It's amazing that they'd allow 7+ attempts to correctly identify the customer's voice. To me, that signals either poor security practices or a lack of confidence from HSBC in the technology itself.
i'd say a determined adversary is probably more difficult than my customer's twin....