By Musammad M Tamanna

A cybersecurity researcher studies how financial institutions can identify suspicious calls while limiting false alarms.

Q: What problem are you trying to solve?

A: A person’s voice can now be imitated with AI, creating risks for banks and their customers. A detector may identify a cloned voice, but it can also mistakenly flag a genuine caller. If staff receive too many false warnings, they may begin to ignore them. I want to study how detection systems can respond more reliably to the conditions of real telephone calls.

Q: What is EchoShield?

A: EchoShield is a framework I developed for my cybersecurity capstone with my advisor, Dr. Thaier Hayajneh. It works with an existing voice-deepfake detector and adds a smaller decision layer that can adjust its warning threshold using feedback from a human agent. The system is designed to alert the agent; it does not block calls or make account decisions.

Q: What have you found so far?

A: In an initial experiment, I tested 70 genuine recordings and 70 cloned recordings. After one feedback update, false alarms on the genuine test clips fell from seven to two. The number of cloned clips detected stayed the same. That is an encouraging result for reducing unnecessary warnings, but it is a small experiment and should not be treated as proof that the method is ready for banking use.

Q: What are the limits of the current work?

A: The test set was limited, including a small number of speakers and cloning conditions. The method also cannot recover a cloned voice that the underlying detector fails to recognize. The next step is broader testing across speakers, voice-cloning tools, telephone audio conditions, and background noise. We need to report both what improves and what remains difficult.

Q: Why does the human feedback matter?

A: A detector’s score is only one part of a decision. People working in a contact center understand the setting and can provide useful feedback, while the system can help them notice patterns. The goal is to support human judgment and measure whether an alert is useful, not to replace the people responsible for customer interactions.

Q: How could this research be useful beyond one institution?

A: Different banks and credit unions use different telephone systems and serve different communities. A method should be tested in varied conditions before anyone assumes it will work everywhere. I plan to develop an evaluation protocol, research code, a warning prototype, and guidance describing both the method and its limitations. Making those materials available could help researchers and financial institutions assess the approach for their own needs.

Q: What comes next?

A: My plan is to expand the evaluation, develop a prototype that warns a human agent during a call, and prepare public guidance on setting thresholds and interpreting warnings. Each stage needs careful testing. I want the work to be transparent enough that others can examine the results and decide where the method is useful.

ABOUT MD. SHAKHAWAT HOSSEN

Hossen holds an M.S. in Cybersecurity from Fordham University and is pursuing a Ph.D. in Cybersecurity at Old Dominion University. His professional background includes network and information-security work at Pubali Bank PLC. His research focuses on cybersecurity methods for detecting AI-generated voice impersonation.

Contact: shakhawat.dolar@gmail.com