with the process.

So use words carefully and sparingly.

MSMatt Smallman14:00

This diagram is my security path visualisation, and I highly recommend it. I use it to understand the end-to-end performance of the identification authentication process in an enterprise. A hundred per cent, of course, come in here at the left and pass through different ID and authentication steps before coming out here on the right.

So if we follow the top branch, the automated identification is successful, automated authentication is successful and customers have an opportunity for self-service. If they don't succeed in automated authentication, they often go to an agent, which can be success or failure. And if they don't successfully identify automatically, they'll probably need to go to an agent for manual identification and manual authentication that follows.

And there are positive and negative outcomes to each of these processes. You can draw your own tool on my website at symnexconsulting.com. But for today's point, I'd like to make clear, like, it's very obvious that placing the registration process here, where 60, 70% of customers pass, is a very easy place to put an active registration process in an IVR following automated identification,

automated authentication. It will capture a significant proportion of customers and require little or no agent effort in order to enrol. But what about these channels? These are where customers failed to authenticate in automation or didn't even identify in automation. Ultimately, these customers experienced far more pain, are likely to be using more challenging forms and knowledge-based authentication and, perhaps more importantly, spent a lot of agent time going through steps that could have been better spent solving customer problems.

Customers in these are really high value for enrolments in Voice Biometrics because if we get it right, they can move from this channel, which we call C and E, up to channels A and B. Later, they'll have an opportunity for automation when they didn't have one before. That's even better than saving 20 or 30 seconds through manual authentication; that's saving an entire call.

So tip number seven: it's about covering all your bases. Don't just look for the obvious path. For registration, enrolment, look at where the most value from registration and enrolment can take place. And again, for a bonus, make sure that's as close to the pain as possible. We haven't talked about this in significant depth and won't do today, but on both these paths, C and E, customers will have experienced quite a lot of pain from the manual authentication process.

They'll probably fail to authenticate in automation, fallen out to an agent. They may have waited in a queue for longer than they wanted to, and they would have to go through that kind of turn-based approach to authentication and may well be frustrated with it. If you wait until the end of the call to ask them to enrol in Voice Biometrics or to register in Voice Biometrics, then they are less likely to say yes than if you

follow up immediately after authentication with something like, 'So you don't have to do that next time, please can I enrol you in our new voice biometric service?' They're far more likely to say yes at that point than they are later on in the call. And we have the data to prove that.

MSMatt Smallman17:09

So having designed the best possible registration process, it's important to make sure that you can optimise it. I promise, and I have never got it all right out of the gate; you'll definitely need to learn from your experiences because, as we said at the beginning, we might start with what looks like the most optimal process, we might

even take that to customer usability testing, but until it really makes contact, customers and your real operating environment, you won't know which bits work and which bits don't work. Unfortunately, there were just so many steps that... Without a robust measurement plan, it's difficult to know where to improve. Are your lower-than-expected enrolment rates

the fault of the technology? The wording you use when you offer the service? Over-cautious eligibility rules? Or just less customers than you expected actually getting authenticated and starting the process? Without the data, you won't know where to start, which is why tip 8 is planning measurement as part of your initial design.

It's important to note that your technology provider will only probably be able to tell you about this final step. They'll only be able to tell you how many callers they have ended up enrolling as a result of you asking them to do it, and generally that number will be very high. There are very few reasons why a good quality sample of audio cannot be turned into a voice print.

There are many reasons why customers may not give their consent. There are many reasons why agents... offer enrolments. There are many reasons why more people than you might expect may not be eligible for a service. So unless you're able to measure this end-to-end process, you won't know where to improve it.

MSMatt Smallman18:47

And with good data, you're able to see the variation in performance between agents, and this is most applicable to, obviously, the agent-assisted approach. In this example, end-to-end consent rate between eligibility and consent was 24%. And that might sound really bad, but it's not uncommon for the early stages of implementation because we have the data.

In this case, we can dig into more depth and we can see that on the agent offer rate, there are a handful of agents... even ask a single customer, and it's likely that they're experiencing some form of technical issue or that they didn't receive the training or they lack any confidence at all to have the conversation with customers, an issue that can easily be addressed and move them into the median level of performance.

We can also see that it's entirely possible, as a majority of agents actually offer the service to nearly every caller, and therefore we can set expectations that 80 to 90 to a hundred per cent offer rate is to be expected. When we move over and look at the consent rate, however, we can see, again, there's a far broader curve.

As with everything in a contact centre, there are gonna be high performers and low performers. But using data like this, we can easily identify the two or three superstars here who are achieving close to a hundred per cent consent rates and use their experience to move the median performance level up, as well as using this data to address underperformance in the lower-performing

agents. So tip nine is about setting realistic expectations and holding people to them. This, unfortunately, is not a technology problem. Technology can provide the data, but it's a leadership task in order to ensure that the individuals perform as they're expected. But if you set them unrealistic expectations, they are never gonna be able to achieve them.

So use the data to set those expectations.

MSMatt Smallman20:43

And I never intended this to turn into a pitch, but as I reflected on the session in a bit more detail, there was so much I couldn't bring out to talk to you about. I'd love to show you some templated process maps, some more wording in a bit more detail and how to manage agent performance in significantly more detail.

