Every IVR that shares a balance, takes a payment or changes an account has to answer one question first: is this caller really the account holder? Ask too little and fraudsters get in. Ask too much and genuine callers hang up or press zero for an agent. This guide compares the authentication methods an IVR can use, explains how AI voice cloning affects voice biometrics, and shows how to combine methods by risk.
What is IVR authentication?
IVR authentication is the step in a phone call where the system confirms the caller's identity before it reveals account data or performs a transaction. It usually combines something the caller knows (a PIN or date of birth), something they have (their registered phone) and sometimes something they are (their voice).
Authentication is different from identification. Identification finds the likely account, often from the calling number or an account number. Authentication proves the caller owns it.
What authentication methods can an IVR use?
An IVR can use six main methods, alone or in combination.
Caller ID (ANI) matching
The IVR reads the calling number and looks it up against the numbers on file. It costs the caller nothing and speeds up routing. However, caller ID can be spoofed, and the FCC warns that spoofing "tricks Caller ID" into showing a number that is not the real one (FCC). Treat a match as a signal for identification, not proof of identity. Our guide to STIR/SHAKEN for outbound IVR explains how carriers attest calling numbers.
Account number and PIN
The caller keys in an account number and a PIN they set. It is familiar, cheap and works by keypad. PINs are only as strong as the caller's choice and your lockout rules, and callers forget them, which drives resets and agent calls.
Knowledge-based questions
The IVR asks for facts such as date of birth, ZIP code or the last four digits of a Social Security number. These are easy for callers to answer, but many of the answers can be found or bought, so they work best as a second factor for low-risk tasks.
One-time passcodes
The IVR sends a short code by SMS, or the caller reads one from an app, and keys it in. This proves possession of a registered device. NIST lists delivery of codes over the public phone network as a "restricted" authenticator and tells verifiers to watch for risks such as SIM changes and number porting (NIST SP 800-63B-4).
Voice biometrics
The caller enrolls by speaking several samples, and the system builds a voiceprint from their vocal characteristics. On later calls, the system compares the live voice with the voiceprint. Active voice biometrics asks the caller to say a passphrase or a set of digits. Passive voice biometrics checks the voice during natural conversation.
Out-of-band confirmation
The IVR asks the caller to approve the call in the company's mobile app, or calls them back on a number already on file. This is strong for high-risk actions but needs an app or a reliable callback number.
How do IVR authentication methods compare?
Each method trades security against caller effort and cost. Use this table to choose a mix.
| Method | Security | Caller effort | Cost and complexity | Best for |
|---|---|---|---|---|
| Caller ID (ANI) match | Low on its own, because numbers can be spoofed | None | Low | Routing and pre-filling the account |
| Account number and PIN | Medium | Low to medium | Low | Balance checks and routine self-service |
| Knowledge questions | Low to medium | Low | Low | Second factor on low-risk tasks |
| One-time passcode | Medium to high | Medium | Medium, with per-message costs | Payments and account changes |
| Voice biometrics | Medium to high as one factor of several | Low after enrollment | Medium to high, with enrollment and vendor fees | Frequent callers and agent handoffs |
| Out-of-band app or callback | High | Medium | Medium to high | Changing payout details and other high-risk actions |
Is voice biometrics still safe with AI voice cloning?
Voice biometrics still adds useful protection, but it should not be the only factor for anything sensitive. Generative AI tools can now produce realistic synthetic speech. The FCC warns that "deep-fake audio" is making scam calls harder to spot (FCC). The US Treasury's FinCEN reported an increase in suspicious activity reports describing deepfake media used "to circumvent identity verification and authentication methods" (FinCEN, November 2024).
NIST's digital identity guidelines, written for US federal systems and widely used as a reference, take a firm line. They say biometrics "SHALL only be used as part of multi-factor authentication with a physical authenticator," that a non-biometric option must always be available, and that biometric characteristics "can often be obtained online or otherwise without consent" (NIST SP 800-63B-4).
If you use voice biometrics today:
- Pair the voiceprint with something the caller has, such as a registered device or a one-time passcode.
- Ask vendors how they detect recordings and synthetic speech, and how they test those defenses.
- Keep a non-biometric fallback for callers with poor lines, colds or speech differences.
- Treat voiceprints as sensitive personal data, with consent, retention and deletion rules.
How do you choose the right authentication mix?
Match the strength of authentication to the risk of what the caller wants to do, and step up only when they ask for something riskier. Follow these steps:
- List the tasks callers complete in the IVR, from store hours to changing bank details.
- Rank each task by risk: information only, low-value transactions, payments, and account or payout changes.
- Assign a minimum method per tier. For example, caller ID plus PIN for balances, a one-time passcode for payments, and out-of-band confirmation for payout changes.
- Step up mid-call. Let callers start with light checks and add a factor when they choose a riskier option.
- Pass the result to agents. When a call transfers, send the authentication status with it so the caller does not repeat it.
- Review failures and fraud reports each month, and adjust thresholds and prompts.
How do you keep authentication from frustrating callers?
Make the information easy to find, keep inputs short and never trap a caller who fails a check. Print the account number clearly on every bill. Ask for the last four digits when full account numbers are long or contain letters. Carry authentication across channels when a chat or app session moves to a call. Give callers who fail a check a clear route to an agent or another method. For more on prompts and menus, read IVR call flow design best practices.
How Plum Voice handles IVR authentication
Plum Voice lets teams build these checks into their call flows:
- Caller ID. Plum DEV exposes the calling number to applications through the session.telephone.ani variable, so an app can look up the account before the first prompt.
- PINs and knowledge questions. Plum Fuse input modules such as Digits collect account numbers and PINs, and the "Private" setting keeps them out of logs and reports (Private mode). Plum's sensitive data types list flags birth dates and Social Security numbers for this treatment.
- Voice biometrics. Plum DEV offers voice biometrics verification services for multi-factor authentication through your sales representative (Plum docs).
- Your identity systems. REST integrations connect the IVR to your CRM, one-time passcode service or fraud tools.
Authentication is the first step in flows such as account inquiry, card activation and payment processing. To see how it fits with payments, read IVR payments: how pay-by-phone works and stays PCI compliant.