A bank login can be perfectly correct and still be catastrophically wrong. The password is right. The phone belongs to the customer. The one-time code arrives and gets entered. Then the customer sends $20,000 to a stranger because a calm voice on the telephone has persuaded her that the stranger is the bank. Every conventional identity check has done its job. The fraud still wins.
BioCatch built its business in that uncomfortable gap between identity and intent. Its software sits quietly inside a bank's website or mobile app and studies the mechanics of a session: typing rhythm, mouse travel, swipe pressure, phone angle, pauses, corrections, navigation, device condition and network context. Those inputs become risk signals. The bank decides whether to let the session pass, ask for another check, hold a payment or send the case to an investigator.
The pitch sounds almost impolite - your hesitation is data - but it solves a practical problem. Security controls usually add friction to everybody because a small minority may be criminal. BioCatch tries to reserve that friction for sessions that look wrong. It is less a digital bouncer checking IDs at the door than a floor manager noticing that someone inside is behaving oddly.
The first trick: watch how, not what
The founding insight arrived before behavioral biometrics became a tidy software category. Avi Turgeman had worked in military intelligence and became interested in whether human interaction with machines carried a measurable signature. In 2011, he founded BioCatch with Benny Rosenbaum and Uri Rivner. The early system looked for patterns that credentials could not explain. A legitimate customer might type familiar personal information fluidly; an identity thief might repeatedly copy and paste it. A bot might fill a form with inhuman consistency. A remote-access tool might introduce latency or produce touch events without the physical motion expected from a phone in someone's hand.
Five years of development preceded major account-takeover deployments at banks in the UK, Spain and Brazil. That long runway matters. The technology needed examples of both ordinary and criminal behavior, but a bank also needed a reliable way to turn a model score into an operational response. Novel detection without workflow is just an interesting dashboard.
From a crooked swipe to a useful decision
Behavior, device, application and network telemetry stream from the digital session.
Models compare the session with personal history, population patterns and known attack behavior.
A score and supporting indicators let the bank pass, challenge, hold or investigate.
BioCatch's customers are banks, credit unions, fintechs and other financial institutions. They buy an enterprise platform, integrate web or mobile collection software and connect the resulting intelligence to fraud systems. There is no public rate card. Contracts are negotiated, which is normal for software whose workload can range from a regional credit union to a global bank processing billions of sessions. Distribution increasingly comes through partners such as Alkami, Lumin Digital, Alloy, Microsoft and Nasdaq Verafin.
What failed first
The first thing to fail was not BioCatch's model. It was the industry's assumption that proving identity proved safety. Account-takeover protection works when the criminal behaves differently from the account owner. Social engineering scrambles that logic. In an authorized push-payment scam, the genuine customer logs in from a genuine device and deliberately authorizes the transfer. The unusual actor is off-screen, applying pressure.
That threat changed the product. BioCatch began emphasizing behavioral intelligence rather than behavioral biometrics alone. Scams360 looks for combinations that may suggest coaching or manipulation: uncharacteristic hesitation, unusual navigation, a call active during a session, risky payment context or signs of remote access. Mule Account Detection looks at the receiving side, where recruited or stolen accounts move criminal proceeds. BioCatch Link connects devices, IP addresses, payees and accounts. DeviceIQ asks not merely whether a device is recognized, but whether it can be trusted.
“We don't look at what they do, we just look at how they do things.”Gadi Mazor, CEO
The distinction is the company's moat and its limit. A single nervous pause proves nothing. Plenty of innocent people type slowly, use accessibility tools, switch hands or make mistakes. BioCatch's claim depends on context across thousands of signals, large comparison sets and feedback from bank investigators. The product is statistical evidence for a decision, not a magic lie detector.
The price of being early
BioCatch raised $10 million in 2014, $30 million in 2018 and a $145 million Series C led by Bain Capital Tech Opportunities in 2020. A further $20 million came from a group of banks later that year. The money funded the unphotogenic work that enterprise security demands: models, patents, integrations, cloud capacity, sales cycles and experts who can sit with a fraud team until a score becomes useful.
There were strategic shortcuts too. BioCatch acquired AimBrain's multimodal biometric platform in 2020 for an undisclosed cash price. Permira first invested in 2023, then bought a majority stake in 2024 at a $1.3 billion enterprise valuation. By the end of 2025, BioCatch reported more than $185 million in annual recurring revenue, 90 new customers for the year and more than 400 employees in over 20 countries. Permira says revenue nearly tripled during its ownership.
Then came Visa. On August 3, 2026, it agreed to pay $2.4 billion in cash for BioCatch. The transaction still requires customary approvals and is expected to close by the end of Visa's fiscal second quarter of 2027. The logic is upstream prevention. Visa already sees transactions at enormous scale; BioCatch adds intelligence from the moments before a transaction, from account opening through the digital session. Catch the coercion, takeover or mule account before the payment rail has to catch the money.
The part worth stealing
Founders cannot copy BioCatch's data history or bank relationships. They can copy the sequence. Start with a neglected signal linked to an expensive decision. Prove it in a narrow workflow. Build feedback from the operators who see whether the alert was right. Add adjacent signals only when they improve that decision. Then turn individual customers into a network.
Sell the action
A risk score matters only when the customer knows whether to pass, challenge, hold or investigate.
Keep friction selective
The product earns trust by leaving ordinary customers alone and explaining why exceptional cases look risky.
Close the loop
Investigator feedback improves models and turns a deployment into an operating system rather than shelfware.
Move with the attack
When criminals shifted from stolen identities to manipulated customers, BioCatch expanded from identity to intent.
Package the expertise
Fraud advisers and threat analysts make the software legible to customers facing unfamiliar attack patterns.
Build shared advantage
BioCatch Trust lets banks learn about risky recipients together without treating personal data as the product.
The network step is especially clever. BioCatch Trust began in Australia with major banks sharing real-time intelligence about receiving accounts without sharing personally identifiable information. A sending bank may know its customer looks distressed. A receiving bank may know the destination account behaves like a mule. Link those views before the payment completes and each institution becomes more useful to the others.
Where the playbook breaks
Behavioral intelligence is a poor fit when sessions are too sparse to establish patterns, when fraud outcomes never return to the model, or when the customer cannot integrate a score into a fast decision. It also needs careful accessibility, privacy and model-governance work. Behavior varies with age, ability, injury, culture, device and circumstance. Treating an anomaly as guilt would turn a low-friction defense into a discrimination machine.
Where BioCatch fits now
BioCatch competes with behavioral and device intelligence from LexisNexis Risk Solutions, Mastercard's NuData and Callsign, and with broader fraud platforms such as Featurespace, Feedzai and NICE Actimize. Banks can also assemble an internal stack from identity proofing, device fingerprinting, transaction monitoring and rules. BioCatch's difference is the depth of behavior-first data, the union of behavior with device and network context, and a product line stretching from account opening to the receiving account.
The company says its software prevented more than $4 billion in fraudulent transactions in 2025. Individual case studies give the number texture: one UK bank reported 81 percent fraud detection with a 0.05 percent false-positive rate during an account-takeover attack; the Lumin Digital partnership estimated $46 million in prevented losses across nearly 50 U.S. institutions in 2025. These are company and customer results, not universal guarantees. Fraud products live or die in the local data, workflow and attack mix.
Still, the larger observation has held up remarkably well. People leak intent into interfaces. Criminals do too. The winning product did not stop at noticing the leak. It learned to combine it with devices, networks, payees and investigators, then return an answer before the irrevocable click. Fifteen years after the first experiment, Visa has put a $2.4 billion price on that head start.