Robots Storm the Castle Click - Short Edition

Coming up later on BBC News will be Newswatch.

First, though, it's Click.

Welcome to the south coast of England, and the country's

biggest fortification, Dover Castle.

They say an Englishman's house is his castle.

This week, this castle is mine.

Like every other home in the land, it needs to be well

defended, because these days, it is constantly under attack.

The walls make it out burglars, but today's

digital invader is wily, and can worm its way

in through the smallest gaps.

Last week's global cyber attack on companies in around 150 countries

shows just how vulnerable systems can be, even if you are not called

into clicking dodgy links.

So this week, we're looking at cybersecurity.

It's me versus the bad guys out there.

And they might be small, but there's a lot of them.

So what can I do to shore up my defences?

One thing is through biometrics.

Gadgets already recognise our fingerprint, and now

banks are starting to identify us using our voices.

So how secure is it?

Is it possible, for example, to fake someone's voice?

We asked Dan Simmons to give it a go, or most precisely,

to find the one person who might stand a chance at breaking

into his bank account.

Thanks, Ben.

Well, one of the things that you might not know about me is that

I am the only member of the Click team to have a twin brother.

Hi.

His name is Joe, and we kind of sound quite alike.

We kind of do sound quite alike.

But I came out first, and he just copied me.

Yeah, well, for this report, it's going to be Joe trying

to copy me...

TOGETHER: ..as we try to break into a bank.

But first, we're going to need some help.

Yep, I really think this guy is going to help us.

Right, good, good.

All right, nice to meet you.

If you'd like to sit down...

What we're going to do first is I have this little

analysis tool here.

And what this will do is just detect, first of all,

the pitch of your voice.

This system that you're trying to break in is analysing your voice

in lots of different ways.

So there will be about 100 different variables it is picking up on.

Hello, I'd like to access my account, please, today...

Hello, I wondered if I could access my account today.

You see there are pretty big differences between them.

So who do you think is the bigger Adam's apple, out of both of you?

I can't see mine.

TOGETHER: Yayayayahh...

It's the first time I've tried to use the telephone banking

service, and I'm not set up, so I am hoping...

LAUGHS

How many - how long do you want to make this?

A bit shorter, OK, a bit shorter.

That wasn't axactly the way you said it the first time.

I'd like to take everything out, today, please.

That was.

I'd like to take everything out, today, please.

I'd like to take everything out, today, please.

That is - that is close.

That's not true.

That is not true.

Excellent, that is brilliant.

Thank you very much.

No worries at all!

What're you dressed like that for?

Well, we're doing a job, aren't we?

I've got a gun.

You don't need a gun, do you?

Your voice is your weapon.

Take that off!

Erica is the voice of NICE - NICE is the voice security provider

for Citibank credit card-holders in the US, among others.

Hi, nice to meet you, too.

Joe's going to try to break into my account, what chances do

you think he has?

Very slim.

What advice can you give me to try and break into his account?

Well, you've known him your entire life, so try to imitate his voice.

She seems very confident about this - what -

what why is it that you think that, maybe, my twin brother can't break

into my account?

Voice biometrics is the most accurate form of identification

there is for access into financial institutions.

Why?

Why?

It registers over 100 different characteristics with voice.

Half of them personality and the half are physical.

And you do look a little bit different,

and your voices are different, so you will have different vocal

characteristics.

So therefore, what percentage chance do you think I have?

It would be one out of several hundred thousand.

How do you make it so that I can access my

account, even if, like, at the moment, I have a little

bit of a...

COUGHS

As I said, there's over 100 characteristics,

and a cough or cold only affects about two.

So we still have all those other characteristics to work with,

and we still have identification.

And has anybody fooled the system through the front door?

Basically, pretending to be somebody they're not?

No.

Can I asked another question?

It might just be a bit out the ballpark, but is this legal?

I'm here to break into the account of Dan Simmons.

Joe, you really don't need the gun.

What do I have to do?

Let's give this a shot.

OK?

Hi, yes, I'd like to access my current account,

if I can, please?

Yes, it's probably about ?10, something like that.

Yeah.

Thanks very much.

Yeah, that's great.

Thank you.

You failed - but close.

Wow, look at how close this is over here.

Look at that!

If we come over here, it you can see there's the threshold

level, and that - that is pretty close.

That was not a bad first go.

That just came out of nowhere.

First go, very good.

It came out of absolutely nowhere!

Very good.

But that's how you test the system, isn't it?

Yes, we that's how we test the system.

We tested with twins, and siblings, and imitators.

You know, a fraudster wouldn't get three chances,

and the reason a fraudster wouldn't get three

chances is that we would register the multiple failures,

and it would dynamically increase the threshold on the third,

and put a flag on the account.

Right, that is not to say, of course, that it's

impossible, is it?

It's not impossible, it's just very improbable.

So, Dan, your bank account is still safe, although your twin

got away with some pretty cool stationery.

Yeah, the old fashioned way.

Were you surprised that the voice attack didn't work?

Yeah, I was, actually.

We really tried hard to match up our voices.

You know, we used the voice coach and the rest of it,

and it just bubbled under what we needed and couldn't get in.

What about the simpler stuff that we have been asked by banks

in the last few years, like "My voice is my password,"

did you try that?

Oh yeah, we had a crack at that.

To get into my account, my twin needs my sort code

and my account number, things I have helped him out with.

He also needs to know my birthdate, but that's probably something

he already knows.

The question is, can my voiceprint give me any extra

protection?

Secret bank, we're not getting any bank names away.

Good afternoon.

Welcome to HSBC.

Oh, it's...

Please enter your sort code, or...

Oh, I've got this one.

Now, interestingly,it's the PIN number, and the account number,

which, if you are from the days from the old cheque-book,

then both of those things you'd use to print objects.

So if you've got an old cheque from somebody you already know

that.

..your date of birth.

He knows my date of birth because we share the same

date of birth.

After the tone, please repeat the phrase "My voice your password".

My voice is my password.

I'm sorry, I didn't catch that.

After the tone, please repeat the phrase "My voice your password".

My voice is my password.

Welcome to HSBC Advance.

The balance of your account is ?1.21p credit.

I'm off to the bank!

For your available balance...

I thought it would be more than that, Dan.

LAUGHS

Evil twin was in.

Perhaps more surprising when you consider the service

providers test their systems with twins to improve security.

I can get into other accounts, apparently,

Dan, so...

HSBC told us:

Major security no no man works at an undisclosed financial

institution.

Oh.

He manages innovation, because they have an

innovation unit.

So what's he been innovating?

Just watch the way he uses his phone, because his security

system is doing just that.

And even with all his login details, I'll

need to replicate how he holds, taps, and tilts his device.

Ha, hi!

Chris, would you mind lending me that for a moment?

No luck.

It's beaten me.

That'll be yours, then.

Brilliant security tips there, unfortunately I think

they have arrived a little bit too late for me.

Still, there you go.

Thanks for watching and I really, really hope that I will

see you soon!

Hello and welcome to Newswatch, with me, Samira Ahmed.

Coming up: the party manifestos are all out.

How well has the BBC done on explaining