Visa BioCatch Acquisition Pulls Fraud War Into Bank Apps

Visa was expected to keep fighting fraud at the payment edge. The Visa BioCatch acquisition shows a deeper ambition: fraud decisioning inside the bank app, before a card transaction or transfer reaches the network.

Visa agreed to pay $2.4 billion in cash for BioCatch, a behavioral fraud detection firm owned by funds advised by Permira and other shareholders, according to American Banker. The deal needs regulatory approval, and Visa expects it to close by the end of March 2027.

That matters because BioCatch is already embedded where banks make high-stakes fraud calls. Three of the four largest U.S. banks by assets use BioCatch software, including Wells Fargo, according to BioCatch’s January release cited by American Banker.

“BioCatch will help our clients stop fraud before it reaches the point of payment,” said Andrew Torre, president of value-added services at Visa.

That sentence is the deal in miniature. Visa isn’t just buying a fraud vendor. It’s buying a position closer to the customer session.

Visa BioCatch acquisition shifts fraud control from checkout to login

BioCatch does not primarily watch card transactions. It watches how bank customers behave inside digital banking.

The company says its software reads more than 3,000 signals during a session, including keystrokes, touch gestures, and the orientation of the phone as a customer holds it. It looks for account takeovers, scams, money mules, and fake account applications.

That creates a different fraud perimeter.

• Before: Fraud detection often concentrated near payment authorization, transfer review, or post-event investigation.
• After: The bank can score risk during login, navigation, profile changes, and transfer setup.
• Tradeoff: Security becomes less visible, but monitoring becomes more constant.

XOOMAR analysis: For bank customers, the most realistic near-term change is not a dramatic new feature. It’s more invisible scoring inside mobile and online banking. If the model flags a session as abnormal, the bank may challenge, hold, or review activity. If it reads the session as normal, the customer may never know BioCatch was involved.

That’s the tension. Banks want faster fraud prevention. Customers may get quieter security. But the data involved is intimate in a new way, because it comes from how people physically interact with their devices.

The numbers show why Visa is buying deeper into bank infrastructure

BioCatch says it protects 760 million users, serves more than 350 banking clients, and analyzes 19 billion sessions a month, according to Visa’s announcement. Permira repeated the same counts and dated them to July. American Banker notes that these figures come from the companies themselves and have not been independently verified.

The acquisition also plugs into a fast-growing Visa business. Visa’s value-added services generated $3.8 billion in the quarter ended June 30, up 33% from a year earlier. Total net revenue was $11.6 billion, according to Visa’s SEC filing cited by American Banker. The filing also lists $5.6 billion in contracted revenue not yet booked, primarily from those services, with about half expected within two years.

BioCatch ended 2025 with more than $185 million in annual recurring revenue, according to its January release. KeyBanc Capital Markets analysts Andrew Schmidt and Anthony DeLise estimated that, assuming 25% to 30% annual growth, BioCatch could reach $260 million to $280 million in 2027 revenue. They called the roughly nine-times-revenue price reasonable.

Visa is also stacking fraud assets. It completed the acquisition of Featurespace in December 2024 and folded it into what is now called Risk and Security Solutions. Featurespace scores payment transactions for fraud. BioCatch works earlier in the journey.

That sequence supports the thesis we laid out in Card Networks Stretch Beyond Payments to Box In Rivals: card networks are not content to sit only at the transaction rail. They want more of the operational software around money movement.

BioCatch reads behavior, but banks still make the call

Behavioral fraud detection works because criminals often inherit credentials, not habits.

A fraudster may have the right password. They may have access to a device or enough personal information to pass basic checks. But they may type differently, move through an app differently, hesitate at different points, or hold a phone in a way that diverges from the real customer’s history.

That does not make BioCatch magic. It produces risk signals.

Those signals can support decisions around:

• Account takeover: Spotting abnormal behavior after login.
• Scams: Detecting suspicious transfer behavior before money moves.
• Money mules: Identifying accounts used to route stolen funds.
• Fake applications: Flagging suspicious behavior during account opening.
• Transfer requests: Reviewing risky movement before execution.

XOOMAR analysis: The customer experience depends less on BioCatch alone than on bank policy. A strong model with blunt rules can still create bad outcomes. A weaker model with cautious thresholds may miss fraud. The acquisition gives Visa a larger role in the signal layer, but banks remain responsible for how those signals affect customers.

This is where the privacy fight gets sharper. Banks can disclose that they use behavioral analytics. But American Banker’s source material does not say how individual BioCatch bank clients explain collection, retention, or sharing of gesture and device interaction data to customers.

