Detecting a replay attack on a voice biometrics system comprises receiving a speech signal; forming an autocorrelation of at least a part of the speech signal; and identifying that the received speech signal may result from a replay attack based on said autocorrelation. Identifying that the received speech signal may result from a replay attack may be achieved by: comparing the autocorrelation with a reference value; and identifying that the received speech signal may result from a replay attack based on a result of the comparison of the autocorrelation with the reference value, or by: supplying the autocorrelation to a neural network trained to distinguish autocorrelations formed from speech signals resulting from replay attacks from autocorrelations formed from speech signals not resulting from replay attacks.