I once had my car towed by the city, only I had no way to tell it was them because it's not like they tell you. I figured I'd call the tow yard before I filed a police report for a stolen vehicle. Completely automated system where you had to give them the social security number of whoever had the title to verify whether or not they had the car in the lot. At the time the car was in my dads name, so I had to give this automated system that I had no way of knowing was legit my dads social security number over the phone. They did have the car at least, but boy if a scammer had a spoofed phone number 1 digit off from the towyard's, they would be sitting on a lot of people's social security numbers right now.

Schwab Bank started using voice recognition "passwords" as well. Luckily, it requires you to log into their website after talking through voice password tutorial to activate the voice password--which I refused to do at the time. Good to know I made a decent choice.

Reminds me of my favorite 'hacking' movie Sneakers: "Hi, my name is Werner Brandes. My voice is my passport. Verify Me."

Fidelity has you put in your online password via the number pad. Have fun if you use a secure 20 digit randomly generated password.

Never mind the insanity of leaking a secret that would otherwise only travel over TLS. Banks wouldn't know actual security if it fell into their lap. They got spoiled by pretending SSNs were somehow private, and are still trying to use "identification" as a crutch rather than focusing on proper authorization - eg a hierarchy of auth levels with the master being a public key on a hardware token, ideally that you go into a branch to replace. The only thing a person can do is refuse their snake oil voiceprints etc wherever possible, and most importantly monitor your accounts religiously at least every 40 days.

Even worse, the snake oil is leaking to non-banks as well. For example, Amazon now seems to insist on doing an email challenge for every login. Very unfriendly UX. Eventually I'll get around to writing a procmail recipe that grabs the codes out of emails/texts, and spits them to a terminal ready to be pasted.

Most banks in the UK have given out hardware 2fa devices for years. I have one for my company accounts that's activated with its own PIN that gives out logon and authorisation codes.

Is this not true in the US?

They are often now replaced by banking apps that offer a similar feature, as my consumer account with the same bank has done.

When it comes to banks, if it makes life easy for the customer, it’s probably not true in the US.

We still don’t have chip and PIN, and we most certainly don’t have TOTP 2FA.

Voice recognition is far more advanced than voice generation.

Not if it's GAN, no?

Government services in Australia have been implementing this technology as well. I hope it won't become mandatory ️

Yes, my family think I’m a Luddite for not using HSBCs voice recognition security on telephone banking