Visa buys BioCatch for $2.4B: fraud moves to the network

Every online sale you make passes a fraud check. You probably think of it as a setting in your payment processor — a slider between "block more" and "approve more." Visa's $2.4 billion acquisition of BioCatch is a signal that the slider is moving out of your account and into the card network.

What actually happened

On August 3, Visa announced a definitive agreement to acquire BioCatch for $2.4 billion in cash, buying out funds advised by Permira and other shareholders. The deal is expected to close by the end of Visa's fiscal second quarter of 2027, subject to regulatory approval.

BioCatch does behavioral biometrics. Instead of scoring a transaction on card number, amount, and IP address, it watches how a person uses the device: keystroke cadence, touch gestures, mouse movement, how the phone is held, how long someone hesitates on a field. Thousands of application, behavioral, device, and network signals, scored in real time, before the payment happens.

The scale numbers from Visa's release: 1.8 billion devices, 760 million users, more than 350 banking clients across 21 countries including 100+ of the world's largest banks, and 19 billion user sessions analyzed a month. Visa's stated rationale is that account takeovers and scams cost the global economy over $1 trillion a year — a figure CNBC tied to the surge in AI-generated scams that read as human because a model wrote them.

Why network-level fraud detection matters for your business

Two things change for anyone selling online.

First, your approval rate becomes a function of a model you cannot inspect. Today when a legitimate customer gets declined, you can look at your processor's rules and argue. As behavioral scoring moves into the network layer, the reason for a decline is a confidence score derived from how someone typed. There is no rule to loosen. Your job shifts from tuning filters to reducing friction that makes real customers look fraudulent — the abandoned-and-restarted checkout, the autofill that types too fast, the customer using a borrowed laptop.

Second, if you deploy behavioral scoring on your own site, you are collecting biometric-adjacent signal on your customers through a third-party script. That is a data-handling decision, not a plugin install. Know which vendor SDKs sit on your checkout page, what they capture, where it goes, and what your privacy policy says about it. "Our payment provider added it" is not an answer that survives a records request.

The durable move is the boring one: keep your own order history, your own customer identity, and your own signal on who is a good buyer. If your only fraud intelligence is whatever the network hands back, you have outsourced a decision that directly sets your revenue.

Sources: Visa Investor Relations, CNBC.