UK Bank's Voice ID Successfully Bypassed Using AI-Produced Audio

A UK journalist was able to successfully bypass Lloyds Bank's "Voice ID" program to access his bank account using an AI-generated audio of his own voice.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident demonstrates how AI voice cloning can be used to impersonate individuals to bypass security systems and commit financial fraud.

Additional risk subdomains

• 2.2 AI system security vulnerabilities and attacks: The bank's biometric Voice ID system possessed a critical security vulnerability that allowed synthetic voice clones to bypass authentication.
• 1.2 Exposure to toxic content: The report notes that ElevenLabs' technology was also abused by trolls to generate transphobic and racist content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human journalist intentionally using ElevenLabs' deployed voice cloning technology to bypass a bank's security system.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: Limited Risk. The system is used to generate synthetic audio (deepfakes), which falls under the category of AI-generated content requiring transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: ElevenLabs
• AI purpose: Voice Generation; Text Style Replication
• Behaviour type: Tool
• Alleged developer: Lloyds Bank, ElevenLabs
• Alleged deployer: Lloyds Bank, Joseph Cox
• Alleged harmed parties: Lloyds Bank

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the report mentions that trolls used ElevenLabs to make synthetic celebrity voices say racist and transphobic things.

Indirectly caused: The report notes that ElevenLabs' technology was used by online trolls to generate toxic content, such as fake celebrity clips reading Mein Kampf.

Privacy

Reported: Yes, the journalist bypassed security to access private account information, including balances and transaction history.

Directly caused: The synthetic voice clone allowed the journalist to bypass security and access private account information, including balances and transaction history.

Inferred additional harm: If exploited by malicious actors, this vulnerability could lead to massive privacy breaches of personal financial data for bank customers.

Epistemic

Reported: Yes, the report describes the generation of highly realistic synthetic voices that mimic real individuals.

Directly caused: The AI system generated a highly realistic synthetic voice clone that successfully deceived the bank's automated authentication system.

Inferred additional harm: The widespread availability of cheap voice cloning tools could erode trust in voice communications and biometric verification systems.

People affected

• Occurrences reported: 1
• People reportedly exposed: 1

Potential causes

Management

• Inadequate Risk Assessment: Management failed to anticipate rapid advances in AI voice cloning technology.
• Insufficient AI Guardrails: ElevenLabs launched with minimal safeguards, allowing anonymous voice clones.

Technology

• Advanced AI Voice Cloning: ElevenLabs technology can clone voices with high accuracy and natural cadence.
• Vulnerable Biometric System: Lloyds Bank Voice ID failed to distinguish synthetic voice from real voice.

Data Inputs

• Publicly Available Voice Data: Only five minutes of audio was needed to train a highly accurate voice clone.
• Compromised Personal Data: Date of birth was easily accessible due to past data breaches.

Human Factors

• Overreliance on Voice Biometrics: Banks marketed voice biometrics as secure and unique like a fingerprint.

Process and Methods

• Weak Multi-Factor Authentication: System only required easily bypassed voice biometrics and date of birth.
• Lack of Liveness Detection: The authentication process did not verify if the speaker was live.

Regulatory Environment

• Lack of Biometric Standards: No strict regulations governing the security of biometric authentication.

Information quality

• Classification confidence: High
• Reason for confidence: The report is a first-hand account by the journalist who conducted the experiment, providing clear details and statements from the bank and regulators.
• Ambiguities identified: None significant, though the exact technical details of Lloyds Bank's Voice ID system and ElevenLabs' internal security updates are not fully disclosed.
• Alternative interpretations: One could interpret this as a security failure of the bank's authentication system rather than an AI safety failure of ElevenLabs, though both are intrinsically linked.

A journalist successfully bypassed Lloyds Bank's voice biometric security using a cheap AI voice clone from ElevenLabs. This incident exposes a systemic vulnerability in financial infrastructure across multiple major global banks, demonstrating how commercial AI tools can easily facilitate financial fraud and identity theft, warranting serious attention from economic security agencies.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United Kingdom
• Other affected: United States
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic vulnerability in biometric authentication rather than an active, immediate national crisis.
• Autonomy: Human-controlled. The AI system acted as a tool to generate audio, with the human journalist directing the creation and manual execution of the attack.
• Novelty: Evolved capability. Represents a significant advancement of existing voice-spoofing threats due to the high quality and low barrier to entry of modern generative AI.

Impact by dimension

• Physical security: Minor. Exposes vulnerabilities in voice biometrics used by critical financial infrastructure, though the incident itself was a controlled test with no kinetic or physical impact.
• Information security: Minor. Demonstrates how consumer-grade AI voice cloning can bypass biometric security, posing a minor threat to individual privacy and identity verification processes.
• Sovereignty: Negligible. No impact on state authority, electoral systems, or core government decision-making processes.
• Economic security: Substantial. Exposes a widespread vulnerability across major financial institutions (including Lloyds, TD Bank, Chase, Wells Fargo) to AI-powered fraud, posing a substantial threat to economic security.
• Societal stability: Minor. Presents risks to privacy and financial security of citizens, potentially eroding trust in digital banking and biometric systems if widely exploited.