Banking by smart speaker arrives, but security issues exist

In this photo, taken June 14, 2018, Gareth Gaston, executive vice president and head of Omnichannel Banking at US Bank, discusses voice assistant banking with a mobile phone, an Amazon Echo (center) and a Google Home (right) in New York. (Photo by MARK LENNIHAN / AP)

NEW YORK — Hey Alexa, what’s my bank account balance?

Big banks and financial companies have started to offer banking through virtual assistants – Amazon’s Alexa, Apple’s Siri, and Google’s Assistant – in a way that will allow customers to check their balances, pay bills and, in the near future, send money just with their voice.

And with the rapid adoption of Zelle, a bank-to-bank transfer system, it soon could be possible to send money to friends or family instantly with voice commands.

But the potential to do such sensitive tasks through a smart speaker raises security concerns. Virtual assistants and smart speakers are still relatively new technologies, and potentially susceptible to being exploited by cyber criminals.

Regional banking giant US Bank is the first bank to be on all three services – Alexa, Siri and Assistant. The company did a soft launch of its Siri and Assistant services in early March and this month started marketing the option to customers.

Other financial companies have set up virtual assistant features. Credit card companies Capital One and American Express both have Alexa skills that allow customers to check their balances and pay bills. There are other smaller banks and credit unions that have set up Google Assistant or Alexa as well.

“We want to be there for our customers in any possible way that we can,” said Gareth Gaston, executive vice president for omnichannel banking at US Bank.

For now, US Bank is keeping the features available through bank-by-voice fairly restrictive.

Customers will be able to check bank balances, pay US Bank credit cards and mortgages, ask Alexa or Google the due dates on bills, and other basic functions. Money cannot be transferred from a US Bank account using voice yet, Gaston said, but the bank is considering the option.

Asking Google, Alexa or Siri for the weather or to tell a joke is one thing, but it’s a whole other issue when these assistants access and share sensitive personal information. These apps will typically announce a person’s available balance over the speaker, which has the potential to create awkward situations at parties.

In the case of Google and Alexa, users must create a secure connection between their bank and the assistant through Alexa’s Skills or Google’s Actions. All banks require the use of a four-digit PIN before they will provide balance and bank account info over these speakers, and suggest making those PINs different from the one on a customer’s ATM card.

Apple’s Siri is the most restrictive of the three virtual assistants, only showing a user a bank account balance on a screen, and not allowing other features like paying bills. Banks can integrate Siri into their iPhone and iPad apps, but Apple’s HomePod smart speaker that launched earlier this year does not currently accept banking commands. A company spokeswoman declined to say whether that feature was coming.

Google Assistant has the capability to do individual voice recognition, providing one additional level of security on that platform, but that is not implemented on US Bank’s Action yet. Security experts say that additional level of security could be foiled, however.

“Users’ voices can be recorded, manipulated, and replayed to the assistants,” said Kurt Baumgartner, a security researcher with Kaspersky Lab. “Also, with access to banking accounts and abilities to transfer and pay out money, remote financial fraud may be within the reach of cybercriminal groups soon.”