Machine learning-based caller authentication with Amazon Connect Voice ID (preview)

To authenticate callers, contact centers often use a time-consuming process where callers have to answer multiple questions verifying their personal details, like social security number, date of birth, and mother’s maiden name. This process is costly, time-consuming, and leads to poor customer experiences. Amazon Connect Voice ID provides real-time caller authentication, which makes voice interactions in contact centers more secure and efficient. Voice ID uses machine learning to verify the identity of genuine customers by analyzing a caller’s unique voice characteristics. This allows contact centers to use an additional security layer that doesn’t rely on the caller answering multiple security questions, and makes it easy to enroll and verify customers without changing the natural flow of their conversation. In this blog post, we will discuss how Amazon Connect Voice ID works and how you can start using it within Amazon Connect.

How Voice ID works

Voice ID requires two steps to authenticate – customer enrollment and customer verification.

Customer enrollment

When a customer calls for the first time, the contact center agent confirms the identity of the caller by using existing security measures such as asking for mother’s maiden name, or a one-time passcode (OTP) delivered by SMS. This ensures that only genuine customers are enrolled in Voice ID. To comply with relevant data protection laws, agents will obtain the customer’s consent where required, before enrolling them. Once the agent initiates the enrollment request, Voice ID listens to the call until it has captured 30 seconds of customer speech (excluding silence) and then creates the enrollment voiceprint. A voiceprint is a mathematical representation that implicitly captures unique aspects of an individual’s voice such as speech rhythm, pitch, intonation, and loudness. The caller does not need to say or repeat any specific phrases to enroll in Voice ID.

Customer verification

When the enrolled customer calls into the contact center again, they can be verified during their interaction with the Interactive Voice Response system (IVR) or with an agent. Voice ID needs 10 seconds of a caller’s voice to authenticate, which can be done as part of a typical customer interaction in the IVR or with the agent (such as “what’s your first and last name?” and “what are you calling about?”). Voice ID uses this audio to generate the caller’s voiceprint and compares it with the enrolled voiceprint corresponding to the claimed identity. Voice ID then generates an authentication score between 0 and 100 that indicates the confidence of match. Contact center managers can use an score authentication score threshold (default threshold is a score of 90) to create policies in Amazon Connect so that agents get a real-time result (“authenticated” or “not authenticated”) to complete the verification process or take additional security measures during the call.

Voice ID’s passive authentication approach does not require customers to say any specific words or phrases during enrollment and verification. Also, Voice ID can be used as an additional security layer in the IVR to authenticate customers without any human intervention. This empowers businesses to provide their customers self-service options for a wider range of issues.

Getting started

To get started with Amazon Connect Voice ID, follow these steps.

1. Log in to your Amazon Connect instance with a user that has permissions to edit contact flows.
2. Choose Routing> Contact flows, and then Create contact flow or open the contact flow where you want to enable Voice ID.
3. Add the Set Security Behavior block in the beginning of your contact flow.
4. In the contact block, when you set the Voice authentication to On, Amazon Connect starts streaming the customer portion of the audio to Voice ID.
5. You can increase or decrease the default Authentication threshold of 90 based on your security and business requirements.
6. Voice ID needs to know the identity of the caller that needs to be enrolled or verified. To provide this information to Voice ID, you can pull the unique customer ID of the caller from your CRM system, based on their phone number, or the response to security questions such as “enter last four digits of your social security number.” Then use the Set contact attribute block to assign a value to the customer ID attribute.

Using Voice ID to verify customers in the IVR

Once you have enabled Voice ID, you can use the Check security status block to check the response from Voice ID.

This block makes it easy for you to receive the voice analysis that includes one of the following status messages – ‘Authenticated,’ ‘Not Authenticated,’ ‘Not enrolled,’ ‘Opted-out,’ or ‘Inconclusive.’

Amazon Connect allows you to create intelligent routing in your contact center that can be based on the result of this contact flow block. For example, you can route a call directly to a customer service agent if the caller is not enrolled for authentication. We will discuss the enrollment experience later in this blog post.

Now, if the caller is already enrolled, Voice ID compares the caller’s voiceprint with the enrolled voiceprint corresponding to the customer ID and returns an ‘Authentication score’. If this ‘Authentication score’ is greater than or equal to the threshold (default threshold of 90 or your custom threshold), then the Check security status block returns the status ‘Authenticated.’ If Voice ID does not have enough speech to make a decision, it returns the status ‘Inconclusive.’

The drag and drop contact flow editor interface makes it easy for contact center managers to use Voice ID and create a secure self-service IVR experience for customers.

Create an agent experience using Voice ID

In addition to the IVR, Voice ID also allows you to design a custom authentication experience for your customer service agents. The Amazon Connect Streams API gives you the power to integrate Voice ID in your existing web applications with Amazon Connect. This API lets you embed the Amazon Connect Contact Control Panel (CCP) UI components into your page, and/or handle agent and contact state events directly, giving you the power to control agent and contact state through an object-oriented event-driven interface. You can take the following actions using the Streams APIs:

1. Enroll a customer: The enrollSpeakerInVoiceID API allows you to create an interface that makes it easy for the agent to enroll the customer with the click of a button.
2. Opt out a customer: Voice ID also makes it easy to opt out a customer based on their request by using the optOutVoiceIDSpeaker API.
3. Check latest authentication result: If the Voice ID already generated an ‘Authenticated/Not Authenticated’ decision based on the customer’s speech in the IVR, an agent who interacts with this customer can view this result using the evaluateSpeakerWithVoiceID API.
4. Re-authenticate a caller: The agent also has the option to re-authenticate the caller again during their interaction by using the evaluateSpeakerWithVoiceID API with the parameter ‘startNew = true’. This may be required if you want to make sure that the caller is still the same person and the call was not taken over by someone else. In some cases, you may want to validate the identity of a different person during the agent interaction. A common example of this is when a person uses their domestic partner’s phone to make the call and the partner’s phone number is associated with the partner’s customer ID. In this case, you can use the updateVoiceIDSpeakerId (speakerId) API and pass the new customer ID. This is required when the agent realizes that the caller is a different person compared to the original customer ID that was associated with the caller. In this case, the agent can simply update the correct customer ID and use Voice ID to complete a fresh verification.

In the custom agent desktop UI below, you can see that the agent has an option to enroll, opt-out, evaluate results of an existing session or evaluate results for a new session.

Conclusion

Amazon Connect Voice ID provides real-time caller authentication making contact centers more secure, providing a better customer experience, and improving the productivity of agents. Please click here to sign up for the preview or reach out to your AWS sales partner to register your interest. We will then review your information and respond to let you know when you can start using these features.