- What's at stake: Three of the four largest U.S. banks by assets run BioCatch software, Wells Fargo among them. After the deal closes, their fraud vendor reports to a card network they also negotiate with.
- Expert quote: Bundling suits a bank until it doesn't, said Eric Grover of Intrepid Ventures: It is more efficient and simplifies vendor management, "albeit at the cost of reducing banks' negotiating leverage."
- Forward look: Visa expects the deal to close by the end of March 2027. Until then, the legal basis for a U.S. interbank sharing network remains a Treasury Department fact sheet that no court has reviewed.
Overview bullets generated by AI with editorial review.
Visa agreed Monday to pay $2.4 billion for a company that watches not card transactions but how bank customers type.
The card network signed a definitive agreement to purchase BioCatch, a
BioCatch monitors behavior. Specifically, it looks at how a user interacts with their banking app and login portal and at their transfer requests.
The vendor claims its software reads more than 3,000 signals as a customer uses a banking app, including keystrokes, touch gestures and the orientation of the phone as the customer holds it.
The company looks for account takeovers,
The deal hands Visa a fraud tool already installed across much of U.S. retail banking. Wells Fargo signed on in 2025, bringing the total to three of the four largest U.S. banks by assets, BioCatch said in a
BioCatch protects 760 million users and serves more than 350 banking clients, analyzing 19 billion sessions a month, according to
Once the deal closes, the U.S. banks running BioCatch will buy their fraud detection from a company with which they also negotiate card terms.
"BioCatch will help our clients stop fraud before it reaches the point of payment," said Andrew Torre,
Visa said in its Monday announcement that it expects the deal to close by the end of March 2027.
A BioCatch spokesperson declined to answer questions about the deal and pointed to the announcement and to a blog post from the company's CEO. A Permira spokesperson said the firm had nothing to share beyond its own announcement.
A fraud data-sharing network that does not yet run in the US
BioCatch offers its anti-fraud behavior monitoring in the U.S. Abroad, it also has an interbank intelligence sharing network called
When the network decides a receiving account looks untrustworthy, it warns the sending bank in real time, and the bank can hold the transfer before the money moves.
That network does not yet operate in the U.S., Mac King, BioCatch's director of global marketing communications, told American Banker.
The network runs in
"In those markets where we've launched BioCatch Trust," real-time interbank intelligence sharing "even further amplifies the efficacy of our behavioral intelligence," wrote BioCatch CEO Gadi Mazor in a Monday blog post.
Seven weeks before the Visa-BioCatch deal, the legal obstacle to building such a network in the U.S. got smaller.
In June, the Financial Crimes Enforcement Network, or Fincen,
The update asserts that protections for information sharing cover suspected fraud, that a bank need not first find laundered proceeds to share such information and that banks can share the data in real time. It specifically lists device identification numbers and IP addresses as sharable.
The Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp.
That guidance is not a statute, and no court has reviewed it.
"The safe harbor has never been tested judicially, so it is not clear whether a court would agree with Fincen's interpretation," Daniel Stipano, a partner at Davis Polk & Wardwell who spent more than 30 years at the OCC,
The Bank Policy Institute, a trade group for large, regional and foreign banks, has asked Congress twice since June to
Despite the flimsy legal basis, banks now have "fewer reasons not to participate" in information sharing, Himamauli Das, a former acting director of Fincen now at the advisory firm K2 Integrity,
A Visa spokesperson did not immediately respond to a request for comment on whether the payment network intends to extend BioCatch Trust to the U.S.
If it decided to bring that fraud data sharing to the U.S., the legal foundation would not be a law or regulation; it would be a fact sheet.
But there is precedent for banks contributing their fraud data to a company owned by one of their commercial counterparties, according to Sara Elinson, a managing director at L.E.K. Consulting who advises banks and fintechs on payments. She pointed to consumer credit bureaus, which build their intelligence out of bank-contributed data while answering to commercial owners.
A bank-owned option also exists. Early Warning Services, the company behind Zelle and owned by a group of large banks, launched an identity and fraud unit called
Certos draws risk signals from a consortium of more than 5,000 banks, credit unions, payment companies, merchants and government agencies, the company said in a
Another service in a suite the government says locks banks to Visa
BioCatch
Value-added services, Visa's term for what it sells clients beyond moving payments, generated $3.8 billion in the quarter that ended June 30, up 33% from a year earlier. Compare that to $11.6 billion in total net revenue, according to its
The same filing lists $5.6 billion in revenue Visa has under contract but has not yet booked, primarily from those services, about half of it expected within two years. In other words, Visa expects to earn $5.6 billion from committed (or, cynically, locked in) customers.
The U.S. Department of Justice says Visa makes those services hard to leave. In its
Visa "anticipates almost five-times the net revenue" from the mandatory version, the complaint reads.
The complaint asks the court to bar Visa from "bundling credit services or credit incentives with debit network services."
Visa denies the allegations.
Judge John G. Koeltl refused to dismiss the case in June 2025, so the parties are now in discovery. They owe the court their next
The government is challenging the fee that applies to merchants through their acquiring banks, which does not apply to the banks that buy fraud tools. Visa has not said how it will price BioCatch to its bank clients.
Buying a bundle can suit a bank well enough. It is often more efficient and makes vendor management easier, "albeit at the cost of reducing banks' negotiating leverage," said Eric Grover, a principal at the consulting firm Intrepid Ventures, which advises payment networks and processors.
Grover reads the purchase as Visa moving in rather than merely adding a product. It "expands Visa from operating the payment network inside client banks' infrastructure, enabling it to deliver greater value and deepen its bank licensees' dependency," he told American Banker.
He put the deal alongside Visa's $1 billion purchase of Pismo, which sells the cloud software banks use to run card issuing and core processing, and which
Regulators have flagged the risk of banks depending on the same few vendors; trouble at a significant third-party provider can reach many institutions at once, "particularly where there is limited substitutability," the Financial Stability Oversight Council warned on page 17 of its
Visa's second fraud purchase in 20 months
BioCatch is Visa's second fraud-vendor purchase in 20 months.
Visa
Visa never announced what it paid, but its
The BioCatch purchase is "on point given accelerating fraud," KeyBanc Capital Markets analysts Andrew Schmidt and Anthony DeLise wrote in a research note the day the companies announced the deal.
BioCatch ended 2025 with more than $185 million in annual recurring revenue (i.e., subscription revenue counted on a yearly basis), according to its January release.
Assuming 25% to 30% annual growth, the analysts put its 2027 revenue at $260 million to $280 million, which makes the price about nine times revenue. They called that reasonable.
KeyBanc rates Visa overweight (its equivalent of a buy recommendation) with a $425 price target. The stock traded around $366 Monday afternoon.
