The Visa BioCatch acquisition announced on Monday sees the payments giant paying 2.4 billion dollars in cash for a Tel Aviv-based fraud detection startup, in a move that reflects how seriously the industry is now treating AI-driven financial crime.

The company is being purchased from London-based private equity firm Permira along with other investors.

What Visa Is Actually Buying

At the centre of the deal is BioCatch’s behavioural biometrics platform, a technology that works quite differently from traditional fraud detection.

Rather than checking passwords, device fingerprints, or transaction patterns, the system analyses how a person physically interacts with their device. It examines keystroke timing, pressure applied to touchscreens, swipe patterns, and the way a phone is held and moved.

The premise is that these habits are effectively unique to each individual and extremely difficult to replicate. A legitimate account holder types their own password with a rhythm built through repetition. Someone entering stolen credentials for the first time does not.

Why This Matters Now

The timing of the acquisition is not coincidental. Generative AI has fundamentally changed the economics of fraud.

Attacks that once required skill, time, and language ability can now be produced quickly and cheaply. Convincing phishing messages can be generated in any language at scale. Voice cloning enables impersonation over the phone. Automated systems can probe thousands of accounts simultaneously.

Visa estimates that scams and account takeovers cost the global economy more than 1 trillion dollars each year.

Traditional defences struggle against this because they largely check credentials rather than behaviour. If an attacker holds the correct password and has intercepted the verification code, conventional systems see a valid login.

Behavioural analysis attacks the problem from a different angle. Stolen credentials do not come with the account holder’s typing rhythm attached.

Catching Fraud Before the Money Moves

Andrew Torre, Visa’s president of value-added services, framed the strategic rationale directly, saying BioCatch will help clients stop fraud before it reaches the point of payment.

That distinction carries real commercial weight. Once a payment has been executed, recovering funds becomes difficult, slow, and often impossible, particularly in cases involving mule accounts and rapid onward transfers.

Detection during the session, before authorisation, is considerably more valuable than detection afterwards.

Part of a Broader Business Shift

The acquisition also fits into Visa’s ongoing effort to diversify its revenue base.

The company’s value-added services division sells fraud prevention, cybersecurity, and analytics software to financial institutions, and it has become one of Visa’s fastest-growing business lines.

That direction makes sense. Transaction fees remain the core business, but they are subject to regulatory pressure and competitive squeeze in multiple markets. Selling security software to banks provides recurring revenue that is less exposed to those dynamics.

A Question of Scale

The most striking element of the deal is the mismatch between BioCatch’s current reach and Visa’s.

BioCatch currently protects around 760 million users across roughly 350 banks, which is substantial by any measure.

Visa’s network connects nearly 14,500 financial institutions and processes more than 329 billion transactions annually, representing over 17 trillion dollars in value.

The gap explains the strategic logic. A detection technology becomes more accurate as it observes more behaviour. Deploying BioCatch’s models across Visa’s infrastructure means exposure to fraud patterns at a scale no independent company could access, which should improve the system’s performance considerably.

BioCatch’s Own Assessment

In a blog post published alongside the announcement, BioCatch offered a notably candid view of the industry’s position.

The company stated plainly that as a society and an industry, the fight against fraud is not being won. It pointed to continued growth in the value of fraud and scam losses, the number of attempts, the volume of mule accounts, and the number of victims, noting that in some cases the increases are exponential.

That is an unusual admission for a security firm announcing an acquisition. It also happens to be accurate, and it explains why a company protecting 760 million users concluded that joining a larger platform was the better path.

Deal Timeline

The transaction is expected to close by the end of Visa’s fiscal second quarter in 2027, subject to regulatory approvals. Other financial terms were not disclosed.

Regulatory review is likely to be reasonably thorough given Visa’s scale and the sensitivity of the data involved. Behavioural biometrics generates detailed information about how individuals physically interact with devices, and privacy regulators in multiple jurisdictions may have questions about how that data is collected, stored, and used.

What It Signals

The deal is a bet on a particular view of where fraud prevention is heading.

If attackers can increasingly obtain credentials, replicate documents, and simulate legitimate communication, then verifying what someone knows or possesses becomes progressively less reliable. What remains harder to fake is how a specific person behaves.

Whether behavioural biometrics holds that advantage indefinitely is an open question. Fraud prevention has always been an arms race, and each defensive advance eventually prompts an offensive response.

For now, Visa has concluded that behavioural analysis is worth 2.4 billion dollars, and that fighting AI-enabled fraud requires tools built around something other than passwords.