1. The role of voice biometrics in a multi-factor authentication solution SpeechTek February 21, 2007 Chuck Buffum cbuffum@rsasecurity.com

2. Voice biometrics in the call center Why is this worth our attention? What applications are the best fit? How should we measure success? How well does it really work? Who has already done this?

3. Why? Identity theft is a serious problem Fraud losses Damage to corporate brand Erosion of customer confidence … and too easy in call centers … and the FFIEC guidance Increasing government/regulatory pressure Increased protection of phone records (Verizon, HP, etc.) Restrictions on use of full SSN HIPAA, SOX, USA Patriot Act

4. What applications? Business transaction calls are where the fraud occurs ($$$) Telephone banking Order entry Loyalty rewards redemption Either automated (IVR) or agent handled Account info calls are where the identity theft occurs (Bad Press) Customer service Account/order/payment status Profile/password management Either automated (IVR) or agent handled The vast majority of typical call volume

5. Multi Factor Authentication (MFA) What you know Account number Mother’s maiden name (MMN) Last 4 SSN Zip Code Date of Birth Challenge/Response questions What you have ANI Who you are Voiceprint What you do Behavior patterns

6. How does MFA fit into my call center? Front end Plug in IVR MFA Server Answer call Send ANI Collect ANI Request account # Play prompt Recognize account # Send result & audio Collect account # Fetch voiceprint & match Fetch ANI & match Request content info (zip) Play prompt Recognize zip Send result Collect zip & match Generate auth score Send id & auth result Go to main menu IVR MFA Server Answer call Collect & store ANI Collect & store account # Present main menu - if low risk transaction, continue - if high risk transaction, invoke MFA Collect ANI Collect account # Fetch voiceprint Fetch ANI & match Request voice utterance Play prompt Recognize & record Send result & audio Match voiceprint Generate auth score Send result or request content Continue to high risk transaction Or collect content for more auth.

7. Measures of success? Business GoalsKey Metrics Critical Success Factors Improved Security Customer acceptance Minimal disruption Affordability Multi-factor auth. Compliance reporting Convenience Effectiveness Utilize installed “kit” Comfortable dialogs Fair price Quantifiable benefits FA/FR Reduced fraud/ID theft Enrollment rate Customer satisfaction Length of install Call duration ROI

8. Realistic performance (your mileage may will vary) Contributors to voiceprint error rate Richness of enrollment Richness of verification utterance Environmental noise Phone-channel mismatch Change in voice (severe cold) Contributors to authentication error rate ANI spoofing “Content” acquisition Recorded audio Observed field performance Voice biometric: 4-8% EER (1% FA, 7-15% FR) MFA: 1-5% EER (<1% FA, 1-9% FR) Customer acceptance very positive IF dialog is short and familiar

9. Happy early adopters US Bank Marriott Washington Mutual First Horizon Visa Harvard Pilgrim Deutsche Bank Southern Pacific RR Ameritrade Air Canada Wells Fargo RBOS

10. Summary Voice biometrics is a key technology in a MFA solution Voiceprint technology works and is effectively deployed Most call center applications are appropriate It should be in your planning horizon If you respond to the carrot (ROI & better customer protection) Or the stick (emerging regulatory compliance)

11. Thank you!