Visa has agreed to acquire BioCatch, an Israeli pioneer of behavioral biometrics for fraud prevention, for $2.4 billion in cash, the network announced on August 3, 2026. It is buying the company from funds advised by Permira and other shareholders, and expects to close by the end of its fiscal second quarter of 2027, subject to regulatory approvals. The price tag signals a shift in doctrine: Visa no longer wants only to rule on a transaction as it passes through the network. It wants to spot the fraudster earlier, from the way they interact with their device.
BioCatch brings 1.8 billion devices and 350 bank clients
BioCatch runs a family of AI and machine learning products that analyze “thousands of application, behavioral, device, and network signals” to tell a legitimate user from a fraudster in real time. The company protects 1.8 billion devices and 760 million users, and serves more than 350 banks in 21 countries, including more than 100 of the world’s largest. It closed 2025 with the best quarter in its history and annual recurring revenue (ARR) above $185 million.
Behavioral biometrics watches how a user acts, not who they are
Physiological biometrics, such as a fingerprint or a face scan, verify who the user is at a given moment. Behavioral biometrics observe how the user behaves throughout a session: typing rhythm, the way they hold the phone, mouse movements, the tilt of the screen, hesitations, an IBAN pasted from the clipboard. These patterns are hard to imitate, even for a fraudster who holds the legitimate customer’s credentials. The system asks nothing of the user. It runs in the background and raises an alert when behavior departs from the usual profile.
Scams now get past transaction checks
The trigger is a change in the nature of fraud. Fake-IBAN fraud, which Verification of Payee has pushed back in the euro area, is giving way to authorized fraud, in which a victim manipulated through social engineering makes the payment themselves. These scams, from bank impersonation and fake delivery notices to romance scams, now amplified by generative AI and voice deepfakes, clear every conventional check because the legitimate account holder presses the button. That leaves behavior as the last usable signal.
“Account takeovers and scams cost the global economy over $1 trillion annually and AI is enabling these attacks at unprecedented scale,” said Andrew Torre, Visa’s president of value-added services. “BioCatch will help our clients stop fraud before it reaches the point of payment.” Behavioral signals target four threats in particular:
- Account takeover. A third party logs in with stolen credentials but does not “type” like the account holder.
- Authorized push payment (APP) fraud. The victim approves the transfer under manipulation. Unusual hesitations and rhythm give away the coercion.
- Money mules. Accounts opened to launder funds show atypical behavioral patterns from enrollment onward.
- Bots and automated sessions. Gestures without human micro-variations reveal automation.
Permira nearly doubles its money in two years
The deal is also a strong exit for Permira. The firm took control of BioCatch two years earlier at a valuation of about $1.3 billion, investing some $750 million for 60% of the company. At $2.4 billion, BioCatch is now worth nearly twice that. The multiple shows how much the networks want anti-fraud capabilities as scams become industrialized.
BioCatch covers the session, Featurespace the transaction
BioCatch will not be starting from scratch. Visa has already absorbed Featurespace, which specializes in adaptive behavioral analytics on transactions, and rolled out its Visa Protect suite. Behavioral biometrics add a session layer to that toolkit, while Featurespace works at the transaction level. Mastercard is following the same logic of moving up the risk value chain, with its own acquisitions in data and identity. For both networks, fraud has gone from a cost to absorb to a service to sell to issuers.
When the victim becomes the manipulated link in a payment, defense can no longer stop at the authorization message. By putting $2.4 billion on the way a person holds a phone, Visa is acknowledging that the next fight against fraud will be won or lost well before the money leaves the account.