The payments giant is buying an Israeli behavioral biometrics pioneer to catch the scams and account takeovers that transaction monitoring never sees. It is also the latest escalation in a spending race with Mastercard to own the security layer of global banking.

[For more news, click here]

The fraud that costs banks the most is often the fraud that looks, on paper, entirely legitimate. It’s a process we use everyday that has no reason for suspicion. A victim signs in with the correct password, from a familiar phone, and authorizes the transfer themselves. With no stolen card or breached credential, there is no obvious anomaly for a transaction monitor to catch. By the time the money is gone, the only unusual thing about the payment was the human being manipulated into sending it.

Visa is spending $2.4 billion to close this blind spot. On August 3, the company announced a definitive agreement to acquire BioCatch, a Tel Aviv firm that reads the way people behave inside a banking session, from funds advised by Permira and other shareholders. The all-cash deal is expected to close by the end of Visa's fiscal second quarter of 2027, pending regulatory approval.

What BioCatch Does

Most fraud tools ask the question “does this transaction look risky?” BioCatch asks a broader one, “does the person on the other side of the screen behave like the account's real owner, and do they seem to be acting freely?” Its software collects more than 3,000 anonymized signals as a customer moves through a digital banking session, including keystroke cadence, the pressure and angle of a swipe, how a device is held, and telltale patterns such as jailbroken phones or the presence of an automated agent. From those inputs, its machine-learning models score both a user's identity and any sign that the user is being coerced or coached, roughly 19 billion sessions a month across more than 760 million people and 1.8 billion devices. The company serves over 350 banks in 21 countries, including more than 100 of the largest financial institutions in the world.

The strategic logic is captured in a phrase from Andrew Torre, Visa's president of value-added services. “Account takeovers and scams cost the global economy over $1 trillion annually and AI is enabling these attacks at unprecedented scale,” he said. “BioCatch will help our clients stop fraud before it reaches the point of payment. This acquisition is part of our strategy to help clients prevent cyber threats upstream, building trust into every transaction.”

The Scams a Transaction Alert Cannot See

The shape fraud takes has changed overtime, more so in the times of AI. Card-present theft and cloned credentials are shrinking problems relative to a faster-growing category in which victims are talked into moving their own money. Regulators call it authorized push payment fraud, and it covers everything from romance scams to fake investment platforms to impersonators posing as banks, tech support, or government agents.

In 2025 alone, Americans reported losing a record $15.9 billion to scams, according to the Federal Trade Commission, up from $12.5 billion the year before. Investment scams, many of them “pig butchering” schemes that groom victims over weeks before steering them into fraudulent crypto platforms, accounted for $7.9 billion while impostor scams drew more than a million complaints. The FBI has separately tied hundreds of millions in losses to AI-enabled tactics such as voice cloning. Deloitte estimates that U.S. authorized push payment fraud could climb toward $15 billion by 2028.

These are the cases where a transaction sits quietly inside a customer's normal limits and normal device history. Behavioral intelligence is one of the few defenses positioned to notice when a legitimate login is being driven by someone, or something, that should not be there.

Gadi Mazor, BioCatch's chief executive, framed the company's pitch around that gap. “Real-time insights into customer intent continue to grow increasingly essential for institutions to establish trust within digital banking sessions,” he said. “For more than a decade, we've demonstrated behavior's unique ability to distinguish the criminal from the legitimate. In the last couple of years, we've shown how real-time intelligence-sharing networks between our customers can amplify the power of our behavioral intelligence further still. Together with Visa, we're even better positioned to advance our mission of making the world a safer place to transact and protect consumers from financial crime.”

A Billion Dollar Arms Race with Mastercard

BioCatch does not slot into Visa's core business of moving money between banks, rather, it slots into value-added services, the division Torre runs, which has grown into roughly a $9 billion operation expanding at about 20 percent a year. That distinction matters. As interchange revenue faces pricing and regulatory pressure, both major card networks are racing to sell software, analytics, and security to the same banks whose transactions they already process.

In December 2024, Mastercard closed its $2.65 billion purchase of Recorded Future, a threat-intelligence company, and by late 2025 had folded it into a product aimed at catching cyber-enabled fraud before it becomes payment fraud. Visa answered on the transaction side a year earlier by acquiring Featurespace, which added real-time AI scoring at the moment of payment. BioCatch extends that stack backward into the session itself. Layered together, a fraud attempt can now be judged twice: once by how the user behaved on the way to the payment, and again by the transaction. Visa says it has invested more than $13 billion in technology and infrastructure over the past five years, and points to open-source tools such as its Visa Vulnerability Agentic Harness as evidence that it intends to compete on security rather than treat it as overhead.

What Comes Next

The deal with BioTech still requires regulatory sign-off in an environment where scrutiny of large payments acquisitions runs high. Integration is its own risk as BioCatch's value rests partly on a cross-institution network in which banks share fraud signals, and some of those banks compete with the businesses Visa is building. Persuading them that a Visa-owned BioCatch remains a neutral utility, rather than a lever for the network's own ambitions, will be a commercial and trust exercise as much as a technical one.

There is also the harder question of privacy. A system that quietly profiles how millions of people type and hold their phones is powerful precisely because it is invisible, and that invisibility invites the scrutiny that biometric data attracts. BioCatch stresses that its signals are anonymized and used to detect coercion and impersonation rather than to identify individuals, a distinction that will matter more as the technology scales across Visa's client base.

What the acquisition makes plain is where the industry now believes the fight is won or lost. For years, fraud prevention meant guarding the transaction. Increasingly, it means understanding the human on the other end of the session, and noticing when that human is not really in control. Visa has decided that understanding is worth $2.4 billion.

Related Articles

Saviynt Posts US$300 Million ARR as AI Identity Security Emerges as a Fast-Growing Market

Cybercrime Now Runs on Subscriptions and Supply Chains, According to a New Global Threat Ranking

KnowBe4 and AWS Sign Multiyear Deal to Secure the Workforce of Humans and AI Agents