If you watch the video that precedes these lines, you have identified yourself with this situation. Why? Because it is a natural and everyday situation: we have all suffered, and continue to suffer, this type of eternal process when we call the customer service line of our telephone company, our energy or electricity company, or our insurance company.
Identity verification processes like this one we have just heard can take almost 2 minutes as long as everything goes right the first time. But, beyond the negative experience we have accumulated as customers, which is no small thing, what are the potential business implications for companies that delegate the verification of their users to methods like these?
Risks faced by the insurance industry
Let’s put some facts on the table:
One of the world’s leading market research firms, LexisNexis, recently published a study on identity management in the insurance sector. This study emphasizes the security and customer experience impacts caused by bad practices in terms of identity verification, not only in call centers.
On the one hand, it is estimated that 18% of policyholders were victims of identity fraud in 2020, either through account theft or fraud in contracting. The thought that almost one in five customers in the insurance sector has been subject to identity fraud should alarm us all.
On the other hand, almost 7 out of 10 respondents said that digitalization had led to increased fraud. In other words, a large majority of respondents were reluctant to incorporate digital methods because of what they saw as an open door to fraudsters. What is the point of all of us making efforts towards a bigger and better digital transformation if our customers may perceive it as harmful?
At Veridas, we have always stated that no total and effective digital transformation will be without a real identity. If we cannot implement secure and private processes to corroborate an identity in the digital world, there will always be an uncovered link in the chain.
In summary, we find ourselves in a scenario in which three significant challenges or risks concur:
- To begin with, high exposure to fraud. Apart from the data we have just shown, we all have in mind recent news of identity theft in banks, massive leaks of personal data on social networks such as Facebook, false identities on Twitter, or even fraud in e-commerce sites as apparently innocuous as Wallapop.
- On the other hand, and what is perhaps most evident to everyone’s eyes, a worsening of our customers’ experience. The need to prevent any digital fraud has meant deploying increasingly complex verification processes based on multifactor authentication strategies. We have nothing against this, as long as a multifactor plan does not involve accumulating unfriendly and not very robust authentication methods, such as question-based methods or digital tokens, like OTPs.
- Finally, it seems necessary to highlight how a landscape of inconsistencies in identity fraud prevention measures is emerging. Companies plan the various customer communication channels as separate, watertight silos, applying ad hoc measures. This leads to inconsistencies in anti-fraud effectiveness, with different levels of security depending on the channel. This is, for the most part, due to the impossibility of finding a method or methods applicable to any channel in a robust and convenient way for the end customer.
Because, what authentication methods exist today? Let’s take a brief look.
Identity verification methods and the tradeoff between security and UX
We will use the classification set by the European Union’s eIDAS regulation, which distinguishes between knowledge methods or factors, possession factors or inherence factors. What is each of these groups and what methods does it include?
The first of all, which refers to knowledge factors, includes those methods that seek to corroborate information that one knows or is aware of. Here we include such long-established methods as passwords, PIN codes or the method based on questions we have heard in the contact center recording. We are all aware of how little security they offer in the fight against fraud as they are easy to hack and do not generate the best customer experience. Who wouldn’t give money to be able to forget all the users and passwords we accumulate daily?
If we move along the security line, we find possession factors, aiming to check if the user has an item or object that only he should own. This adds another layer of security over knowledge elements, but it certainly comes at the expense of the customer experience. Who has never been in the middle of a bank transfer when your bank tells you that they are going to send you an OTP code or a push notification to your mobile to confirm the transaction, and at that moment, you do not have your mobile at hand and you have to cancel the process? This is an excellent inconvenience from a customer experience point of view, but let’s look at it from a security point of view: let’s think that our mobile has been stolen and they are trying to make a bizum or transfer to someone else… Won’t the OTP code reach the same mobile that was stolen and, to top it off, the application will automatically copy and paste it so that the fraudster doesn’t even have to make that effort?
Finally, we have what the European standard calls inherency factors. These methods seek to corroborate who you really are: your biological measurements or physical characteristics, either through facial biometrics, voice biometrics, a fingerprint system, iris recognition, or any other biometric method. If we choose the right technology, and conveniently certified, these are considered the most secure methods that exist, and may exist, because it is really difficult to hack them and they are impossible to forget. In addition, they are the most effective in generating good user experiences, which finally breaks the traditional tradeoff between user experience and security. But I insist that we must rely on qualified and adequately certified providers for this. Not everything goes.
