Visa to Acquire BioCatch for $2.4B: Behavioral Biometrics as the Trust Layer for Agentic Commerce
Visa has agreed to acquire Israeli behavioral biometrics firm BioCatch for $2.4 billion. How keystroke and device-handling signals that separate humans, AI agents, and fraud bots reshape payment security in the agentic commerce era.
Key Takeaways
- Visa has agreed to acquire behavioral biometrics firm BioCatch for $2.4 billion in cash, with closing expected by the end of Visa's fiscal second quarter of 2027
- The deal brings in-house a trust infrastructure that separates legitimate humans, authorized AI agents, and fraud bots based on keystrokes and device-handling signals
- As agent-driven transactions grow, the premises of fraud detection shift, and e-commerce operators need to rebuild their defenses around trust signals provided by payment networks
Inside the $2.4 Billion Deal
The card network giant plans to scoop up the Israeli firm to strengthen its defenses in a fight against fraud fueled by artificial intelligence.
www.paymentsdive.comOn August 3, 2026, Visa announced that it has agreed to acquire BioCatch, an Israeli firm specializing in behavioral biometrics and fraud detection, for $2.4 billion in cash. The sellers are investment funds advised by Permira along with other shareholders. The deal is expected to close by the end of Visa's fiscal second quarter of 2027, subject to customary closing conditions including regulatory approvals.
Founded in 2011 and headquartered in Tel Aviv, BioCatch serves 350 banking clients across 21 countries, including 100 of the world's largest banks. Its platform protects 1.8 billion devices and 760 million users, analyzing 19 billion user sessions every month.
The valuation trajectory is worth noting. When Permira completed its purchase of a majority stake in September 2024, BioCatch was valued at $1.3 billion. In less than two years, the price has nearly doubled to $2.4 billion, a testament to the demand attached to AI fraud prevention. BioCatch's standalone financials, such as revenue and profitability, were not disclosed in the release.
What BioCatch's Behavioral Biometrics Actually Watch
Behavioral biometrics verifies identity not through physical traits like fingerprints or faces, but through the idiosyncrasies of how a person operates a device. BioCatch's platform continuously collects more than 3,000 anonymized signals, including keystroke rhythm, touch gestures, the angle at which a phone is held, mouse movements, and even whether an AI agent is in use, to distinguish legitimate users from fraudsters in real time.
What sets this approach apart is that the judgment happens before the payment. Rather than waiting for a card number to be entered and a transaction to arrive, the system observes everything from login through in-session behavior. That makes signs of account takeover, and even the hesitation of a victim being coached through a transfer by a scammer, detectable. Covering everything upstream from bank account opening through transactions is exactly what Visa calls upstream threat prevention.
Real-time insights into customer intent continue to grow increasingly essential for institutions to establish trust within digital banking sessionsSource: Gadi Mazor (CEO, BioCatch)
Recent product moves already anticipate AI agents. DeviceIQ, announced in March 2026, is reported to detect agentic browsers, deepfake injection, and AI-assisted access at the device level. The company has also outlined a flow in which, upon detecting agent-driven activity, the bank asks the customer whether they authorize that agent to act on their behalf, letting only approved agents through. This is a significant step beyond blanket bot blocking toward agent authorization management.
A Second Deal After Featurespace: Why Visa Is Internalizing Fraud Prevention
This is not Visa's first major fraud-prevention acquisition. In 2024, the network agreed to buy the UK's Featurespace for roughly $1 billion, making BioCatch its second such deal in two years. The two companies cover different ground, and together they form a defensive line spanning both sides of the payment.
| Item | Featurespace (2024) | BioCatch (2026) |
|---|---|---|
| Deal size | About $1 billion | $2.4 billion (cash) |
| Headquarters | Cambridge, UK | Tel Aviv, Israel |
| Core technology | Adaptive behavioral analytics on transaction data | Behavioral biometrics (keystrokes, touch gestures, device handling) |
| Primary detection point | At payment transaction execution | Pre-payment, during login and session activity |
| Primary targets | Anomalous payment transaction patterns | Account takeover, scam coercion, bot and AI agent discrimination |
| Customer base | Financial institutions and payment providers | 350 banks in 21 countries (including 100 of the largest banks) |
Behind the moves lies a sense of alarm that AI has changed the nature of fraud. Andrew Torre, Visa's president of value-added services, framed the scale of the damage in the announcement.
