Voice banking has been touted as the technology to watch in 2018 (even on this very site), but two recent developments show the new technology has significant challenges to overcome.

Whether or not consumers choose to engage in “voice banking” itself, the risks associated with virtual assistants and chatbots are growing. Juniper Research predicts that half of American households will contain a smart speaker by 2022, and virtual assistants are already ubiquitous on mobile devices. Capital One is up and running on Amazon’s Alexa, as are a few other institutions, but voice banking and voice commerce remain in their infancy.

Last week came the news that Alexa and other voice-activated virtual assistants were able to be activated and controlled via signals undetectable to humans. Known as the dolphin attack (the aquatic mammals apparently have great hearing), this exploit was first discovered last fall, but received new attention earlier this month when The New York Times brought it to mainstream attention. Hackers are able to interact with systems without alerting users, and were able, under specific circumstances, such as proximity to the device, to make phone calls and visit websites under an unsuspecting user’s very nose, or fingers.

This was ominous enough. But just days later came news that seemed so strange it couldn’t possibly be true: a Seattle-area woman reported Alexa recorded her conversation, then sent the file to a contact, all without her consent. Amazon explained to Recode how this could happen:

Echo woke up due to a word in background conversation sounding like “Alexa.” Then, the subsequent conversation was heard as a “send message” request. At which point, Alexa said out loud “To whom?” At which point, the background conversation was interpreted as a name in the customers contact list. Alexa then asked out loud, “[contact name], right?” Alexa then interpreted background conversation as “right”. As unlikely as this string of events is, we are evaluating options to make this case even less likely.”

Whether this reminds you of 2001 or 1984, we can agree both of these situations are unlikely, to say the least. But when it comes to your money, regulators will want to be sure these systems are safe, and it’s clear that as of now, concerning voice-based systems, we still have a lot more to learn.