The present invention extends to methods, systems, and computer program products for securing audio-based access to application data. A client sends and a server receives a request for audio-based access to application data. The server sends a first audio challenge for a user credential in response to the request. The client receives the first audio challenge and sends a user credential. The server receives the user credential and sends a second audio challenge. The second audio challenge is configured to be understandable to a user of the client but difficult to recognize using automated voice recognition techniques. The client receives the second audio challenge and sends an additional portion of data responsive to the second audio challenge. The server receives the additional portion of data and calculates a client authorization based on the received user credential and received additional portion of data.