Account takeovers and scams cost the global economy over $1 trillion annually and AI is enabling these attacks at unprecedented scale
The numbers line up with Visa's own observations. The company has invested more than $13 billion in technology over the past five years and has released Vulnerability Agentic Harness, an open-source AI security tool for identifying vulnerabilities at scale. In its 2026 global e-commerce payments and fraud report, based on a survey of about 1,200 merchant professionals worldwide, about 80% named data and technology as their biggest fraud management challenges. The more Visa builds fraud detection into value-added services it sells to merchants and banks, the stronger the case for owning these capabilities outright.
What This Means for the Trust Layer of Agentic Commerce
Reading this acquisition as a mere security upgrade misses half the picture. The other half is a play for the trust infrastructure of agentic commerce, where AI agents discover products, compare options, and execute payments.
Visa has already built out Visa Intelligent Commerce as its agent payment foundation, and the Trusted Agent Protocol (TAP) uses cryptographic signatures to prove that a bot is a Visa-approved, legitimate agent. But a cryptographic signature only vouches for the agent's registered identity. Whether the human behind it is genuine, whether the instructions came from the account holder, or whether the session has been hijacked by a fraudster, the signature alone cannot say.
That is where behavioral signals fit in. Agentic commerce transactions require separating three actors: the legitimate human, the agent legitimately authorized by that human, and the malicious bot or hijacked session. Identity proof in the style of TAP and behavioral verification in the style of BioCatch are complementary layers. Agent-driven traffic can just as easily become a vector for fraud, a concern already visible in retail, which is why owning both layers matters so much to a payment network.
Mastercard Got There First, and a Caveat on Behavioral Biometrics
Looking at the competition, this deal has a catch-up dimension. Mastercard completed its $2.65 billion acquisition of threat intelligence leader Recorded Future in December 2024, and its Agent Pay platform embeds tokenization, authentication, and an acceptance framework, with Recorded Future's threat monitoring layered on top as intelligence. The two card networks are advancing agent payment rails and security acquisitions as a package, and the parallels are hard to miss. Financial institutions share the anxiety: an Accenture study reportedly found that 78% of financial institutions expect fraud linked to AI agents to rise significantly.
A caveat is in order, though. Behavioral biometrics was built on the premise of human operating habits, and as legitimate AI agents take over more transactions, the human signals the technology was designed to observe disappear from the session. US banking observers have pointed out that fraud models trained for decades to treat bots as threats will need rebuilding for the agent era. BioCatch's own pivot toward agent detection and authorization with DeviceIQ is precisely a response to that shift. Whether the price tag pays off depends less on detecting human quirks than on how quickly the combined company can establish the new market of verifying agent authenticity. With roughly a year of regulatory review before closing, a verdict remains some way off.
Implications for E-commerce Operators
For e-commerce operators, the acquisition signals that the main arena of fraud detection is moving off their own sites. As agent-driven access grows, traditional bot defenses such as IP filtering and CAPTCHAs start blocking legitimate agents, translating directly into lost sales. Identifying authorized agents will increasingly be delegated to protocols like TAP and to behavioral and device analytics on the network side.
In practical terms, the first step is building the capacity to consume fraud scores and agent verification signals from payment networks and PSPs. As Visa's merchant survey showed, fraud management pain is concentrated in data and technology. Securing connectivity to the trust signals being standardized at the network level is likely to deliver a better return than refining in-house bot detection.
Measurement design for checkout and login flows also deserves a fresh look. If a legitimate agent-driven transaction gets flagged as suspiciously fast operation, agentic commerce revenue is thrown away. The mindset has to shift toward distinguishing humans from agents and routing each through verification appropriate to what they are.
Conclusion
Visa's $2.4 billion acquisition of BioCatch is a move to make the ability to determine who is really operating a session a core asset of the payment network, in an era when AI powers both fraud and defense. Featurespace brought anomaly detection at the transaction level, BioCatch brings pre-payment behavioral verification, and combined with TAP and Visa Intelligent Commerce, a trust stack that separates humans, agents, and fraud bots is taking shape.
Mastercard has assembled a similar lineup ahead of Visa, making it clear that competition in agent payments will be fought on the depth of trust infrastructure, not just checkout convenience. For e-commerce operators, building the capacity to use network-side trust signals is the practical first step toward agentic commerce readiness. Closing may be as far off as the end of Visa's fiscal second quarter of 2027, but the time to start preparing is now, while the announcement is fresh.
