Visa’s $2.4B Bet on Behavior: Why Keystrokes Now Matter More Than Passwords

A Fraud-Detection Company Built on How You Type, Not What You Buy

Visa announced on August 3, 2026 that it would acquire BioCatch for $2.4 billion in cash, with the deal expected to close by the end of Visa’s fiscal second quarter of 2027, subject to regulatory approval. Unlike most fraud-prevention tools that flag suspicious transactions after the fact, BioCatch’s technology analyzes the behavior around a transaction — how a user types, swipes, holds their phone, and moves a mouse — to determine in real time whether the person behind the screen is who they claim to be.

BioCatch’s platform analyzes thousands of real-time signals during digital banking sessions, including keystroke patterns, touch gestures, device handling, and behavioral signs of coercion, feeding them into AI models that distinguish legitimate users from fraudsters within milliseconds. Visa’s own investor announcement puts a precise figure on that signal collection: more than 3,000 data points per session. The scale of that operation is already substantial: the company protects 1.8 billion devices and serves 760 million users, working with more than 350 banking clients across 21 countries — including over 100 of the world’s largest banks — and processing roughly 19 billion user sessions every month. BiometricUpdate reports BioCatch counts three of the top four U.S. banks by assets among its clients, and Fortune reports the 15-year-old company generated $185 million in annual recurring revenue in 2025.

The valuation jump is the clearest signal of how fast the market for this category has moved. Permira-advised funds acquired a controlling stake in BioCatch for $1.3 billion in 2024; Visa’s $2.4 billion cash offer less than two years later represents a step-up of roughly 85% in headline valuation, even before accounting for the revenue growth BioCatch has posted in the interim.

Why Visa Is Buying Behavior Instead of Building It

Andrew Torre, Visa’s president of value-added services, framed the deal around the scale of the threat: “Account takeovers and scams cost the global economy over $1 trillion annually and AI is enabling these attacks at unprecedented scale.” That framing matters because it locates the acquisition inside a specific problem — generative AI has made it dramatically cheaper for fraudsters to clone voices, fabricate documents, and script convincing social-engineering scripts, but AI has been far slower to fake the physical rhythm of how a real, un-coerced human interacts with a touchscreen or keyboard under normal conditions. BiometricUpdate reports BioCatch has progressively integrated signals from the application, network, and device levels to widen that behavioral fingerprint beyond keystrokes alone.

BioCatch CEO Gadi Mazor tied the deal to a broader shift in how banks think about identity verification: real-time insight into customer intent, he said, is becoming essential for banks — not just verifying that a login credential is correct, but confirming that the person entering it is acting under their own free will and not being coached or coerced through a live scam call. BioCatch will retain its leadership team and operate inside Visa’s Value-Added Services group after the deal closes, rather than being absorbed and rebranded — a structure that suggests Visa wants to preserve the specialized product and client relationships rather than fold the technology into an existing fraud tool.

Visa CEO Ryan McInerney put the acquisition in the context of an escalating defensive spend: in comments reported by Fortune, McInerney said “we are all in an arms race to protect this ecosystem,” noting that Visa has invested $13 billion over five years in fraud protection and cybersecurity initiatives. That spending, McInerney argued, is backed by what Visa describes as arguably the largest global payments data set that exists — a claim the BioCatch deal directly extends by adding 19 billion monthly behavioral sessions on top of Visa’s existing transaction-level fraud signals.

For Visa, the acquisition extends a card network’s core business — moving money securely — into the pre-transaction moment, where a scam victim is often still on the phone with a fraudster when they authorize a transfer that looks, on paper, like a normal payment. A transaction-monitoring system alone cannot catch that; a system trained on behavioral deviation, in principle, can.

What This Means for Banks and Fraud Teams

1. Expect behavioral biometrics to become a baseline expectation, not a differentiator

With Visa folding this capability directly into its Value-Added Services stack, banks that already route card transactions through Visa’s rails may soon see behavioral-risk scoring bundled into existing relationships rather than sold as a separate specialist contract — raising the floor for what “standard” fraud tooling looks like across the industry.

2. Reassess authorized-push-payment fraud controls specifically

BioCatch’s coercion-detection signals target exactly the scam pattern regulators have struggled to address: a legitimate account holder, manipulated in real time, authorizing a transaction themselves. Fraud teams should map which of their current controls actually detect behavioral coercion versus simply verifying credential correctness — the two are not the same defense.

3. Watch for consolidation among independent behavioral-biometrics vendors

A $2.4 billion strategic acquisition by a payment network signals to the remaining independent players in this space — and to their venture backers — that the exit path now runs through the card networks and core banking infrastructure providers rather than an IPO, which will likely accelerate further M&A in adjacent fraud-detection categories over the next 12-18 months.

The Bigger Picture on AI-Versus-AI Fraud Defense

Visa’s willingness to pay nearly double BioCatch’s two-year-old valuation reflects a broader repricing happening across the fraud-prevention industry: as generative AI lowers the cost of producing convincing scams, the defensive tools capable of detecting the human behavioral signal underneath an AI-assisted attack become correspondingly more valuable, not less. The deal also reinforces a pattern visible across payments infrastructure in 2026 — incumbents are increasingly choosing to acquire specialized AI-native risk and security capabilities outright rather than build comparable detection systems in-house, since the training data and model tuning required to reliably distinguish human behavioral signatures from synthetic ones takes years to accumulate at BioCatch’s scale of 19 billion monthly sessions. For an industry racing to stay ahead of AI-enabled fraud, that data moat may end up being worth more than the $2.4 billion price tag suggests.

Frequently Asked Questions

Sources & Further Reading

• Visa Acquires BioCatch for $2.4 Billion to Fight AI-Powered Fraud — Disruption Banking
• Visa Acquires Behavioral Biometrics Pioneer BioCatch Amid Fraud Prevention Build-Up — Biometric Update
• Visa to Acquire BioCatch — Visa Investor Relations
• Why Visa Is Willing to Spend $2.4 Billion on BioCatch — Fortune