Visa announced its intent to acquire behavioral biometrics vendor BioCatch for $2.4 billion. BioCatch uses JavaScript on websites and its own SDKs built into mobile applications to continuously analyze signals including typing cadence, touchscreen gestures, mouse movements, hesitation, and device handling to detect identity theft at registration, account takeover, mule accounts, and scams before a payment occurs.

  • BioCatch complements Visa’s existing fraud management offerings. BioCatch provides risk signals and behavioral biometrics for online/cyber fraud management. Prior to the acquisition, Visa had nascent, incomplete capabilities in this space. Payment networks are moving further into cybersecurity and fraud software. Pure payment transaction monitoring (for example, Visa’s 2024 Featurespace acquisition), even when it is based on very large volumes of data, does not address pre-payment risks such as identity theft, account takeovers, effective scams, and first-party fraud detection, all of which behavioral biometrics solutions can help prevent.
  • The acquisition price signals Visa’s rush to market. Visa could have built behavioral biometrics technology on its own, but given market demand and time-to-market pressures, an acquisition was a more efficient option. Given the fact that a close competitor, LexisNexis, had already picked up BehavioSec (a direct BioCatch competitor) in 2022 and that there are very few pure-play behavioral biometrics vendors remaining in the market, Visa wanted to establish a presence in the digital cyber fraud management space.
  • Behavioral biometrics provides an important layer in fraud detection. Behavioral biometrics complements passwords, device intelligence, and physical biometrics. There have been ways to evade behavioral biometrics, including AI-driven robotic behaviors, bots, and robotic process automation that have been able to bypass behavioral biometrics. It is also true that behavioral biometrics can produce false positives when users have temporary or permanent changes to fine motor skills (holding a baby, dealing with an injury, in a cast, etc.) that modify hitherto normal mouse movements, screen swipes, and keyboard typing patterns. Even with the above shortcomings, however, behavioral biometrics provides a strong layer for cyber defenses in depth.

The main challenges with deploying behavioral biometrics are the potential impacts on customer experience and usability of behavioral data, including:

  • Unnecessarily insulting (i.e., stopping transactions of) honest customers with false positives, which may create attrition.
  • Using behavioral biometrics in jurisdictions where behavioral biometrics information is considered personally identifiable information.
  • The cost and complexity of integrating behavioral biometrics with customer identity and access management (CIAM) and other authentication and deepfake detection platforms.

Visa’s Acquisition Materially Changes The Behavioral Biometrics Market

This acquisition signals an effective end to the standalone behavioral biometrics market. Behavioral biometrics has slowly been subsuming into the financial crime management, CIAM, and commerce fraud management markets in the past five years. Visa will likely integrate BioCatch’s behavioral biometrics into its Visa Protect for Merchants and Visa Risk Manager solutions.

Forrester clients interested in learning more about behavioral biometrics or this acquisition can schedule a guidance session with me.

Share