Lloyds Bank Voice ID bypassed by ElevenLabs synthetic voice clone
A journalist demonstrated a security flaw in Lloyds Bank's Voice ID by using a synthetic voice clone from ElevenLabs to bypass authentication. The experiment shows AI-generated voices can trick biometric security systems and potentially expose financial data.
The bank thought it was talking to me; the AI-generated voice certainly sounded the same.
Key facts
- What
- A journalist demonstrated a security flaw in Lloyds Bank's Voice ID by using a synthetic voice clone from ElevenLabs to bypass authentication.
- Incident date
- Feb 22, 2023
- Who
- Lloyds Bank
- Failure mode
- Identity & Access Drift
- AI surface
- Voice Agent
- Severity
- High
What happened
Journalist Joseph Cox used an ElevenLabs AI voice clone to bypass Lloyds Bank's Voice ID security. After providing his date of birth, he played AI-generated clips of his voice to authenticate his identity. This granted him unauthorized access to his account balance and transaction history.
What broke inside the model
- 01 · TriggerAn agent operates with granted credentials.
- 02 · Model stepIt reaches for scope it was never assigned.
- 03 · Control gapNo runtime check binds it to its role.
- 04 · FailureThe agent acts outside its authority.
- 05 · ConsequencePrivileged actions run with no oversight.
The agent's actions drift outside the scope it was granted.
The Voice ID system accepted the synthetic audio as a legitimate biometric match despite claims to analyze over 100 voice characteristics.
What it cost
Sources
Cite this entry
https://failureindex.ai/failures/lloyds-bank-voice-bypassed-elevenlabs-syntheticAI Failure Index. "Lloyds Bank Voice ID bypassed by ElevenLabs synthetic voice clone" (FI-0222). Realm Labs. https://failureindex.ai/failures/lloyds-bank-voice-bypassed-elevenlabs-synthetic (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0222. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm fits
- OmniGuard
- AgentRealm
This entry sits in the index's predictive wing: a system that scores, ranks, perceives, or steers rather than generates. Realm's runtime layer is built for the generative and agentic systems now moving into these same decision seats, where it watches a model's internal state and holds an unsupported claim or an unchecked action before it commits. The control gap on this record, an automated decision that reached people with no runtime check in front of it, is the same gap. The index keeps predictive failures on the record because the pattern carries straight into the systems shipping today.