Australian Journalist Able to Access Centrelink Account Using AI Audio of Own Voice

A Guardian journalist was able to verify their identity and gain access to their own Centrelink self-service account using AI-generated audio of their own voice along with their customer reference number, shortly after voiceprint was deployed for ID verification.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident highlights a critical security vulnerability in a deployed biometric AI system that can be exploited using AI-generated voice clones to gain unauthorized access to sensitive accounts.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The voiceprint system lacks the technical robustness to reliably distinguish between genuine human voices and high-quality synthetic voice clones.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The security vulnerability is an unintentional capability flaw in the deployed Nuance voiceprint AI system, which fails to distinguish between real and synthetic cloned voices.

EU AI Act risk tier

• Risk tier: 2 High Risk

Risk Level 2. High Risk: The system is used for biometric identification and verification of individuals, which has significant implications for safety, fundamental rights, and public interests under the EU AI Act.

AI system and alleged parties

• AI system: AI-generated voice software, voiceprint service (Nuance)
• AI purpose: Identification; Voice Recognition
• Behaviour type: Tool
• Alleged developer: Centrelink
• Alleged deployer: Services Australia, Australian Taxation Office
• Alleged harmed parties: Centrelink account holders

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 10900000

Potential causes

Management

• Inadequate Risk Assessment: Failure to proactively update systems against emerging AI voice spoofing.
• Overreliance on Vendor Claims: Trusting vendor claims of security without independent validation.

Technology

• Vulnerability to Voice Cloning: Biometric voiceprint systems fail to distinguish AI-cloned voices.
• Advanced Voice Cloning Tools: AI allows high-fidelity voice cloning with very little training data.
• Imperfect Synthetic Voice Detection: Detection algorithms fail to flag cloned voices in up to 14% of cases.

Data Inputs

• Exposed Customer Reference Numbers: CRNs are printed on correspondence and not treated securely like passwords.
• Publicly Available Voice Data: Social media and public recordings provide audio to train voice-cloning AI.
• Short Audio Sample Requirement: AI models require only four minutes of audio to generate a realistic clone.

Human Factors

• Overconfidence in Biometrics: Agencies falsely assumed voiceprints were secure and could detect clones.

Process and Methods

• Single-Factor Biometric Auth: Using voiceprint in lieu of passwords without multi-factor verification.
• Automated IVR Vulnerability: Automated systems lack human interaction to detect synthetic voice delays.

Regulatory Environment

• Absence of Clear Legislation: Lack of legal frameworks governing government use of biometric verification.
• Lack of Standardized Guardrails: No basic standards to ensure technology is safe from AI cybercrime.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, first-hand investigative evidence of the vulnerability being successfully tested by a journalist, along with official statistics on user adoption and statements from relevant government agencies.

A journalist demonstrated that the Australian government voiceprint biometric system used by ATO and Centrelink can be bypassed using an AI-generated voice clone. While no hostile exploitation was reported, the vulnerability exposes over 10 million citizen accounts, highlighting a significant evolutionary threat to biometric security and government service integrity.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Australia
• Alleged perpetrator: Journalist

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing strategic vulnerability in biometric authentication systems rather than an active, imminent crisis.
• Autonomy: Human-controlled. The AI voice cloning tool is fully controlled and deployed by a human operator to bypass the biometric system.
• Novelty: Evolved capability. Represents a significant advancement in synthetic voice generation, making voice cloning accessible enough to easily bypass government grade biometrics.

Impact by dimension

• Physical security: Negligible. No physical security threats or critical infrastructure disruptions were reported or indicated in the incident.
• Information security: Minor. The vulnerability exposes biometric data systems to potential unauthorized access, though no classified intelligence compromise was reported.
• Sovereignty: Minor. Demonstrated vulnerability in major government services could allow unauthorized access to citizen accounts, representing a minor threat to secure government operations.
• Economic security: Minor. Vulnerability in taxation office authentication could facilitate tax fraud or financial identity theft, posing minor risks to economic security if exploited at scale.
• Societal stability: Minor. The vulnerability exposes over 10 million citizens to potential identity theft and privacy violations, representing a minor but notable risk to societal privacy protections.