Your bank knows your password. The criminal who stole it might know it, too. That leaves an awkward question hanging over the login screen: what, exactly, has the bank just proved? Callsign has built a business around collecting a more revealing set of clues. How you type. How you swipe. How you hold the phone. The device and location involved. The little things you do while thinking about something else.
The London company sells authentication and fraud-prevention technology to organizations that need to recognize people online. Its software combines behavioral biometrics with device, location and threat intelligence, then lets customers decide what should happen next. Admit the user, request another check, intervene with a warning or block the session. The aim is fewer interruptions for legitimate customers and fewer opportunities for impostors.
Callsign calls the resulting profile “Digital DNA.” The name sounds biological; the ingredients are digital interactions. There is no cheek swab. What matters is whether the evidence surrounding an action fits the person performing it. For a customer trying to pay a bill, success may look like absolutely nothing happening: no detour, no code to retrieve, no password reset before breakfast.
The bank robbery that became a business
In Callsign’s account of its origins, Zia Hayat’s interest in security began with the 1994 bank-hacking episode involving Vladimir Levin. Money could be stolen through a connection, without anyone entering a branch. Years later, Hayat and business partner Ian Welch founded Callsign in London in 2012. The company began with seven employees and a focus on protecting workers’ digital identities.
The first two years went into building and testing with Fortune 500 companies. Callsign’s history records deployments reaching hundreds of thousands of users by 2016. In 2017, it began rolling out a customer-facing version. That change widened the audience from employees accessing systems to people accessing their money and services. It also raised the stakes for convenience: customers have less reason to tolerate a cumbersome security routine than employees required to use one.
A $35 million Series A announced in July 2017 helped finance expansion. Accel and PTB Ventures led the round, with Allegis Capital and NightDragon Security participating. Former McAfee chief David DeWalt joined the board as vice chairman. The company’s subsequent history records expansion into the United States and Australia, followed by offices in the UAE and Singapore in 2021. The early product work had become an international enterprise sales effort.
Three jobs hiding inside one login
Callsign’s platform separates the job into intelligence, orchestration and authentication. The Intelligence Engine collects and evaluates signals. Behavioral models examine interaction patterns; device intelligence examines the equipment; location and telecoms information add context. Its ensembling approach combines evidence into a confidence score. A familiar device acting strangely and an unfamiliar device behaving like its usual owner need not receive the same treatment.
The Orchestration Layer turns those assessments into decisions. Analysts can build policies through a graphical interface, test alternative journeys and use approval workflows before changes go live. Callsign describes simulation, A/B testing and champion/challenger testing. That is a practical selling point for a bank whose fraud team wants to change a rule without making every adjustment a fresh software project.
The Authentication Suite supplies the checks themselves. Passive methods sit alongside active options, including hard tokens and one-time codes by SMS or email. Passwords and PINs can remain part of a layered system. Callsign One packages authentication and fraud capabilities around a single SDK integration and prebuilt journeys. The broader platform also supports REST APIs and deployment on premises or in the cloud.
This is business software bought by institutions and integrated into their services. A consumer generally encounters it inside a bank’s experience. The technical expertise spans behavioral modeling, fraud detection and the operational machinery that lets a security decision become an actual customer journey. A score alone does not stop a payment; the surrounding system has to act on it.
Saven’s password reset gets a rewrite
The clearest illustration comes from FirstOntario Credit Union. In September 2023, Callsign announced that FirstOntario was using its platform for Saven Financial, the credit union’s fully digital division. The work covered account opening, login and reactivation. Passwords and SMS one-time codes were removed from core journeys, with behavioral, device, location and threat signals used to identify returning members.
At onboarding, the system checks for device threats before cryptographically associating a user with that device. Later interactions draw on that relationship and the user’s historical pattern. When someone changes phones, the orchestration tools can adapt the re-registration journey. That is a more specific promise than “passwordless”: fewer awkward moments when a legitimate member’s circumstances change.
Michael Walsh, FirstOntario’s senior vice president of information technology, described the goal as removing “member frustration that comes with passwords” while reducing OTP and contact-center costs. Those are two expenses caused by the same bad morning: the bank pays to deliver a code or answer a call, while the member pays in time. The announcement describes the mechanism for savings without putting a dollar figure on the result.
Other named relationships show the range of deployment. In July 2019, Callsign announced a Lloyds Banking Group rollout across its core brands. In November 2022, UnionDigital Bank in the Philippines described using behavioral biometrics, device fingerprinting and bot detection, with policies that could change without code updates. These are banks buying infrastructure for their own customers, rather than asking customers to adopt a separate security brand.
