Where voice appears in KYC and remote verification
Most KYC programmes think of identity as a document plus a face, but voice is present at more steps than many teams realise. Video KYC sessions carry an audio track in which the applicant answers an agent's questions. Some onboarding flows ask the applicant to read a phrase aloud as a liveness prompt. Periodic re-KYC and account recovery often happen by phone. High-risk customers may be called back to confirm a transaction or a change of details.
Each of these is an opening for a synthetic voice. In a video KYC session, an attacker can pair a face swap with a cloned or converted voice so both channels match the stolen identity. On a phone re-verification, a clone can answer knowledge questions taken from breached data. Voice deepfake detection fits KYC by checking the audio in these moments for synthetic speech, alongside the face and document checks already in place.
How voice deepfake detection fits into a KYC flow
Voice deepfake detection fits KYC as one more signal at the points where audio is captured, feeding the same risk engine that already weighs document, face and device results. It does not need its own approval step. The audio from a video session, a spoken liveness phrase or a re-verification call is scored for synthetic speech, and the result joins the other signals before the policy decides to approve, step up or refer to review.
The table shows where to place it and what a high-risk result should trigger.
| KYC step | Audio captured | What detection checks | Action on high risk |
|---|---|---|---|
| Video KYC session | Applicant's answers to the agent | Synthetic or converted speech; consistency with the face video | Agent asks unscripted follow-ups; refer to senior review |
| Spoken liveness prompt | A random phrase read aloud | Synthetic speech, replayed audio | Repeat with a new phrase; fall back to another liveness method |
| Phone re-KYC or recovery | Caller's voice | Cloned voice used with breached personal data | Require in-app approval or document re-capture |
| High-risk callback | Customer confirming a change | Cloned voice answering the bank's call | Hold the change; confirm through a registered device |
Why voice cannot be a KYC factor on its own
Voice matching was never designed to resist cloning. NIST's SP 800-63B-4, finalised in July 2025, states that biometric comparison based on voice shall not be used in its authentication guidelines, while requiring presentation attack detection for facial recognition and discussing injection attack detection. In February 2023 a Motherboard journalist reported accessing his own Lloyds Bank account by phone with a clone made from about five minutes of speech, with only his date of birth as the other check.
Regulators expect institutions to watch for synthetic media in identity processes. FinCEN's November 2024 alert FIN-2024-Alert004 warned that criminals use deepfake media created with generative AI to get around identity verification, and the FBI's December 2024 announcement lists cloned voices used to access bank accounts. Treat voice as supporting evidence that detection can confirm is human, never as the factor that completes verification.
Effect on user experience and high-volume onboarding
Done well, voice deepfake detection is invisible to genuine applicants. It analyses audio that is already being captured, so it adds no extra step, and only the small share of sessions with a high-risk score see a follow-up. The friction cost depends on the threshold: set it too low and genuine applicants with poor microphones or noisy rooms get stepped up; set it too high and clones pass. Tune it on your own sessions and track step-up rates by device type, language and network quality.
For high-volume onboarding, analysis needs to run asynchronously alongside the session or within the latency budget of the flow. Neural Defend's NeuroVerify accepts audio in the same API request as face images and video, runs six signals in one call and returns one unified risk score, and reports under 200 ms p95 on eligible image requests under defined test conditions. Audio timing should be measured on your own sessions during evaluation.
Keeping audit evidence from voice checks
Every automated KYC decision should leave a record a reviewer or examiner can follow: which media were analysed, which model version produced which score, what threshold applied, and what the policy did with the result. Store detector output with the session record and keep the original audio for the period your retention rules allow.
For disputed or referred cases, a reviewed forensic record carries more weight than a score alone. NeuroDetect lets an analyst examine the session's audio and video down to segments and frames, add notes, and download a forensic report that records observations, uncertainty, provenance and model context. Whether any record is accepted as evidence depends on the regulator or court, so involve compliance and legal teams in designing what you keep.
Which Neural Defend product to use for voice in KYC
Use NeuroVerify where voice is captured inside a digital onboarding or recovery flow, because it checks face images, video and audio together in one request and returns signal-level evidence for your policy. It does not analyse ID documents, so keep your document verification step. Use NeuroCall, currently in Beta, for phone-based re-KYC, recovery and callback steps, where it scores call audio for synthetic speech. Use NeuroDetect for referred cases that need a documented forensic review.
All three can run in a managed cloud, private cloud or VPC, on-premises or air-gapped, which matters when biometric data and session recordings fall under data protection rules. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certification.
Evidence boundary
Limitations
- Voice detection on short liveness phrases and low-quality microphones is less reliable than on longer, cleaner audio.
- Admissibility and retention rules for KYC evidence vary by jurisdiction; this page does not give legal advice.
- NeuroCall is in Beta, and the NeuroVerify latency figure applies to eligible image requests, not audio; measure audio timing yourself.
Source record
Sources and references
- NISTSP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator ManagementPublished July 31, 2025. Verified October 19, 2026.
- FinCENFinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions (FIN-2024-Alert004)Published November 13, 2024. Verified October 19, 2026.
- FBI Internet Crime Complaint CenterCriminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)Published December 3, 2024. Verified October 19, 2026.
- arXivASVspoof 5: Crowdsourced Speech Data, Deepfakes, and Adversarial Attacks at ScalePublished August 16, 2024. Verified October 19, 2026.
- European CommissionTransparency obligations under Article 50 of the AI ActVerified October 19, 2026.
- VICE (Motherboard)How I Broke Into a Bank Account With an AI-Generated VoicePublished February 23, 2023. Verified October 19, 2026.