That question echoes broader fights over bank-grade privacy and transaction data controls, including our coverage of Privacy Fight Thrusts EthSystems Into Ethereum’s Bank Race.

BioCatch Trust is the bigger U.S. question Visa hasn’t answered

BioCatch already offers behavior monitoring in the U.S. Its interbank intelligence network, BioCatch Trust, does not yet operate in the U.S., Mac King, BioCatch’s director of global marketing communications, told American Banker.

That network runs in Australia, where it launched in November 2024 and now covers more than 85% of the country’s banked population, and in Argentina, where it launched in May 2025. Member banks pool behavioral and device signals. If the network decides a receiving account looks untrustworthy, it warns the sending bank in real time.

BioCatch CEO Gadi Mazor framed it this way:

“In those markets where we’ve launched BioCatch Trust,” real-time interbank intelligence sharing “even further amplifies the efficacy of our behavioral intelligence.”

The U.S. legal path is still thin. In June, Fincen updated its fact sheet on Section 314(b) of the USA PATRIOT Act, saying information-sharing protections cover suspected fraud, do not require a bank to first identify laundered proceeds, and can include real-time sharing. The update specifically lists device identification numbers and IP addresses as sharable.

But a fact sheet is not a statute. Daniel Stipano, a partner at Davis Polk & Wardwell and former OCC official, told American Banker in June:

“The safe harbor has never been tested judicially, so it is not clear whether a court would agree with Fincen’s interpretation.”

Visa did not immediately respond to American Banker on whether it plans to bring BioCatch Trust to the U.S.

Banks may like the bundle until it weakens their hand

The most sensitive commercial issue is not whether BioCatch works. It is who controls it after the deal closes.

Once Visa owns BioCatch, major banks using the software will buy fraud detection from a company they also negotiate with on card terms. That creates convenience and dependence in the same package.

Eric Grover, principal at Intrepid Ventures, told American Banker that bundling can be efficient and simplify vendor management, “albeit at the cost of reducing banks’ negotiating leverage.”

He also said the deal takes Visa “beyond the edge of the network into the heart of its bank issuers,” comparing it with Visa’s $1 billion purchase of Pismo, which closed in January 2024.

Regulators are already looking at Visa’s bundling practices in another part of the business. The U.S. Department of Justice has a pending monopolization lawsuit over debit cards, alleging Visa introduced a mandatory fee in October 2023 that bundled previously optional value-added services fees. Visa denies the allegations. Judge John G. Koeltl refused to dismiss the case in June 2025, and the parties are in discovery, with the next status report due Aug. 21.

That lawsuit concerns merchant-side fees through acquiring banks, not bank fraud tools. Still, it explains why the BioCatch deal will be read through a broader dependency lens.

Your bank app may get quieter security, and less obvious surveillance

The practical question for customers is simple: what changes inside the bank app?

Expect more risk checks around logins, transfer requests, account changes, and other high-risk sessions if a bank already uses BioCatch or adopts it under Visa. The checks may not appear as a pop-up or a new authentication screen. They may sit behind the session.

The upside, if banks tune the system well, is earlier detection of account takeover and scam behavior. The risk is that customers may not understand what behavioral data is collected, how long it is kept, or how automated fraud restrictions can be appealed.

Useful questions for your bank:

• Collection: What behavioral signals are captured during mobile and online banking?
• Sharing: Is that data shared with Visa, BioCatch, or other partners?
• Retention: How long are behavioral and device signals stored?
• Appeals: How can customers challenge fraud-related holds, blocks, or account restrictions?

The next evidence to watch is not just whether regulators approve the Visa BioCatch acquisition. Watch whether Visa tries to extend BioCatch Trust into the U.S., whether banks accept deeper bundling, and whether disclosures to customers become clearer. If those pieces move together, the next phase of bank security will be smoother when it works, but far less visible by design.

Disclaimer: This XOOMAR analysis is for informational and educational purposes only. It is not financial, investment, legal, tax, or professional advice. It does not provide buy, sell, hold, price-target, portfolio, or personalized recommendations. Verify information independently and consult qualified professionals before making decisions.

Impact Analysis

• Visa’s $2.4 billion deal pushes fraud prevention deeper into bank apps, not just payment networks.
• BioCatch is already used by three of the four largest U.S. banks, giving Visa a major foothold in bank-side fraud decisioning.
• Customers could see earlier scam detection, but also more continuous behavioral monitoring during digital banking sessions.