Lloyds Bank (Lloyds Banking Group) · AI used against the institution · severity 1 of 5
Vice's Motherboard reporter Joseph Cox reported on 23 February 2023 that he had passed Lloyds Bank's telephone Voice ID check with a synthetic clone of his own voice made on a free ElevenLabs account from about five minutes of recorded speech. After entering his date of birth and playing the clone saying "my voice is my password", he reached his balance and recent transactions; earlier attempts had failed until he adjusted the clone. Lloyds told Vice that Voice ID is optional and gives more security than knowledge-based checks, that it was aware of the synthetic-voice threat and deploying countermeasures, and that it had not seen such voices used to defraud its customers. It was a controlled test with no loss.
Record last reviewed Oct 21, 2026 · Markdown
Date
Feb 22, 2023 · disclosed Feb 23, 2023
Institution
Country
United Kingdom
AI system
ElevenLabs voice synthesis (attacker side); Lloyds Voice ID (target) · Generative voice-cloning service used to pass a bank's telephone voice-biometric check · vendor: ElevenLabs
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Confirmed by the institution
Severity
1 of 5
Impact
No customer harm; the test used the reporter's own account · The cloned voice plus a date of birth gave access to the account balance and a list of recent transactions and transfers over the phone. No money was moved.
What happened?
Cox phoned Lloyds Bank's automated service line and, instead of speaking, played a sound clip of a synthetic version of his voice saying "check my balance". The system asked for his date of birth, which he typed, then asked him to say "my voice is my password". He played the cloned phrase, the system authenticated the voice, and he gained access to his balance and a list of recent transactions and transfers.[1]
He made the clone by uploading about five minutes of his own recorded speech to ElevenLabs, an AI-voice company, at no cost and without providing ID or payment details. Several attempts failed with Lloyds' system saying it could not authenticate the voice; after he had the clone read a longer body of text to make its cadence more natural, the audio passed. Other voice-cloning services he tried struggled with his British accent.[1][2]
Lloyds' website said at the time that its Voice ID analyses over 100 characteristics of a caller's voice and that "your voice is like your fingerprint". Cox tested only Lloyds, but noted that TD Bank, Chase and Wells Fargo offered similar voice verification. Trade and tech outlets including Futurism, Biometric Update and IT Brew followed up on the test, and security specialists quoted by IT Brew advised treating voice as at most one factor alongside others.[1][3][4]
When did it happen?
- Feb 22, 2023
Cox uses an ElevenLabs clone of his voice to pass Lloyds Bank's telephone Voice ID check and reach his account information.[1]
- Feb 23, 2023
Vice's Motherboard publishes the test with a statement from Lloyds Bank.[1]
- Mar 31, 2023
IT Brew reports on the test, quoting Lloyds' statement and security specialists who recommend multiple authentication factors.[4]
What was the impact?
- Customers: No customer harm; the test used the reporter's own account[1]
- Other: The cloned voice plus a date of birth gave access to the account balance and a list of recent transactions and transfers over the phone. No money was moved.[1]
Severity 1 of 5: Contained: a journalist's controlled test on his own account that exposed balances and transactions but caused no loss and no regulatory action.
How did Lloyds Bank (Lloyds Banking Group) respond?
A Lloyds Bank spokesperson told Vice: "Voice ID is an optional security measure, however we are confident that it provides higher levels of security than traditional knowledge-based authentication methods, and that our layered approach to security and fraud prevention continues to provide the right level of protection for customers' accounts, while still making them easy to access when needed." Lloyds said it was aware of the threat of synthetic voices and deploying countermeasures, but had not seen a case where such a voice had been used to commit fraud against its customers.[1][4]
What was the outcome, and did regulators act?
No regulatory action has been reported. Lloyds kept Voice ID as an optional measure; no public announcement of changes to it in response to the test was found as of 2026-10-21. In November 2024 a BBC reporter passed the voice-ID checks of Santander and of Halifax, also part of Lloyds Banking Group, with an AI clone of her voice.[1][5]
Did an AI voice clone really get into a Lloyds Bank account?
Yes, in a controlled test. Vice reporter Joseph Cox reported in February 2023 that an ElevenLabs clone of his own voice, plus his date of birth, passed Lloyds Bank's telephone Voice ID and gave him access to his balance and recent transactions. It took several attempts and some adjustments to the clone.
Was any money lost in the Lloyds voice-clone test?
No. The reporter used his own account and only reached account information such as balances and recent transactions; no money was moved. Lloyds said it had not seen synthetic voices used to commit fraud against its customers. No regulator took action over the test.
What did Lloyds Bank say about the voice-clone test?
Lloyds said Voice ID is optional and, in its view, more secure than knowledge-based checks, and that its layered fraud controls protect accounts. It said it was aware of the synthetic-voice threat and deploying countermeasures, and that voice ID had led to a significant fall in phone-banking fraud.
Is the Lloyds voice-clone case counted as an AI incident?
Yes, as an AI-weaponised case: an outside party used a generative voice-cloning service to defeat a bank's voice biometrics. It is a journalist's demonstration with no loss, so it is rated severity 1. Lloyds did not itself describe the cloned voice as AI, so attribution is inferred from the record.
- How I Broke Into a Bank Account With an AI-Generated Voice news
- Journalist uses AI voice to break into own bank account news
- Journalist Clones His Voice and Uses It to Break Into His Own Bank Account news
- Voice generation AI blows through bank's voice ID security news
- Cloned customer voice beats bank security checks news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning