Santander UK (Banco Santander) and Halifax (Lloyds Banking Group) · AI used against the institution · severity 1 of 5
BBC You and Yours reporter Shari Vahl reported on 28 November 2024, during BBC Scam Safe Week, that an AI clone of her voice passed the telephone voice-ID checks of both her banks, Santander and Halifax. The clone, made from a radio interview she had given, said "my voice is my password" and got her past authentication to the stage where the system asked the reason for her call; it worked through studio speakers and again through a basic iPad speaker. She called from her registered phone number, so a criminal would also need the victim's phone. Santander said it had "not seen any fraud as a result of the use of voice ID"; Halifax called voice ID an "optional security measure". It was a controlled test with no loss.
Record last reviewed Oct 21, 2026 · Markdown
Date
Country
United Kingdom
AI system
AI voice clone made from a radio interview, used to pass telephone voice-biometric checks ('my voice is my password')
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Confirmed by the institution
Severity
1 of 5
Impact
No customer harm; the reporter used her own accounts · The clone passed voice authentication at two UK banks and reached the stage of phone banking where account information is available. A criminal would also need the victim's registered phone, the BBC noted. No money was moved.
What happened?
As part of BBC Scam Safe Week, Vahl had her voice cloned by the same expert who had cloned actor James Nesbitt's voice for a Starling Bank awareness campaign, using an interview she had done on the radio. She then called Santander's phone banking from her registered number and played a recording of the clone saying "my voice is my password". The system replied "Thank you for using your voice as your password" and asked the reason for her call.[1]
She repeated the test with her other bank, Halifax, part of Lloyds Banking Group, and the clone passed again. The first attempts used BBC studio speakers; a later attempt from her home on Merseyside through a basic iPad speaker also worked, suggesting high-quality audio was not needed. The BBC noted that the information reachable at that stage of phone banking could help criminals build trust with a victim.[1][2]
Saj Huq, a member of the UK government's National Cyber Advisory Board, told the BBC he was dismayed but not surprised, calling it a clear example of the risks of generative AI. CX Today and the Digital Watch Observatory reported the test the following day, and CX Today noted that OpenAI had earlier in 2024 encouraged phasing out voice-based authentication for bank accounts.[1][2][3]
When did it happen?
What was the impact?
- Customers: No customer harm; the reporter used her own accounts[1]
- Other: The clone passed voice authentication at two UK banks and reached the stage of phone banking where account information is available. A criminal would also need the victim's registered phone, the BBC noted. No money was moved.[1]
Severity 1 of 5: Contained: a journalist's controlled test on her own accounts at two banks, with no loss and no regulatory action reported.
How did Santander UK (Banco Santander) and Halifax (Lloyds Banking Group) respond?
Santander said: "We have not seen any fraud as a result of the use of voice ID and are confident that it provides greater levels of security than traditional knowledge-based authentication methods." It called voice ID "one element of our stringent approach to customer security and fraud prevention" and said: "We constantly review, test and enhance our systems in response to increasingly sophisticated tactics used by fraudsters." Halifax described voice ID as an "optional security measure" and said its "layered approach to security and fraud prevention provides the right level of protection for customers' accounts".[1]
What was the outcome, and did regulators act?
No regulatory action has been reported, and no public announcement by either bank of changes to voice ID in response was found as of 2026-10-21. Both banks kept voice ID in place as one layer of their security, per their statements to the BBC.[1][3]
Did an AI voice clone get into Santander and Halifax accounts?
Yes, in a controlled BBC test. In November 2024 reporter Shari Vahl played an AI clone of her voice saying "my voice is my password" and passed the phone-banking voice-ID checks at both Santander and Halifax, reaching the stage where the system asked the reason for her call. She was calling from her registered number.
Was any money lost in the BBC voice-clone test?
No. The reporter used her own accounts and did not move money. Santander said it had not seen any fraud resulting from voice ID. The BBC noted that a criminal would also need the victim's registered phone, but that the information reachable could help scammers win a victim's trust.
What did Santander and Halifax say about voice ID?
Santander said voice ID is one element of a wider security approach, more secure than knowledge-based checks, and that it constantly reviews and tests its systems. Halifax called voice ID optional and said its layered security gives the right level of protection. Neither bank announced changes to voice ID.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning