Why this guide was published today

Visa has agreed to acquire behavioral-intelligence company BioCatch for $2.4 billion in cash. The deal shows how payment companies are investing in technology that tries to detect fraud before a transaction reaches the final payment stage.

What this article adds beyond the acquisition news

• A simple explanation of behavioral biometrics.
• A comparison with passwords, fingerprints and device checks.
• Realistic examples of normal, suspicious and scam-influenced sessions.
• A privacy and fairness checklist for banks and customers.
• An immediate response plan for suspected account takeover.
• A safe student project that does not collect sensitive banking data.

What is behavioral biometrics?

Traditional login security asks whether a person knows a password, possesses a registered device or can provide a fingerprint or facial scan.

Behavioral biometrics examines how a person interacts with a website, phone or application. It may evaluate patterns such as typing rhythm, swiping, scrolling, device movement and navigation behaviour.

Simple definition:

Behavioral biometrics is the analysis of interaction patterns to estimate whether a digital session appears normal, automated, controlled by a fraudster or influenced by a scammer.

The system usually does not make a decision from one tap or typing mistake. It combines many signals and compares the current session with previous behaviour, population patterns and known fraud indicators.

Which behaviours can produce security signals?

Typing cadence

The timing between keystrokes, use of corrections and whether information appears to be typed naturally or pasted from another source.

Touch and swipe patterns

Swipe speed, direction, pressure where supported, finger movement and the way a person selects buttons or fields.

Device handling

How the phone is held, its orientation and movement patterns during a session.

Mouse behaviour

Pointer movement, pauses, speed, clicking patterns and whether actions resemble automated software.

Navigation sequence

Which screens are opened, how quickly the user moves between them and whether the path matches normal activity.

Data-entry behaviour

Whether account information is entered from memory, copied and pasted, repeatedly changed or completed in an unusual order.

Session context

Device reputation, network information, location changes, login history and other security signals may be considered alongside behaviour.

A bank does not necessarily collect every signal listed above. The exact data depends on the provider, application, permissions, device capabilities and local privacy requirements.

How a behavioral fraud check can work

Simplified session-risk process

1

The customer signs in

Passwords, passkeys, device checks or multifactor authentication establish an initial level of trust.

2

The session is observed

The security system collects approved interaction and contextual signals while the customer uses the service.

3

Patterns are compared

Current behaviour is compared with previous sessions, known attack patterns and population-level indicators.

4

A risk score is produced

Multiple weak and strong signals are combined instead of treating one unusual action as proof of fraud.

5

A proportionate response follows

The bank may allow the action, request another verification step, delay the transfer or send the case for review.

Example:

A customer signs in from their normal phone but suddenly pastes a new payee’s details, pauses for long periods, switches repeatedly between a messaging app and the banking app, and attempts to transfer nearly all available funds.

None of these signals alone proves fraud. Together, however, they may justify an additional warning or verification step.

Behavioral biometrics compared with other security methods

Method	What it checks	Main limitation
Password or PIN	Whether the user knows a secret.	The secret can be stolen, guessed, reused or revealed to a scammer.
One-time verification code	Whether the user has access to a registered phone, email or authenticator.	Codes can be intercepted or voluntarily shared during social-engineering attacks.
Fingerprint or face recognition	Whether a physical biometric matches an enrolled template.	It commonly verifies the person at one moment rather than evaluating the complete session.
Device recognition	Whether the phone or computer has been seen before.	A criminal may control the victim’s real device through malware or remote access.
Behavioral biometrics	Whether interaction patterns appear consistent with normal or trusted behaviour.	Behaviour can change naturally, and unusual behaviour is not automatic proof of fraud.

Strong account protection combines multiple layers. Behavioral analysis should support—not automatically replace—secure authentication, transaction monitoring, customer warnings and human investigation.

Conceptual risk-score model Session risk = behavioural anomalies + device risk + transaction risk + network risk + known fraud indicators This is an educational model, not BioCatch’s proprietary formula or an industry-standard calculation.

Three different sessions that may look unusual

These examples demonstrate why the response should be proportional. A changed typing pattern may justify another check, but it should not automatically prove criminal behaviour.

Where behavioral biometrics can fail

Natural behaviour changes

Injury, age, stress, medication, disability, a new device or an unfamiliar keyboard may alter interaction patterns.

Limited history

A new customer may not have enough previous sessions to create a useful personal baseline.

Shared devices

Family members or employees may legitimately use one device in ways that differ from the primary user.

Accessibility technology

Screen readers, voice control, external keyboards and assistive switches can create different interaction patterns.

False confidence

A normal-looking session is not guaranteed to be safe. Skilled criminals may use the victim’s device or manipulate the genuine customer.

Poorly designed responses

Blocking an urgent legitimate payment without clear support can harm customers and reduce trust.

Fairness requirement:

Customers should have a reasonable way to verify legitimate activity and challenge an incorrect restriction. An automated risk score should not become an unexplained permanent judgement about a person.

Behavioral biometrics and scam detection

Account-takeover fraud and authorised-payment scams are different problems.

During account takeover, a criminal controls the account without permission. During an authorised-payment scam, the real customer performs the transaction after being deceived, pressured or frightened.

