Visa just agreed to pay $2.4 billion for a company that can tell who you are by the way you type.
The payments giant announced Monday that it's buying BioCatch, a fraud-intelligence firm, in an all-cash deal — purchased from private equity house Permira and other investors, with closing expected by the end of Visa's fiscal second quarter of 2027. On paper it's another security acquisition. In practice, it's a bet on where fraud fighting has to go now that AI runs both sides of the game.
A trillion dollars walks out the door every year
Visa puts the global cost of scams and account takeovers at more than $1 trillion annually. And AI keeps pushing that number up. Phishing emails that used to take a person time to write now generate themselves in seconds. Voices get cloned. Fake identities get assembled on demand. Attacks that once needed a whole crew can be automated by one person with the right tools.
Here's the part that keeps bank security teams up at night: a fraudulent transaction can look completely legitimate. Real customer, correct password, familiar device — and it's still fraud, because someone talked that customer into sending the money. The password check passes. The scam works anyway.
"Account takeovers and scams cost the global economy over $1 trillion annually, and AI is enabling these attacks at unprecedented scale," said Andrew Torre, Visa's president of value-added services. BioCatch, he said, will help clients "stop fraud before it reaches the point of payment."
So what does BioCatch actually do?
Founded in 2011, the company works from one stubborn fact: people are hard to imitate. Its AI analyzes thousands of signals in real time during a banking session — how fast you type, how you swipe, even how you hold your phone — and flags sessions where the behavior doesn't fit the account owner.
A scammer can steal your password. Some can get into your device. Copying the way your thumbs move? That's a much taller order.
It's not a niche operation, either. BioCatch protects 1.8 billion devices and roughly 760 million users, with more than 350 banking clients across 21 countries. Over 100 of them, Visa says, rank among the world's biggest banks.
Catching fraud before the money moves
Visa already scans transactions at the moment of payment. BioCatch moves the checkpoint earlier — into the banking session itself, before anything leaves the account. Visa calls this going "upstream," and it's the whole logic of the deal: a card network paying $2.4 billion for a company that watches logins, not payments.
There's a pattern here, too. Visa bought UK fraud-detection firm Featurespace in 2024 and says it has spent over $13 billion on technology and infrastructure in five years. Mastercard did its own version of this, closing a $2.65 billion acquisition of Recorded Future the same year. The card giants aren't just moving money anymore — they're selling banks the security layer around it.
What happens to BioCatch now
Not much, apparently, and that's deliberate. Founder and CEO Gadi Mazor said the company keeps operating as-is — same leadership, same reporting lines — inside Visa's Value-Added Services organization. "BioCatch isn't going anywhere," he wrote. "I also am not going anywhere."
For the rest of us, the change should be invisible in the best way: more scams caught before the money's gone, no new hoops at checkout. The deal still has to clear closing. But assuming it does, the world's largest payment network won't just know where your money goes — it'll know whether the hands sending it are really yours. Fraudsters have gotten good at faking credentials, devices, even conversations. The one thing they still can't fake well is the small, unconscious way you use your own phone.
Image: Towfiqu barbhuiya, via Pexels
