# Voice payment AFA threat model

Run this worksheet with payments, fraud, security, voice engineering, operations, legal, and accessibility owners. The examples and identifiers are fictional. Map the current RBI directions and your regulated entity’s approved authentication policy before launch.

## System boundary

**Conversation lane:** audio, speech recognition, language model, text-to-speech, call events, and explanations.

**Authorization lane:** transaction resolution, risk policy, approved authentication factors, transaction-specific challenge, signed approval, and one-time commit.

Rule: the conversation lane never receives raw OTP values, biometric templates, private authorization tokens, or permission to edit an approval state.

## Threat worksheet

| Threat | Fictional attack | Required evidence | Control owner | Result |
| --- | --- | --- | --- | --- |
| Voice replay | Recorded customer speech is played into the call | Replay and liveness test results by phone condition | Biometrics | |
| Voice clone | Synthetic voice passes similarity check | Current anti-spoof coverage and residual false-accept risk | Fraud | |
| Number takeover | Attacker controls calls and SMS | Approved step-up path independent of the compromised number | Authentication | |
| OTP exposure | Code enters transcript or logs | Search all events, dashboards, exports, and support tools using a test code | Security | |
| Transaction swap | Amount or beneficiary changes after approval | Approval bound to transaction hash; change forces new approval | Payments | |
| Approval replay | Signed approval is submitted twice | One-time commit and idempotency evidence | Payments | |
| Prompt injection | Caller asks agent to mark auth as passed | State accepted only from signed authorization service | Voice engineering | |
| Background speech | Television says “yes” | No commit from passive speech | Voice evaluation | |
| Template theft | Biometric template is exposed | Protected storage, limited access, revocation, and re-enrolment path | Security | |
| False reject | Genuine caller has illness or poor audio | Measured reject rate and accessible alternate path | Product | |
| Support abuse | Operator views or changes sensitive state | Role test, approval trail, and tamper evidence | Operations | |
| Recovery abuse | Attacker resets factors through weak support flow | Recovery threat model and high-risk review | Identity | |

## Transaction-binding test

Use an invented payment:

```text
Transaction ID: txn_example_7f2
Amount: ₹2,500
Beneficiary: Anita Rao, saved reference ending 1842
Rail: IMPS
Approval expiry: 120 seconds
```

Run these changes after approval. Every one must require a new authorization:

- amount ₹2,500 to ₹25,000;
- beneficiary Anita Rao to an unsaved UPI handle;
- debit account changed;
- rail changed;
- approval submitted after expiry;
- the same signed result submitted twice.

## Secret-isolation drill

1. Use a clearly fictional OTP such as `481927` in staging.
2. Complete the protected input path.
3. Search speech transcripts, model requests, analytics, call summaries, general logs, support views, exports, and error traces.
4. Expected result: no raw OTP outside the approved authentication service.
5. Repeat with a failed attempt and an interrupted attempt.

## Release record

```text
Payment workflow:
Applicable policy version:
Factors and independence review:
Transaction-binding evidence:
Anti-spoof test set version:
False-accept / false-reject review:
Telecom risk-signal policy:
Fallback and recovery owner:
Secret-isolation drill result:
Open risk, owner, expiry:
Approvers:
```