DO NOT ENROLL IN CHARLES SCHWAB'S VOICE ID SERVICE

John Robinson |
Categories
Cybersecurity
Charles Schwab

By John H. Robinson, Financial Planner (April 8, 2024)

I have posted two articles over the past six months that were critical of Schwab’s identify verification process for clients who are logging into their accounts or calling Schwab Alliance for phone support.  My criticism centered around Schwab’s deployment of LexisNexis’ Knowledge Based Authentication (KBA) process.  Specifically, I noted that LexisNexis is known for flawed data collection that sometimes/often makes it difficult for consumer to answer the KBA questions.  I also noted that LexisNexis has suffered at least one major data security breach and that it faces multiple class action lawsuits accusing the company of illegally gathering private consumer data. Links to the articles are as follows -

Schwab’s Accountholder Verification Process is Definitely Unique.

Client Verification with Schwab - So Secure, Even You Can't Log In!

Last week, a client called to inform me that she stumbled upon a way to circumvent Schwab’s onerous KBA system – Schwab Voice ID Services. She asked me if I thought she should enroll. My answer was a resounding, unambiguous, “NOOOOOOOOOOOOO!”

 

What’s Worse Than a KBA System that Prevents You from Accessing Your Accounts?  A Voice ID System that Makes It Easy for Anyone to Access Your Accounts.

Here’s how Schwab presents its Voice ID System:

 

Wow, “voice biometrics technology.” That sounds avant-garde, but can anyone think of a potential flaw in this system? Here’s one – What about AI technology that can be used to mimic your voice and then repeat back to Schwab, “At Schwab, my voice is my password?” Lest you think I am being overly paranoid, here are a few recent articles that suggest otherwise -  

Cybercriminals are Using AI Voice Cloning Tools to Dupe Victims (CBS News)

How to Protect Yourself Against Voice AI Scams (CNBC)

AI voice cloning scams on the rise, expert warns (Fox News)

 

But Schwab’s Explainer Video Says Each Person’s Voice has Its Own Unique Fingerprint. 

Yes, and just as you can make a copy of your fingerprint to keep in a federal database, sophisticated AI software can make a copy of your voice and use it to mimic you. Schwab rolled out its Voice ID Service way back in 2020.  AI software is vastly improved and security breaches at major financial institutions that employ Voice ID software have already been reported. Congress is sufficiently concerned that last year it summoned several large financial institutions, including Schwab to defend their use voice ID platforms -

Brown Presses Banks on Voice Authentication Services

6 U.S. Banks Buttonholed on Voice Biometrics by Chair of Senate Banking Panel

Scarier still is this article – How I Broke Into a Bank Account with an AI-Generated Voice .  Here is an excerpt:

“Okay,” the bank replied. It then asked me to enter or say my date of birth as the first piece of authentication. After typing that in, the bank said “please say, ‘my voice is my password.’” 

Again, I played a sound file from my computer. “My voice is my password,” the voice said. The bank's security system spent a few seconds authenticating the voice. “Thank you,” the bank said. I was in.

Does that sound familiar?

 

John H. Robinson is the owner/founder of Financial Planning Hawaii and Fee-Only Planning Hawaii. He is also a co-founder of fintech software maker Nest Egg Guru.