Visa is buying cybersecurity startup BioCatch for $2.4 billion in cash, betting that behavioral intelligence can help banks stop fraud earlier as artificial intelligence makes scams cheaper, faster and harder to detect.
The payments giant announced the deal Monday, saying it will acquire BioCatch from private equity firm Permira and other investors. The acquisition pushes Visa deeper into cybersecurity at a time when account takeovers, identity theft and AI-assisted scams are putting banks, payment networks and their customers under growing pressure.
The size of the problem helps explain the price tag. Visa says account takeovers and scams cost the global economy more than $1 trillion each year. AI is giving fraudsters new tools to automate attacks, impersonate people and target victims at a scale that would have required far more time and labor just a few years ago.
“Account takeovers and scams cost the global economy over $1 trillion annually, and AI is enabling these attacks at unprecedented scale,” said Andrew Torre, president of value-added services, Visa. “BioCatch will help our clients stop fraud before it reaches the point of payment. This acquisition is part of our strategy to help clients prevent cyber threats upstream, building trust into every transaction.”
That “upstream” strategy gets to the heart of the $2.4 billion deal. Visa already sits at one of the most valuable points in the payment chain, where it can analyze transactions for signs of fraud. BioCatch moves detection earlier, looking at how someone interacts with a device before money starts moving.
BioCatch founder and CEO Gadi Mazor said the company will continue operating after the acquisition, with its leadership team and reporting structure remaining intact as BioCatch joins Visa’s Value-Added Services organization.
Commenting on the deal in a blog post, Mazor said:
“Earlier today, Visa announced its plans to purchase BioCatch. BioCatch isn’t going anywhere. Post-acquisition, we will continue to operate as we have, but now as part of Visa. I also am not going anywhere. With Visa, we will keep our entire leadership team and reporting structure intact, and we are excited to join its Value-Added Services organization.”
BioCatch Looks at Behavior, Not Just Transactions
Founded in 2011, BioCatch has built its business around behavioral biometrics, technology that looks for subtle signals in the way people use phones, computers and banking applications.
The company’s technology uses AI and machine learning to analyze thousands of application, behavioral, device and network signals in real time. Those signals can include keystrokes, touch gestures and the way someone handles a device, giving banks another way to distinguish legitimate customers from fraudsters.
Instead of relying solely on passwords, device IDs or transaction histories, BioCatch looks at how a person behaves during a banking session. That approach can help identify suspicious activity even when someone has the correct login credentials.
A fraudster may have the right username and password. They may have access to a victim’s device or enough personal information to pass basic security checks. Replicating the legitimate user’s behavioral patterns presents another hurdle.
BioCatch has turned that technology into a sizable global business. The company protects 1.8 billion devices and 760 million users worldwide, serving more than 350 banking clients across 21 countries. More than 100 of those customers rank among the world’s largest banks, according to Visa.
That reach makes BioCatch far more than an experimental cybersecurity startup. More than a decade after its founding, the company has grown into a major fraud intelligence provider embedded across some of the world’s largest financial institutions.
Visa Wants to Stop Fraud Before the Payment Happens
For Visa, BioCatch adds another layer to a security operation that already spans payments, fraud detection and risk management.
The acquisition reflects a push to catch attacks earlier. Detecting a fraudulent payment once it reaches the transaction stage is valuable, but identifying suspicious behavior before the transaction is initiated gives banks another chance to stop the money from leaving an account.
Visa calls that moving cybersecurity “upstream.”
That strategy becomes more significant as AI changes the economics of fraud.
Generative AI can help criminals create convincing phishing messages, fake identities and impersonation attempts at low cost. Voice cloning and synthetic media can make social engineering attacks more believable. Automated systems can let attackers target far more potential victims than would have been practical through manual operations.
The result is a difficult problem for banks and payment networks: a transaction can originate from a real customer, using valid credentials on a recognized device, yet still be the product of fraud if that customer has been manipulated into sending money.
BioCatch gives Visa another way to look for warning signs before the transaction reaches the payment network.
The $2.4 Billion Deal Extends Visa’s Cybersecurity Buying Spree
BioCatch is not Visa’s first major security acquisition.
Visa acquired Featurespace, a Cambridge, U.K.-based company that uses AI to detect fraud and financial crime, in 2024. The company has invested more than $13 billion in technology and infrastructure over the past five years as it tries to stay ahead of fraud across its global payments network.
Visa’s latest purchase comes as its biggest rival is making similar moves.
Mastercard completed its $2.65 billion acquisition of threat intelligence company Recorded Future in 2024, bringing one of the cybersecurity industry’s better-known intelligence platforms inside the payments company, Reuters reported.
Taken together, the deals show how the card giants are pushing beyond the traditional business of moving payments between merchants, banks and consumers. Fraud intelligence, identity, cybersecurity and risk services are becoming a bigger part of what they sell to financial institutions.
BioCatch gives Visa another foothold in that market.
AI Is Changing the Economics of Fraud
The timing of the acquisition may be just as significant as its size.
Financial fraud has always been a scale business. Attackers make money by finding methods that can be repeated across enough victims to justify the effort.
AI changes that calculation.
Tasks that once required people to write phishing emails, research targets or impersonate individuals can increasingly be automated. Attackers can produce personalized messages in seconds, translate scams into multiple languages and create synthetic content that makes impersonation more convincing.
Defenders are turning to AI and behavioral data in response, setting up a technological race between systems trying to identify suspicious activity and criminals trying to appear legitimate.
That is where BioCatch fits into Visa’s strategy.
Rather than asking only whether someone possesses the correct credentials, behavioral biometrics asks another question: Does this person behave like the account owner?
For a company processing payments across a global network, adding that information to existing fraud signals could make suspicious activity easier to spot earlier.
Visa’s Security Business Is Moving Closer to the User
There is another reason the BioCatch acquisition stands out.
Payment networks traditionally see activity once consumers are close to making a transaction. BioCatch watches what happens during the digital banking session itself, giving Visa access to a different layer of fraud intelligence.
That could become increasingly valuable as scams move beyond stolen credit card numbers.
Account takeover, authorized payment fraud, social engineering and identity-based attacks often begin long before a payment reaches Visa’s network. Detecting unusual behavior during that earlier stage could help banks intervene before funds leave an account.
For Visa, that means cybersecurity can become part of a broader business that stretches from the user’s interaction with a banking app all the way through the payment.
It may explain why the company is willing to put $2.4 billion behind BioCatch.
The acquisition still needs to clear the closing process. Visa expects the transaction to be completed by the end of its fiscal second quarter of 2027.
If the deal closes as planned, BioCatch will join a growing collection of fraud and security technologies inside Visa at a moment when AI is raising the stakes for attackers and defenders.
The card giant built its business around moving money. Now it is spending $2.4 billion to get better at spotting fraud before that money moves.