We move from a presumed identity to a real one by applying these biometric methods. We speak of assumed because we are not verifying what one really is, but what one knows or possesses with the previous methods. Have you, who are reading this, never accessed a relative’s cell phone, with their consent, because you know their PIN? Or have you never successfully passed a questionnaire, like the one we heard in the call at the beginning, because you know the personal data of a relative or acquaintance? With biometrics, on the other hand, we are checking what makes people unique, so we would be able to talk about real identity. I cannot delegate my voice or my face, and if I think of doing it through a recording or a photograph, Veridas would be able to detect it.
Applying Biometrics to Call Centers
What is the difference between the two situations in the video at the beginning? Why did one take almost 2 minutes just to verify an identity and the other took only 6 seconds to verify the identity and route the call simultaneously? Is this situation a valid use case?
The answer to the last question is YES. Companies as important as BBVA or Deutsche Telekom, among others, are already using our voice biometrics to improve their customer service processes, making them safer and faster. Veridas voice biometrics can verify an identity with only 3 seconds of voice, in any language and with any text.
Are these features unique? No, by themselves they are not, but the combination of the 3 is. No one on the market offers 99%+ accuracy, with a processing time below 150 milliseconds with 3 seconds of audio, regardless of language and text—no one else.
The application of this technology brings three benefits that until now seemed impossible to apply at the same time: fraud prevention, cost optimization and UX improvement. We were forced to choose between one of these three levers of business improvement, but this is no longer the case.
We significantly improve security with solutions like these as we move from inflexible and easy to supplant methods to secure methods. We also reduce the cost significantly, going from processes that last on average 60, 90 or even 120 seconds to 3-second processes. The reduction in TMO is brutal.
And finally, the customer experience. With total honesty, I can tell you that our customers buy from us because of cost reduction, because the business case comes out on its own, and in return they can “sell” it to their customers as an improved experience, which it is.
What customers or use cases do we have in production?
Let’s briefly review two use cases that highlight the solution’s effectiveness. On the one hand, a leading Spanish company in the energy sector has deployed our solution in its contact center in Spain and will soon deploy it in other geographies of its group. In this case, the solution is integrated just as you have heard in the previous example: it is coupled to their previously established process, with no need to modify the flows that were already in place.
Specifically, Veridas can authenticate the identity of this company’s customers when they answer the open-ended question about the reason for the call, leveraging the answer to route the call and identify the caller. Therefore, the customer never has the feeling of being recognized and the reduction in TMO is over a minute. For a call center that receives about 350,000 calls per month, this measure saves about 6,000 hours per month of a telephone conversation or about 35 FTEs. To date, we already have more than 70,000 customers registered in the voiceprint system and more than 230,000 authentications carried out.
On the other hand, we have the use case of pensioners in Mexico. Until the implementation of Veridas technology, Mexican pensioners needed to go in person to their bank branch to give proof of life if they wanted to receive a pension. BBVA understood that this situation required an urgent solution that would allow its pensioners to carry out the operation remotely but without affecting the security needed for a financial institution of the prestige and standards of BBVA. Veridas voice biometrics offered a solution to both problems and, in addition, it was an ideal technology for the variety of ethnicities, languages, cultures or even socioeconomic situations (having or not internet or the last generation cell phone) of its portfolio of pensioners.
Today, there are already more than 90,000 pensioners registered in the biometric life faith system, and we have already managed more than 125,000 life faiths remotely, with a conversion rate of more than 95 percent.
Is this technology secure?
Remember: not everything is the same. That is why it is essential to demand a minimum level of certification and approval from the technology providers we choose to ensure that we obtain the results they promised. At Veridas we have always been committed, and will continue to be committed, to submitting our technology to independent evaluators who examine us all under the same testing conditions. The National Institute of Standards and Technology (NIST) undoubtedly stands out among these evaluators.
Another important aspect is our strict compliance with GDPR. So strict that our technology is private by design and by default. This means that we do NOT store customer data. We only process data and return results, automatically deleting all data from our cloud.
We are also SEPBLAC compliant to assist in preventing money laundering. Finally, our voice biometrics product has been confirmed by the prestigious law firm ÉCIJA as a valid solution for the execution of advanced electronic signatures. And what does this mean? It means that we can allow you to sign new products via telephone without using other methods, robustly and securely.