But unfortunately there just wasn't time to fit that into our brief session today. So my final tip, and also because I needed a round number, as tip 10, was to buy the book. Now, normally I would have a guest joining us today so that we could discuss their particular experiences with this.

Unfortunately our guest that was planned for today was unable to join us, so it's just me and our participants, of which there are many on the call. So I'm hoping that as we go to the next slide, there will be people who want to ask some questions, give us the benefit of their experience. So please throw either into the Q&A session or the chat window

any questions you might have. And there are lots of people on the call, so I can't believe there aren't any.

Maybe there aren't any. Maybe I've covered every available topic.

MSMatt Smallman22:11

Okay, great. We do have a few questions. So Dan Miller of Opus Research has put into the chat: is it difficult to get agents to buy into new steps or to add to their script? And I think this is a really important question. Some of the challenges we see, particularly with agent-assisted enrolment, are where we try to handle it as an exception, as something that's only done occasionally.

I think there's a level of activity that is needed in order to achieve competence. Most people who work in contact centres, most agents, they have their patter. Sometimes this patter is mandated to them by the organisation, but many times it's just how they've got to work with clients.

They work through the different steps, the process. First I must identify them, then I must find out why they're calling. Then I must do this, then I must do that. And before they go anywhere else, I must ask them these final questions. And we find it far easier to help them integrate Voice Biometrics enrolment into that process so that almost by default, after they've completed knowledge-based authentication, they move into that.

'So that was really hard, but we've got a new service that will make it easier next time you call. Would you like to set it up?' And we find that works really well when customers don't get to do that. We find it hard for agents to remember to do it, and we find ourselves coming up with all sorts of complex schemes to prompt and flash things on their screen in order to remind them.

MSMatt Smallman23:41

So that was Dan's question. Okay. We've got a few more coming up in the chat, so I don't know where to go next. Yeah. So we've got a very good question about effectiveness of enrolment with agents versus IVR: if a company has capability for both, is there a better route? Well, traditionally, we've seen active

Voice Biometrics using phrases like 'My voice is my password' mostly be enrolled using an automated method, but as I think I showed on my previous slide, if you just do that, then you are dependent on customers having some means of authenticating before they get into the enrolment step, to the registration process,

and that also means that you're getting in the way of having their needs met. So whilst they're still talking to the IVR, they're still thinking about being routed to the agents, have their needs solved, or to the self-service feature. By throwing this up in the middle of their conversation, you're often getting in the way of that.

And there can be a tendency to think it's gonna take more time and effort than perhaps it is. So generally we see... which compares sharply with when they're speaking to an agent. So when a customer is speaking to an agent, they have some degree of confidence that they're now speaking to a human and that their

problem is going to get solved for them. They also have some emotional connection with the agent, which is different to the IVR, in that they want the agent to help them. So their propensity to agree and consider fairly anything the agent presents to them is higher. Plus, usually, with the passive form of the technology that we implement with agents, it

easier. The customer doesn't need to do anything. The customer just continues to speak and the enrolment is created at some point during the call. And therefore, traditionally we have seen lower levels of consent and offer acceptance and consent in automated systems than we have with agents.

However, the challenge is that agent conversations clearly take time and money, and the agents need to remember to. So there is no one right answer here. I think the answer is a hybrid between the two. And we are working with this in a number of situations at the moment where, if possible, we offer the service and we ask for their consent in an automated fashion.

We collect enrolment if possible, but if we can't do that, then we use agents as well to have that conversation. And then finally, if we need to, we can put them back into an automated system that captures any fixed-phrase passphrases they... So I hope that answered the question in the Q&A.

MSMatt Smallman26:27

Okay. We've got another one in the chat. I'm just gonna read it. From Noah: 'When I'm talking with people about VB, I inevitably hear concerns, resistance around the security of voice prints. Can't someone just fake my voice? What if someone steals my voiceprints? Do you have any perspectives on this, helping people overcome those objections?'

Yeah. And I think that this is a very live and current issue. And I think objection handling is also the key to this. I generally find people, I mean, I think this is a well-established psychological fact, that people exist in two broad buckets. There's the action-orientated and it's more reflective-orientated people.

You can imagine when a customer calls a call centre, they were calling to have their problem solved and we suddenly offer them this new voice biometric service. That was not something that was even on their mind when they dialled the phone number. Some people will be able to understand process and accept that at face value.

During that interaction, many people will require some more time to consider and evaluate it. That may just be a few seconds, it may be a minute or so. They may be able to reach a conclusion before the end of the call. But I think handling people's objections, giving people an opportunity to raise those objections early on, is really important.

So the specific objections that Noah's talking about? Yes, these do come up. We often find that they're in the buying-time category, that people feel that they've been ambushed, maybe, and need to come up with something in order to buy themselves time to evaluate and make an effective decision.

And often... and they're very similar to the most common objection we see, which is like, 'I'm happy with the existing process.' So they're happy with the existing process. Challenge is really because they haven't had time to think about or process that technology. And they don't really understand the vulnerabilities of knowledge-based authentication and what the implications of that to them might be.

