Visa Bets $2.4 Billion on Behavioral Biometrics

Behavioral Biometrics Becomes Visa's $2.4 Billion Bet

Behavioral biometrics just became a $2.4 billion line item inside the world's largest payments network. Visa announced Monday that it will acquire BioCatch, betting that behavioral biometrics, the science of reading how a person moves, types and holds a phone, can catch fraud before a single dollar leaves an account. The deal lands at a moment when generative AI is turning scams into an industrial process, and the old password based defenses are buckling under the load.

The price tag reflects the scale of the problem. Visa estimates that account takeovers and scams cost the global economy more than $1 trillion a year, and the company is now paying cash to move its detection net further upstream. BioCatch, founded in Tel Aviv in 2011, has spent more than a decade turning behavioral biometrics into a working business, and Visa is buying it from funds advised by private equity firm Permira along with other shareholders. The transaction is expected to close by the end of Visa's fiscal second quarter of 2027, subject to regulatory approval.

What makes the purchase notable is not the sum but the shift in strategy it signals. Visa built an empire on the moment money changes hands. It is now paying a premium to see what happens in the minutes before that moment, when a fraudster is still poking around a banking app trying to look legitimate.

What BioCatch Actually Sees

BioCatch does not ask who you are in the traditional sense. It watches how you act. According to Visa's official announcement, the company's models analyze more than 3,000 anonymized signals per session, including keystroke rhythm, mouse movement, touchscreen gestures, the angle at which someone holds a device, and even signs that a jailbroken phone or an automated AI agent is driving the interaction. The premise is simple. A criminal may steal your credentials, clone your device fingerprint and gather enough personal data to pass a security quiz, but replicating the muscle memory of how you swipe and type is far harder.

That approach gives banks a second line of defense that activates even when every conventional check comes back clean. Behavioral biometrics can flag a session where the login is technically valid yet the user behaves like a stranger, or where a legitimate customer shows signs of being coached through a scam in real time. BioCatch's systems continuously score both intent and coercion across every millisecond of a digital banking session.

The reach is substantial. BioCatch protects 1.8 billion devices and 760 million users worldwide, serves more than 350 banking clients across 21 countries, and counts over 100 of the world's largest banks among its customers. Its models process 19 billion online banking sessions every month. Founder and chief executive Gadi Mazor confirmed in a company blog post that the business, its leadership and its reporting structure will stay intact as it joins Visa's Value-Added Services organization.

Moving Fraud Detection Upstream

Visa's leadership keeps returning to one word: upstream. The card network already sits at a valuable choke point, where it can scan transactions for anomalies as money flows between merchants, banks and consumers. But by the time a suspicious payment reaches that layer, the fraud is often already in motion. Behavioral biometrics lets Visa watch the earlier act, the login and the navigation, where warning signs appear before any transfer is initiated.

"Account takeovers and scams cost the global economy over $1 trillion annually, and AI is enabling these attacks at unprecedented scale," said Andrew Torre, president of value-added services at Visa. "BioCatch will help our clients stop fraud before it reaches the point of payment. This acquisition is part of our strategy to help clients prevent cyber threats upstream, building trust into every transaction."

The logic is compelling because so much modern fraud never looks like fraud at the payment stage. Authorized push payment scams, in which a victim is manipulated into sending money themselves, originate from a real customer on a trusted device using correct credentials. Nothing about the transaction itself is anomalous. The only tell is behavioral, and behavioral biometrics is built to read exactly that: hesitation, unusual navigation, or patterns consistent with someone acting under pressure.

AI Rewrites the Economics of Fraud

Fraud has always been a scale business, and scale is exactly what artificial intelligence now delivers to criminals. Tasks that once demanded human effort, writing convincing phishing messages, researching targets, cloning voices, impersonating relatives, can be automated and personalized in seconds. A scam that used to require a person can now be run by a script against thousands of victims at once, translated into any language, dressed in synthetic audio and video that feels authentic.

That shift is the real reason Visa is willing to write a nine-figure check. When the cost of launching a believable attack collapses toward zero, defenders can no longer rely on friction and rarity to keep losses manageable. They need signals that machines cannot easily fake, and the way a specific human interacts with a specific device remains one of the hardest things to synthesize convincingly. Behavioral biometrics is, in effect, a countermeasure aimed squarely at the automation advantage that AI hands to fraudsters.

Visa is not approaching this cold. Over the past five years the company says it has invested more than $13 billion in technology and infrastructure to defend the payments ecosystem, and it has begun deploying its own AI security tools, including an open-source agentic harness designed to help clients find and fix vulnerabilities at scale. BioCatch adds the behavioral biometrics layer that watches the human, not the network. Readers tracking this arms race can follow the wider coverage on Blumefield.

The Card Networks' Security Arms Race

This is not Visa's first move into the security business, nor is it happening in isolation. Visa absorbed the fraud-detection firm Featurespace in 2024, and its chief rival Mastercard completed a $2.65 billion purchase of threat intelligence company Recorded Future the same year. The two payment giants are steadily rebuilding themselves around risk, identity and cyber defense, selling protection to financial institutions as aggressively as they once sold the pipes that move money.

The strategic reasoning is sound. Interchange fees remain lucrative but politically exposed and slow-growing, while fraud prevention is a fast-expanding market with pricing power and deep lock-in. Every bank that wires BioCatch's behavioral biometrics into its login flow becomes harder to pry loose, and Visa gains a data vantage point, the digital banking session itself, that it never previously owned. Owning that layer turns a defensive expense into a recurring revenue stream.

Risks remain. Behavioral data invites scrutiny from privacy regulators, the integration of a 350-client platform is rarely seamless, and the deal must still clear antitrust review in multiple jurisdictions before it closes in 2027. Critics will note that concentrating so much fraud intelligence inside a single network raises its own systemic questions. Yet the direction of travel is unmistakable. As AI erases the line between a genuine customer and a convincing impostor, the companies that route the world's money are betting on behavioral biometrics to watch not what you know, but how you behave. For more on the collision of AI and financial security, see Blumefield's ongoing analysis.