Passwords and one-time codes may not stop the second situation because the real customer can successfully pass each authentication step. Behavioral and transaction signals may help identify that the session differs from the customer’s normal activity.

Technology still cannot determine with certainty what another person said during a private telephone call. Banks should combine automated warnings with trained staff and clear customer education.

How banking customers should protect themselves

Personal account-security checklist

Secure the login

• Use a unique password or passkey for the financial account.
• Enable multifactor authentication where available.
• Prefer an authenticator application or security key when supported.
• Never share a one-time code with a caller or message sender.

Secure the phone

• Install operating-system and banking-app updates.
• Use a strong screen lock and biometric unlock where appropriate.
• Remove unknown remote-access and screen-sharing applications.
• Do not conduct financial activity on an untrusted public device.

Verify urgent requests

• End unexpected calls claiming that money is in immediate danger.
• Contact the bank using the number printed on the card or official statement.
• Do not use a telephone number supplied by the suspicious caller.
• Never transfer money to a “safe account” suggested during an unsolicited call.

Monitor activity

• Enable transaction and login alerts.
• Review account statements regularly.
• Report unknown transactions immediately.
• Keep recovery telephone numbers and email addresses current.

What to do when a bank challenges a legitimate transaction

1. Read the warning rather than repeatedly submitting the same transfer.
2. Confirm that the banking app and telephone number are official.
3. Complete the bank’s additional verification process.
4. Explain any relevant change, such as travel, injury or a new device.
5. Ask how to appeal or review the decision when access remains restricted.
6. Do not provide passwords or complete one-time codes to an incoming caller.

A security check can be inconvenient, but avoiding unsafe verification methods is more important than completing the payment quickly.

Privacy questions a responsible bank should answer

Which signals are collected?

The explanation should distinguish interaction measurements from message contents, passwords and unrelated personal information.

Why is each signal necessary?

Data collection should be connected to a defined security or fraud-prevention purpose.

How long is the information retained?

Retention should not automatically continue forever simply because storage is inexpensive.

Who receives the information?

Customers should understand whether data is processed by the bank, a security provider or other approved partners.

Can the data be used for another purpose?

Fraud-prevention signals should not quietly become advertising, employee-monitoring or unrelated profiling data.

How can a customer challenge a decision?

Human review and accessible support are particularly important when a payment or account is restricted.

Immediate response to suspected account takeover

Student project: build a privacy-safe session-risk simulator

This project demonstrates risk scoring without collecting real passwords, bank details or unique biometric profiles.

1. Create a fictional dataset containing 100 digital sessions.
2. Add non-identifying fields such as session duration, number of corrections, pasted fields and new-device status.
3. Label some fictional sessions as normal, account takeover or scam-influenced.
4. Create a simple rule-based risk score.
5. Test different warning thresholds.
6. Calculate how many legitimate sessions are incorrectly flagged.
7. Calculate how many fraudulent sessions are missed.
8. Add a human-review stage for medium-risk sessions.
9. Write a data-retention and appeal policy.
10. Explain why the simulation must not be presented as a real banking-security product.

The strongest report will discuss false positives, accessibility, privacy and the consequences of blocking a legitimate customer.

Original analysis: fraud detection is moving beyond the login screen

Older account-security systems concentrated heavily on the moment of login. Once a person entered the correct password and verification code, the rest of the session could be treated as trusted.

Modern fraud increasingly exploits that assumption. Criminals can steal credentials, take control of a device or persuade the genuine customer to authorise a transaction.

Behavioral analysis extends security across the complete session. This can help institutions respond to suspicious activity that appears after successful authentication.

However, continuous security can also become continuous surveillance when its limits are unclear. The value of the technology depends on collecting only necessary signals, testing for unfair errors and allowing customers to challenge automated decisions.

Visa’s planned acquisition suggests that fraud intelligence is becoming a central part of payment infrastructure rather than a separate tool added after losses occur.

The best outcome would not be a system that silently watches everything. It would be a layered system that notices meaningful risk, explains its response and helps customers stop dangerous payments before money leaves the account.

Frequently asked questions

Editorial transparency: This article uses Visa’s proposed BioCatch acquisition as the current starting point. The session examples, privacy audit, response plan and student exercise are original educational frameworks. The conceptual risk equation does not represent BioCatch’s proprietary technology or the internal scoring system of any bank.

Final takeaway

A password can show that someone knows a secret. Behavioral biometrics tries to determine whether the complete session behaves like a trusted customer. It can improve fraud detection, but it should remain one transparent and reviewable layer within a broader security system.

Sources

Reuters — Visa to acquire BioCatch for $2.4 billion:
Read the Reuters report

Visa — Official BioCatch acquisition announcement:
Read Visa’s announcement

BioCatch — What is behavioral biometrics?:
Review BioCatch’s explanation

BioCatch — Behavioral intelligence and continuous session analysis:
Review the behavioral-intelligence overview

Federal Trade Commission — Recognising and avoiding phishing scams:
Review the FTC guidance

Federal Trade Commission — Protecting personal accounts from hackers and scammers:
Review account-protection guidance