Technologists have predicted for years that biometric technology--fingerprints, voiceprints, eyeball scans--will become commonplace, replacing relatively insecure passwords and personal-identification numbers. Visa International last week said it took a major step toward mainstreaming biometrics technology.

The credit-card company formed a strategic partnership with biometric voiceprint-authentication vendor Vocent Solutions Inc. to develop voice-authentication technology that could be used to replace passwords and reduce fraud for online and mobile transactions. Visa uses Vocent's voice-authentication application, Voice Secure Password Reset, internally to reduce the number of costly password-reset requests to its call center, Visa VP Georgann Scally says. By the middle of next year, Visa hopes the two companies can develop similar software to ease the management of passwords for online merchants as well as transactions over cell phones.

"Visa is trying to grease the market for this," hoping credit-card issuers and merchants like the idea, says Theodore Iacobuzio, director of consumer credit at research firm TowerGroup. The success of Visa's deployment to 5,000 employees will let its partners see that voice authentication works.

SPEAKING OF BENEFITS Voice authentication offers several advantages Customers and employees don't need additional hardware or software on cell phones or PCs Businesses view it as less intrusive than other forms of biometrics People need to spend only a few minutes to train applications to learn their voiceprints Technology can increase security by providing an additional layer of authentication when used with existing security applications

The previous process of resetting virtual private network passwords at Visa was tedious, Scally says. Employees would call the help desk, respond to a few questions to confirm their identities, and then call into their voice mail to retrieve new passwords. With the new system, which has been active for about six weeks, an employee who has provided a voiceprint need only call an automated system, state his or her name, answer a query, and a new password will automatically be generated. Analysts estimate that such password requests represent 30% of all internal help-desk calls and can cost more than $100 per year for each employee. Vocent's application starts at $150,000.

While self-service password-reset apps have been available for years, analysts say they'll be watching how well Visa progresses on its plans to work with Vocent to deploy voiceprint-authentication technology for secure access and transactions by consumers. "Visa is interested in the idea of universal commerce, where you can perform commerce transactions anytime, anywhere, anyhow you'd like," Scally says, noting that Vocent already has helped Visa develop a prototype for mobile-commerce operations.

Voiceprints could hold greater promise for combating credit-card fraud than smart cards or other biometrics such as a thumbprint or iris scan, Iacobuzio says. All the employees or customers need "is their voice. They don't need any expensive biometric or smart-card readers on their PCs or phones," he says.

Vocent's Voice Secure Password Reset authenticates a voice by vetting it against a digital representation generated by that person's vocal track from a previous recording. Trying to trick the system with a recording won't work, Scally says, because callers are asked to pronounce a random sequence of digits.

"On a mobile phone, if you're purchasing something and have to key in a password or other type of information, it's difficult," she says. "So we're looking at Vocent to help us develop voice authentication and speech-recognition patterns that would make it easier and faster."

While Gartner security analyst John Pescatore says voice biometrics hold a lot of promise, the technology was developed for landline-quality phone service. "They may have a challenge getting this technology to work well with PC voice-over-IP Internet phones or even cell phones," he says. And don't expect PINs or passwords to disappear any time soon, TowerGroup's Iacobuzio says. Chances are voice biometrics will be used with them for some time, instead of replacing them.