My bank wants my voice as a password. Is voice ID safe against AI cloning?

My credit union describes the voiceprint as being like a fingerprint, over a hundred characteristics, unique to you. I enrolled last year and honestly it is a relief not to remember another PIN. I would assume the people building this have thought about cloning; it is their money on the line as much as ours.

Jules, your case is unusual because you have so much audio out there. For most of us there are maybe a few voicemails floating around. I would not lose sleep over it.

The fingerprint comparison is marketing, and it points the wrong way for a threat model. A fingerprint is hard to collect without touching you. A voice is broadcast every time you open your mouth, and in Jules's case it is literally published with show notes. Biometric security rests on the sample being hard to obtain. Voice is the one biometric you hand out for free.

Anti-spoofing is a real research area, not pure vapour. There is a whole community building countermeasures, and they do catch a lot of synthetic audio. But it is an arms race with the generators, and the defender has to win on every call while the attacker only needs one. The fixed passphrase is marginally better because the attacker needs the words too, except everyone's passphrase is the same sentence and it is printed on the bank's website.

What to ask for instead: any factor you can revoke. You cannot rotate your larynx.

@Tomas Reyes ok that settles it. I will decline the bank one and ask payroll for an authenticator app, and I will ask Kwame's question about the data policy while I am at it. slightly horrified that five minutes of audio was enough when I have published roughly four hundred hours of myself.

Small corrections to keep the thread honest in both directions. Liveness and anti-spoofing are not marketing; they are deployed models that look for artefacts of synthesis and playback. What they are not is general. They are trained against known synthesis systems and known channels, and performance drops on a generator they have not seen or on heavily compressed phone audio. Cox's test, note, used the least sophisticated injection path possible, a laptop speaker held to a phone, and still passed after a few attempts.

On text-dependent versus free speech: the fixed phrase gives the system a direct comparison against your enrolment of the same words, which helps it a little. It also gives the attacker a fixed target. Neither variant changes the underlying problem, which is that the secret is public. The voice detector accuracy thread has the detail on why phone-line audio is the hard case.

@Sam Whitlock fair point, and I had not thought about the collection side at all. A fingerprint takes effort to lift. My voice is on every parent voicemail I have ever left. I will go find the opt-out.

From the platform side: we evaluated voice as a step-up factor for high-risk account actions and did not ship it. Not because it never works, but because of the failure mode. When a password leaks we force a reset and move on. When a voiceprint is defeated there is no reset. The user keeps the same voice and we have no recovery path except telling them to stop using the feature we sold them.

The second issue is retention. Enrolling means handing a biometric template to a vendor, often not the bank itself, with its own retention policy and its own breach history. Jules, that is a fair question to put to the payroll company before you enrol: who holds the template, for how long, and what happens to it when the contract ends.

One angle not yet raised: in several jurisdictions biometric identifiers have their own legal regime, and employers in particular may need informed written consent, a published retention schedule, and a stated purpose before collecting them. Illinois's Biometric Information Privacy Act is the well-known example and it explicitly covers voiceprints. I will not guess what applies where Jules lives, but "may I see your biometric data policy" is a reasonable request to make of HR before enrolling, and whether they can produce one tells you a great deal about how carefully the system was set up. Ingrid's retention question is the same point from the operational side.