So yes, we do see these objections around voice prints and deepfake AI. But I think when you ask customers to take a step back and realise that today their accounts may just... secured or protected by their mother's maiden name, which is probably... and their date of birth, both of which are probably readily available from Facebook or that they've given and shared with hundreds or thousands even of different organisations, then they're able to make a more reasoned decision.

I would never say that Voice Biometrics is foolproof, is completely impenetrable. I would just say that it's a significant improvement in security over traditional knowledge-based authentication processes. It makes it significantly harder for fraudsters and imposters to access your accounts.

And that's how I tend to handle those objections. We try to advise agents really not to get into long-winded conversations: pros and cons of this technology. There are always a hardcore of people who will not want to, for a variety of reasons, use this type of technology, and we need to respect their rights and also not waste too much time trying to convince them otherwise.

So I hope that answered that question.

MSMatt Smallman29:51

Okay. I am just gonna see if there's any more in the chat. Okay, someone's asked a really interesting question about a good cost per authentication. So I'm not sure we're really covering cost per authentication here. I do think there's a cost per enrolment that's often missed in the business case for this type of technology.

Obviously you need to pay for the IT and the technology integration, but actually the time and effort required for an agent to have that conversation with a customer is a cost. And I often talk about the payback curve. It's like, particularly when we turn on these types of technology, will obviously be in negative territory for a few weeks or months until the volume of users has increased such that we start saving time and money.

MSMatt Smallman30:51

Okay. And then I had one final question in the Q&A: the length of voice sample changed over time. Yeah. So I think that this is often a concern we see from people, that there isn't enough audio on the phone call that their agents are having with customers, and we just don't find that to be the case.

Like, I think by the time you've got through knowledge-based authentication, explained your reason for calling and had that dealt with, you're likely in the 20 to 30 seconds of customer speech space. And with most forms of this technology and most vendors, it'll be possible to tune and optimise systems such that that will be sufficient audio.

There will obviously be a few that need to drop off at that point. But I think that's a legacy issue. So somebody else has asked in the chat, have there been any research and specific terms to avoid when agents... with an agent's guide towards enrolment?

Well, there are definitely some in my book, which is just here. But I really... phrases like biometric is a really misunderstood and mischaracterised phrase, and has all sorts of implications for people. So I think that would be the top one to avoid. Explicit consent

also has negative connotations, as I discussed, so I would tend to avoid that. I would always advise agents to use some form of quicker, easier or more secure as their default sales pitch. And we work with clients on the specific proposition on how that works for them.

Okay. So we've had a ton of really good questions there. And I think that's probably about all we have time for this afternoon. So I'm gonna move on to our final slides, if I can find the right button below me. Apologies. So just want to do a quick look forward to some events we have coming up.

MSMatt Smallman32:57

So the Modern Security Community, newly renamed, previously the Modern Customer Security Community, but people found that a little bit of a mouthful. So we've renamed a Modern Security Community. We host events usually every other week at about this time. And usually they're a little less formal than my presentation today.

Today, we were expecting to have a guest and unfortunately he couldn't make it. In two weeks' time, we are gonna move on to a slightly different topic area where we're gonna look at network authentication, and we're doing a 101 really on network authentication, how it works and how it might be implemented in your call centre.

And that's following on from the session that Andrea from Lloyds Banking Group gave us two or three weeks ago, where she talks about their implementation of this technology. And we'll be joined by Chris Wade from Smart Numbers, who's been leading their development of this technology.

And he'll be able to answer some questions on that, and I'll be giving us a high-level overview of that topic. We'll then move on two weeks later to a panel discussion where we'll be joined by a few business leaders, where we'll talk about how to make the case for better authentication in your organisation.

And then hopefully the team from Opus will be joining us to discuss the findings from their 2023 Intelligent Authentication Survey, which I have had a benefit of a sneak peek of, and has some really interesting findings as this technology evolves that should be quite actionable, both by end users and by solution providers.

And then finally, we'll be moving into a new season where we'll be looking at Voice Biometrics 101, which will be a bit of a primer session, often how I'd start with clients, giving them a high-level discussion. And then we'll be looking at the Voice Biometrics threat, which is really topical right now.

I know a few articles and a few bits coming out from the press about different forms of synthetic voice and other threats to Voice Biometrics. I think it's really important to put all those threats in the context of the entire range of vulnerabilities to authentication. And that's exactly what we'll be doing on that session.

And I'm still looking for guests to join us then. So that's what our upcoming agenda looks like. There's also the monthly newsletter, the next version of which is due out early next week, which includes some analysis and news on analysis and of the news from the last month of a...

issues that might be topical to people in this field. And, fingers crossed, with any luck, our new website will be going live early next week, which will have all of the playbacks of previous sessions, and a few weeks later we'll move the booking functionality from Luma over to that.

So thank you again for your participation. You will receive an automated feedback request very shortly. I'd really encourage you to give us your feedback. We're only a few months into this. I'm literally learning every day of what works and what doesn't work, and I'd love your feedback to help us make this better and more...

So that's pretty much everything I have for you today. Thank you again very much for your time and have a great afternoon.