FAQs

VOICEME MFA (Multi-Factor Authentication) provides one of the highest security levels currently on the market, both on the front end and on the back end. On the front end, VOICEME implements up to 6 authentication factors to ensure user identity. Among them:

• Voice biometrics
• Face biometrics
• Authentication device information
• KYC (Know Your Customer), which includes document upload, face matching, and AML.

In addition, it includes Voice Liveness (through STT, Speech To Text), based on a time-limited sentence aimed at preventing deepfake cyberattacks. A combination of factors that makes it very hard for a potential cyber attacker to gain access, as it requires a wide range of information and evidence to pass the authentication system.

On the back end, VOICEME implements a wide range of security measures to ensure transmitted and stored data protection. Among others:

• High-level asymmetric encryption – it delivers secure data transmission, ensuring information transmission over the internet is protected against unauthorized access by potential attackers.
• Symmetric encryption – it implements end user biometrics protection algorithm, ensuring biometric data is secured and protected against access in the event of server compromise.
• Encrypted data fragmentation algorithm – it is used to partition data into fragments and disperse them into a neural network, making it extremely difficult to rebuild data even in the event an attacker manages to access one or more fragments.

To conclude, VOICEME MFA offers an extremely high security level both on the front end and on the back end, ensuring access protection by a wide range of security measures and making it very hard for a potential cyber attacker to compromise user identity or gain access to user data.

Please find below how VOICEME stays ahead of cyberattacks aimed at identity thefts:

Cyberattack	Description	Voiceme prevention
Brute force attack	The hacker attempts to crack a password or encryption key by various combinations of characters.	VOICEME authentication method does not use static passwords. It implements biometric authentication (offering biometric OTP) which is much harder to be cracked by brute force attack.
Dictionary attack	The hacker attempts to crack a password by trying a list of common words or words from a dictionary.	As above mentioned, Voiceme authentication is not based on static passwords.
Phishing	The attacker sends a false message (via e-mail, text message, website) to trick the recipient into providing authentication credentials in reply.	VOICEME implements a multi-factor authentication process to make it harder for an attacker to trick the user and gain access.
Keylogging	The attacker instals a malicious software on the user device to record keystrokes and steal the user password.	As Voiceme authentication method is based on biometric authentication (offering biometric OTPs), a keylogger cannot capture access data.
SIM swap attack	The attacker tricks a mobile carrier into transferring the user number to a new SIM card, thus intercepting OTPs sent via SMS.	As Voiceme does not manage user biometrics via device, the fraudster cannot record its biometrics and use it to authenticate despite the SIM swap attack.
Malware	The attacker instals a malicious software on the user device to intercept OTPs or authentication credentials.	The implementation of biometric authentication makes it hard for the malware to intercept access credentials.
Spoofing	The attacker presents a fake image, video or digital fingerprint to deceive the biometric authentication system.	VOICEME implements voice liveness, which requires a real-time voice confirmation and validation to prevent the use of fake evidence.
Deepfake	The attacker creates realistic face-swapped videos and/or voice audios to deceive the biometric authentication system.	As mentioned above, the implementation of voice liveness, which requires a real-time voice evidence, helps preventing deepfakes.
Replay attack	The attacker records and retransmits a video depicting the user face or a fingerprint to deceive the biometric authentication system.	Voice liveness requires a real-time voice evidence, countering the attacker using recorded or replayed video to gain access.

Benchmarking with other standard authentication methods

Security (countering identity theft attacks): Voiceme offers a high security level against cyberattacks (see above) aimed at identity thefts, leveraging its MFA approach.

ID Trust (identity security concerning user actual identity): regardless attack mode (see security), VOICEME ensures that the authenticating/acting subject is proprietary of involved biometrics, thus delivering high user identity trust standards as voice biometrics uniqueness provides a strong relation with user identity. For example, an RSA authentication is hardly hacked by cyberattacks but can be easily transferred upon transferring hardware device used for strong authentication.

UX (User Experience): VOICEME offers a frictionless user experience as profile registration takes just 3 seconds and each subsequent use (authentication/action) takes only 3 seconds. Authentication via voice biometrics is convenient and intuitive for users – as a matter of facts, it does not require users to enter complex passwords or type OTPs.

Omnichannel: VOICEME is natively omnichannel, i.e. it can be used across multiple platforms and devices. In other words, it offers increased flexibility and adaptability to user needs and single use cases. On the other hand, phone biometrics deliver limited flexibility – and security.

Third party biometrics: having adopted provisions set forth by EBA (European Banking Association) and ABF (Arbitro Bancario Finanziario, the Italian banking and financial ombudsman), Voiceme implements the transition from device-based biometrics (e.g.: smartphone biometrics) to subject-based biometrics, thus achieving and ensuring effective subject identification and not device identification. Smartphone biometrics poses several security-related issues (notably, the possibility to log in using PIN as fallback, SIM swap attacks and deepfake attacks against face biometrics).

Use-case personalization: Voiceme delivers use-case personalization – it can be suited and set to meet specific situation and environment needs as it enables authentication method and specification selection (voice only, voice + face, voice + random sentence, voice + face + random sentence, random sentence lifetime, accuracy, number of words in the random sentence, random sentence generated by Voiceme or provided by the customer, etc.)

