Journalist Breaks Bank Security With AI Voice

A journalist has managed to bypass Lloyds Bank’s Voice ID security by using an AI tool that can replicate people’s voices without their consent. It’s called voice cloning and it’s on the rise.

Vice journalist Joseph Cox has detailed how he used ElevenLabs’ AI tools to mimic his own voice. Using recordings of the AI tool saying key phrases, such as “my voice is my password”, he was successfully able to bypass the voice security checks on his own bank account, as you can see in the video embedded below.

The successful attack raises doubts over the strength of bank voice ID systems and whether the burgeoning number of AI tools could be used to commit financial fraud.

Five-minute training

Cox said it took only a few minutes to train the ElevenLabs system to mimic his voice. “To create the voice, I recorded about five minutes of speech and uploaded it to ElevenLabs (for the audio clips, I read sections of Europe’s data protection law),” he wrote. “A short while later, the synthetic voice was ready to use, with it saying whatever text was entered into ElevenLabs’ site.”

His first few attempts to beat the Lloyds Bank system failed, with the bank reporting it couldn’t authenticate his voice. “After making some tweaks on ElevenLabs, such as having it read a longer body of text to make cadences sound more natural, the generated audio successfully bypassed the bank’s security,” Cox added.

In a statement given to Vice, Lloyds Bank said it was aware of the threat of AI voices and wasn’t aware of any cases where a synthetic voice had been used to defraud customers.

AI fraud

AI voice systems have been used in the past to commit huge financial crimes. In 2020, a Hong Kong bank manager was conned into making a $35 million bank transfer after a deepfake voice was used to impersonate a director of a company that he’d spoken to previously, in a case uncovered by Forbes.

A year earlier, criminals used AI software to impersonate the CEO of a British energy company, in a bid to fraudulently transfer more than £200,000 out of the firm’s German parent company, according to a report in the Wall Street Journal.

In short, AI is making it harder to trust anything we see, hear or read anymore.

For more on cybersecurity

Check out our security section where you can find a range of content on all things cybersecurity. In addition, head here for breaking news on all things technology.