Visa Agrees to Buy BioCatch for $2.4 Billion to Stop Fraud Upstream of Payment

Visa (NYSE: V) signed a definitive agreement to acquire BioCatch for $2.4 billion in cash. The sellers are funds advised by Permira, BioCatch's majority owner, along with other shareholders. Visa did not disclose BioCatch's revenue, profitability or the multiple it is paying, and neither party has published a merger agreement.

Visa says the deal is subject to customary closing conditions, including applicable regulatory approvals, and expects completion by the end of its fiscal second quarter of 2027. Visa's fiscal year ends on 30 September, so that points to a close by 31 March 2027, roughly eight months after signing.

For Visa, the price is small next to its balance sheet and cash generation, so funding is not the risk. The real questions are what the money buys and whether BioCatch's position with the banks survives a change of owner.

BioCatch does behavioural biometrics. It doesn't check who you are by fingerprint or face. It checks how you behave: typing rhythm, how you move a mouse or swipe a screen, how you hold the phone, how you move through an app. According to the announcement, it continuously collects more than 3,000 anonymised data points per session. These include keystroke and mouse activity, touch-screen behaviour, AI-agent usage and jailbroken devices.

Its models use those signals for two things that older fraud tools struggle with:

• Account takeover: someone else is using a legitimate customer's credentials. They type, move and navigate differently, even with a correct password and a known device.
• Authorised push-payment scams: the real customer is making the payment, but under coaching or pressure. Hesitation, long pauses while on a call, copy-pasted payee details and remote-access tools all leave behavioural traces.
• Money mules and application fraud: accounts opened or run to launder money show navigation patterns that genuine new customers don't.
• Network intelligence: BioCatch shares risk signals across its client banks, so a mule account flagged at one bank can be scored at another.

That second use case, the scam where the victim authorises the payment, is the one that matters most commercially. A card-network fraud score that only sees a properly authenticated, properly authorised payment has nothing to go on. The behavioural evidence is in the session that came before it.

Visa's own framing is direct. In the announcement, Andrew Torre, president of value-added services, said account takeovers and scams cost the global economy over $1 trillion a year, and that AI is enabling these attacks "at unprecedented scale".

Fraud is moving earlier in the chain. When fraud meant stolen card numbers, the network could catch it at authorisation by spotting an odd merchant, location or amount. Social engineering moves the decision earlier. By the time a coached victim confirms a transfer, every technical check passes. The only place left to catch it is the behaviour in the session.

Visa says it has invested more than $13 billion in technology and infrastructure over the last five years to protect the payments ecosystem. BioCatch turns part of that from a partnership into a capability Visa owns, and gives it a signal it can sell back to the same issuers whose cards run on its network.

The $1 trillion global figure is Visa's. The government data behind it points the same way, and it shows the shift towards scams where the victim makes the payment.

• United States, FTC: consumers reported losing more than $12.5 billion to fraud in 2024, up 25% on 2023. The FTC says the jump came from more victims losing money, not more reports: 38% of people who reported fraud lost money, against 27% a year earlier. Investment scams ($5.7 billion) and imposter scams ($2.95 billion) led, and bank transfers and crypto accounted for more losses than all other payment methods combined.
• United States, FBI IC3: the 2024 Internet Crime Report recorded $16.6 billion in reported losses, the highest in the report's history.
• United Kingdom, PSR: since 7 October 2024, UK payment firms have had to reimburse most victims of authorised push-payment scams, up to £85,000 per claim, with the cost split between the sending and receiving firms. The regulator's rules turned scam losses into a direct cost on bank balance sheets.

BioCatch isn't Visa's first fraud-technology deal. In December 2024 Visa completed its acquisition of Featurespace, a Cambridge, UK, developer of real-time AI transaction monitoring. Featurespace protected about 500 million consumers and processed more than 100 billion payment events a year, and became part of Visa's Risk and Identity Solutions business.

Taken together, the two deals cover the fraud lifecycle in layers:

Visa describes the deal as complementary to its existing cyber, fraud, risk and security products, spanning "account opening to transactions". It is not trying to replace the issuer's processor or core banking system. It is adding a trust layer that makes its value-added services harder for banks to drop.

With no disclosed revenue, the usual multiple can't be calculated. What can be measured is the price per unit of reach. At $2.4 billion, Visa is paying about $3.16 per protected user, $1.33 per protected device and about $6.9 million per bank client.

Seen this way, Visa isn't paying for current earnings. It's paying for a distribution position: an installed base inside more than 350 banks, and a data network that improves as more banks share signals. Behavioural models are hard to copy because they need years of labelled sessions. Visa can sell that through its issuer relationships far faster than BioCatch could alone.

Visa's own forward-looking statements name the main uncertainties: the timing and outcome of regulatory review, shifts in the competitive landscape, cybersecurity incidents, and the pace and success of integration. Three of these matter most here.

• Regulatory and privacy scrutiny. Behavioural data is sensitive even when anonymised. How freely Visa can share session signals across its client base will depend on data-protection rules in each market.
• Bank trust. BioCatch's clients chose an independent specialist. Some may hesitate to send that much session data to a network they also negotiate fees with. Keeping that trust matters as much as the technology.
• Competitive response. Other networks, processors and fraud vendors are building or buying their own session intelligence. Mastercard has bought threat-intelligence and identity businesses, and independent behavioural vendors will pitch their neutrality to banks wary of network lock-in.

Until Visa confirms completion, the correct status is definitive agreement, pending close.

The central view

Visa is buying its way upstream. As fraud moves from stolen card data to social engineering, the network that can only see the payment message is always one step late. BioCatch gives Visa a seat in the banking session, plus a data network that is hard to rebuild from scratch.

Why the price makes sense

For a company of Visa's scale, $2.4 billion is a modest price for a capability its biggest issuers already pay for and regulators are making mandatory in all but name. The return will come less from BioCatch's own revenue and more from making Visa's value-added services harder to replace.

What could go wrong

If banks see BioCatch as compromised by network ownership, or integration slows model development, Visa will have bought the brand without keeping its edge. Privacy limits on cross-client data sharing could also cap the network effect that justifies the price.

What it signals for buyers and sellers

For fraud, identity and risk-technology founders, the message is that strategic buyers will pay for position in the customer journey, not only for revenue. Companies that own a signal earlier than the payment, and an installed base of banks, are now strategic assets to networks, processors and large banks. Acquiry runs buy-side and sell-side mandates in fintech and payments, and in any sector or market beyond it.