In conclusion, VOICEME MFA offers top safety, prime user identity trust, unrivalled user experience, omnichannel support and personalization, which make it the prime and most advantageous choice compared with other advanced authentication methods.

Voiceme is a natively omnichannel platform that can be used at any customer touchpoints: web, mobile, physical devices such as smart lockers or access turnstiles, chats, chatbots and voicebots (Voiceme is WhatsApp integrated). Once onboarding is completed, i.e. customer biometrics are recorded – in just 3 seconds – the customer can authenticate at any touchpoints. Each channel can be configured with a different authentication process to meet specific use cases. For example, only-voice authentication can be provided for call centers, while face-voice and random sentence authentication can be provided for mobile applications to ensure the highest security level. Voiceme allows use-based personalization, adapting and configuring itself to meet the specific needs of different situations and environments. Users can choose the controls to use and the relevant features, such as voice, face or face-voice authentication, besides being offered the chance to use random sentences, set permitted random sentence lifetime and specify other options. Moreover, il MFA di Voiceme Voiceme MFA offers high security, user identification reliability, excellent user experience, and omnichannel support – features that make it more favourable than other advanced authentication methods.

Voiceme integrates easily and intuitively with existing systems and applications thanks to available APIs. Companies can initiate an API call with Voiceme services and get instant answers. Moreover, Voiceme offers mobile and desktop Android and iOS SDKs, thus furtherly simplifying integration. These tools allow companies to easily add voice and face authentication to their applications, improving security and user experience. Voiceme is available as SaaS or on-Premises solution, entirely based on proprietary technology. Furthermore, Voiceme provides flows and technical material for integration assessment on request.

With Voiceme, you can make three types of electronic signature:

1. Simple Electronic Signature (SES): it offers the lowest security level and can be contested or disregarded as it does not unambiguously identify the signatory.

2. Advanced Electronic Signature (AES): it provides a higher security and authentication level compared to a simple electronic signature. Security level is ensured by document integrity and signatory authenticity by means of advanced digital certificates. . It must ensure the unambiguous identification of the signatory, the unique link of signature, signatory and document, the sole control of the signatory over signature generation system, the possibility for the signatory to check any subsequent changes to the document and the identification of the company issuing the certificate.

3. Qualified Electronic Signature (QES): it offers the highest security and authentication level of all kinds of electronic signatures; it is issued by a qualified certification service provider and requires the AgID (Agenzia per l’Italia Digitale, the Italian Authority governing accreditation and supervision of e-signature service providers) prior approval of corporate signature process.

Voiceme is integrated with a Certification Authority (CA) for the issuance of advanced and qualified electronic signature certificates, ensuring compliance with current regulation in force and legal validity of electronic signatures. CA can vary based on the customer’s preferences.

You do not need to use all authentication factors on Voiceme: the choice depends on specific use case, offering adaptability and configurability to meet the specific requirements of different situations, environments and use cases. Users are allowed to select controls to use, which may include voice authentication, voice and face authentication, voice and random sentence authentication, face-voice and random sentence authentication, besides being able to configure permitted random sentence lifetime, the required accuracy, the number of words in the random sentence, , and whether the random sentence is generated by Voiceme or provided by the customer.

AI-powered speech synthesis technology has made significant progress: documented cases of vishing (voice fraud) are increasingly reported by the media and other sources. It is crucial to understand, on the one hand, the ongoing technological development and, on the other hand, the importance of appropriate security measures. An effective approach to the matter is the implementation of an MFA (Multi Factor Authentication) system that includes non-homogeneous biometric authentication and voice liveness: this is the system offered by Voiceme to ensure authentication system security.

In Voiceme, biometric data is collected during the initial mapping procedure and subsequent interactions with the platform and processed to create a unique user profile based on voice and/or facial data. However, Voiceme does not directly store biometric data, but only “mapping data”, a unique vector representation of user biometrics. Mapping data is retained for as long as necessary - in compliance with data protection regulations - and protected by an encrypted fragmentation algorithm that makes it extremely difficult to rebuild data even in the event of unauthorized access. At the end of the retention period, data is safely destroyed: it is worth highlighting that Voiceme does not store audio or video files containing user biometrics, but only vectors that mathematically describe voice and face biometrics. Data retention and deletion policies are defined by Voiceme customers, in compliance with data protection regulations in force.

Voiceme provides one of the highest security levels currently available on the market, both on the front end and on the back end. On the front end, Voiceme uses up to 6 authentication factors, including voice and face biometrics, device information and KYC (Know Your Customer); moreover, it implements the proprietary voice liveness algorithm aimed at preventing deep fake cyberattacks. A combination that makes it difficult for cyber attackers to gain access. On the back end, Voiceme implements measures such as asymmetric and symmetric encryption to protect transmitted and stored data; moreover, its security is enhanced by a secure data segmentation algorithm that makes it extremely difficult to rebuild data even in the event of server compromise. In short, Voiceme offers a high level of security both on the front end and on the back end protecting access and user data from a wide range of threats (Synthetic Identity Fraud and Data Breach).