Visa is paying $2.4 billion for BioCatch, an Israeli behavioral biometrics company whose software tracks how users type, swipe, and hold their phones to flag account takeovers and social-engineering scams. The all-cash deal is Visa's largest cybersecurity acquisition in years and folds a specialist fraud-detection engine directly into a payment network that processes hundreds of billions of transactions annually.
BioCatch sits in a corner of the security market that has grown urgent in the generative AI era. Rather than checking passwords or one-time codes, its models score the physical rhythm of a user's interaction with a device — cursor movement, tap pressure, scroll speed, the pauses between keystrokes. Those signals are hard for a scripted bot or a remote attacker to replicate, and they degrade in specific ways when a legitimate user is being coached by a scammer on the phone.
That last case, known in the industry as authorized push payment fraud, is the fastest-growing loss category for banks and card networks. Victims log in themselves, authenticate correctly, and move money on instructions from a criminal posing as a bank agent, delivery service, or family member. Traditional fraud rules see a clean session. Behavioral biometrics can see a user hesitating, reading from a script, or handling their phone differently than they normally do.
Key facts
- 01Visa agreed to acquire BioCatch for $2.4 billion in an all-cash cybersecurity deal.
- 02BioCatch's software analyzes behavioral biometrics — typing cadence, swipe patterns, device handling — to spot fraud in real time.
- 03The purchase deepens Visa's fraud-detection stack as AI-generated scams escalate across global payment rails.
For Visa, the acquisition is a bet that the next round of payment fraud will look less like stolen card numbers and more like manipulated humans. Generative AI has made voice cloning, deepfake video calls, and personalized phishing cheap and scalable. The industry consensus is that identity-layer defenses — the ones that ask whether the human at the keyboard is really who they claim to be, and really acting freely — matter more than they did even two years ago.
BioCatch's customer base skews toward large banks, which already run its scoring alongside their own fraud systems. Embedding the technology inside Visa's network potentially extends that coverage to any issuer or merchant on the rails, without each one having to negotiate a separate contract. It also gives Visa a proprietary data signal it can price into its risk products, a category the company has been building out as interchange revenue faces regulatory pressure in multiple markets.
The $2.4 billion price tag is a meaningful premium over BioCatch's last private valuation, which sat closer to $1.3 billion after a 2023 secondary transaction led by Permira. Existing investors including Bain Capital, Sapphire Ventures, and Maverick Ventures are among the sellers. The deal is subject to regulatory approval in the United States, European Union, and Israel.
Competitors in the behavioral-biometrics and fraud-orchestration space — including Feedzai, Featurespace, and Mastercard's own in-house risk unit — now face a more integrated rival. Mastercard acquired Ekata for $850 million in 2021 and Recorded Future for $2.65 billion in 2024, and has been assembling a similar identity-and-risk stack. The Visa deal closes a gap and, at $2.4 billion, resets the price for pure-play behavioral biometrics specialists still on the market.
Skeptics will note that behavioral biometrics is not a finished science. False-positive rates matter enormously at Visa's scale, where blocking a legitimate transaction costs a real customer and a real merchant. Regulators in Europe have also raised questions about how continuous biometric profiling squares with GDPR consent requirements, and BioCatch has adjusted its disclosures more than once in response. Integration risk is real: bolting a specialist scoring engine onto a global network without introducing latency or new failure modes is nontrivial.
The strategic logic still holds. Payment networks make money by keeping fraud losses low enough that issuers and merchants stay on the rails, and by selling premium risk services on top of authorization. AI-driven scams are pushing loss curves in the wrong direction, and the defenses that work are the ones that operate on signals attackers cannot easily fake. Visa is buying one of the better-instrumented versions of that defense and taking it off the market for everyone else.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