“member frustration that comes with passwords”
MICHAEL WALSH / FIRSTONTARIO
On the problem Callsign helped address, 2023
A real customer can still be a scam victim
Recognizing the account holder does not settle every fraud question. Someone can be using their own phone, typing in their own rhythm and sending money because a convincing stranger told them to. Callsign’s Dynamic Interventions product addresses that uncomfortable distinction between identifying a person and understanding the risk around an action.
The company describes combining recognition and threat scores with context such as remote-access signals, unusual navigation or telephony information. Instead of repeating the same warning at the same point, organizations can change the question and its timing. Callsign’s argument is that predictable warnings become familiar to customers and rehearsable for scammers. A warning that everyone has learned to click past is doing very little work.
The practical lesson is to design interventions around a specific danger. A bank can make the next step depend on what it sees, then measure whether the intervention helps. That does not make a model an infallible reader of intent. It makes authentication part of an ongoing decision process, with opportunities to pause after the door has already opened.
The competition is for the decision
Callsign sits where behavioral biometrics, online fraud detection and customer authentication overlap. Datos Insights included it alongside BioCatch, LexisNexis Risk Solutions, Mastercard’s NuData and other vendors in its behavioral biometrics and device-fingerprinting market assessment. Buyers have alternatives for collecting those signals. Callsign’s pitch combines recognition of genuine users with threat detection and the tools to orchestrate a response.
That breadth changes the buying conversation. A bank can compare the cost and flexibility of an integrated platform with assembling several specialist products. The useful test is whether the combined system makes better decisions for that bank’s traffic, without creating extra work elsewhere. Callsign’s 2024 announcement of a Leader rating in Javelin’s Product Vitals category offers one external evaluation point; it should not be read as a universal win across every category or deployment.
Distribution matters, too. In October 2021, Callsign announced that Visa would introduce its behavioral biometric and device intelligence solutions to financial institutions, payment providers and merchants across Europe through Visa Fintech Partner Connect. The distinction is worth keeping straight: access to a partner network creates opportunities for sales. It does not turn every institution in the network into a customer.
The bill includes more than the software
Callsign’s commercial model is enterprise software and associated integration and support. Callsign One advertises a fixed-price proposition, with sales handled through demo and contact requests. For a buyer, the useful budget is the whole authentication operation: software, implementation, messaging, fraud losses, customer support and the business lost when good customers cannot get through. The $35 million Series A financed the vendor; it is not a measure of what a bank pays.
There is a process worth copying here. Start with one troublesome journey, such as device replacement or account reactivation. Record its completion rate, extra-check rate and support demand. Test a revised policy on a controlled slice of traffic, then compare outcomes before widening the rollout. Callsign provides experimentation tools for that approach. The proposed measurements are an implementation discipline, rather than a promise of a particular return.
The same discipline should cover people whose behavior changes and situations where signals are sparse. An unfamiliar interaction may belong to a legitimate customer. A familiar one can accompany a scam. Sensible deployment therefore includes another way to prove identity and a route to assistance. Callsign’s support for active authenticators gives operators options, but choosing tolerances and recovery journeys remains consequential work.
Privacy is part of that work. Callsign says its collection is event-based and its behavioral data is obfuscated. Those are design commitments, not a reason to stop asking how the system operates. Its careers pages emphasize accountability, collective learning and flexible working. For this particular business, those cultural aspirations have a concrete test: how carefully teams handle the evidence on which someone’s access depends.
Compare the whole journey. No single metric tells the story.
Beyond the password, beyond the login
Two 2026 announcements extend the story. In July, Callsign announced that it had joined the FIDO Alliance as a Sponsor member, bringing its behavioral and continuous-authentication perspective to standards work. Membership is participation in that process, rather than a product certification. The company’s argument is that proving possession of a credential should sit alongside continuing attention to the person using it.
An Ooredoo partnership release, posted in August and dated June 29, describes making Callsign’s Digital DNA technology available to organizations in Qatar through the telecom operator’s enterprise relationships. Banks, airlines, healthcare providers and government agencies are the intended audience. The announcement describes a pipeline and deployments planned for the coming months, placing it at a different stage from the documented Saven implementation.
For Callsign, the opportunity is to become part of how organizations decide whom to trust, across more than the login screen. For customers, the standard is plainer. Let me into my account when it is me. Interrupt me when there is a good reason. And when your software is unsure, give me a useful way forward. A bank that gets those three things right has done something people can feel, even when they never see the technology’s name.