Visa has agreed to acquire behavioural fraud specialist BioCatch for $2.4 billion in cash, extending the payment network’s security business into the moments before a fraudulent transfer or card transaction is completed.

BioCatch analyses application, behavioural, device, and network signals to distinguish legitimate users from criminals in real time. Those signals can include keystrokes, touch gestures, patterns of device handling, and evidence that a customer is being manipulated or coerced during a digital banking session.

The company serves more than 350 banks across 21 countries and says its systems protect 760 million users and 1.8 billion devices. Permira, which became BioCatch’s majority owner in 2024, said the platform was analysing more than 19 billion digital sessions each month by July 2026.

The transaction remains subject to regulatory approval and is expected to close by the end of Visa’s second fiscal quarter of 2027. Andrew Torre, president of value-added services at Visa, said: “BioCatch will help our clients stop fraud before it reaches the point of payment.”

Security moves before the transaction

Payment security has traditionally concentrated on the transaction itself, including whether credentials match, whether a card is present, where a payment originates, and whether its amount differs from normal activity. However, many current scams exploit a genuine customer who has authenticated successfully but is being deceived into moving money.

Behavioural systems attempt to identify that distinction by examining how a session unfolds rather than relying solely on a password, device, or transaction rule. Hesitation, unusual navigation, remote-access software, changes in typing patterns, and relationships between receiving accounts can add context that static identity checks do not provide.

That approach has become more valuable as criminals use social engineering to work around strong authentication. A bank may know that the correct customer is using a recognised phone, yet still need to decide whether the person is acting freely, following instructions from a fraudster, or transferring funds into a mule network.

Visa said BioCatch would complement its cyber, fraud, risk, and security products across account opening, account takeover, scams, mule accounts, and application fraud. The company has invested more than $13 billion in technology and infrastructure over the past five years to protect the payment ecosystem, indicating that security services are becoming a larger part of its commercial relationship with banks and merchants.

BioCatch’s growth under Permira also helps explain the valuation. Its revenue nearly tripled and gross profit increased more than threefold during the investment firm’s ownership, while the business expanded products covering device intelligence, interbank information sharing, and behaviour-based detection of mule accounts.

A larger role for payment networks

The purchase brings a wider section of fraud prevention under the control of a company already embedded throughout global payments. Banks could gain simpler procurement and integration if BioCatch’s signals become closely connected with Visa’s existing risk services, although they may also become more dependent on one of the dominant network providers.

Integration will involve more than combining two software catalogues, since behavioural intelligence depends on data gathered continuously throughout a digital session. Financial institutions will need clarity over where signals are processed, which organisations can use them, how long they are retained, and how decisions can be explained when a legitimate customer is delayed or blocked.

False positives remain an operational concern because fraud systems sit inside customer journeys where interruption carries a direct cost. A model that stops more scams but creates excessive friction can shift work into call centres, delay urgent transfers, or push customers towards other providers, while a model tuned too loosely may fail to detect manipulation until money has left the account.

The acquisition also reflects how artificial intelligence is operating on both sides of financial crime. Criminals can use AI to produce convincing communications, automate targeting, and vary their tactics, while banks and payment networks respond with systems that combine larger quantities of behavioural and technical information.

Consequently, the competitive value of fraud technology is moving from isolated rules towards intelligence drawn across institutions, devices, accounts, and payment flows. BioCatch has already developed a network through which participating banks can share risk information without exchanging directly identifying customer data, and Visa could expand the reach of that model substantially.

That scale may improve detection where fraud moves between institutions, although it also places greater weight on common models, shared assumptions, and the governance of the signals used to classify behaviour. An error made across a large network can affect more customers than a mistake inside a single bank.

Regulators examining the deal will therefore be assessing more than its purchase price. The transaction joins a significant behavioural dataset, a specialist fraud platform, and a payment network operating across more than 200 countries and territories, while the promised benefits depend on whether those assets can be combined without weakening privacy, competition, or accountability.

Visa’s immediate claim is that it can stop more fraud before a payment begins. The longer-term test will be whether banks gain stronger and more transparent defences, rather than exchanging a fragmented security market for deeper dependence on a single infrastructure provider.