Capital

The Bank Receiving Your Money Pays Half the Scam

Visa is paying 2.4 billion dollars for the behavioural model that scores 19 billion banking sessions a month. Under British rules the bank receiving scam money already refunds half of it.

CapitalBy Servola Tech Desk2026-08-034 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Key takeaways

Visa is paying 2.4 billion dollars in cash for BioCatch, a company that analyses 19 billion banking sessions every month across more than 350 banks, which means the behavioural model deciding whether a payment looks like a scam is moving inside the card network rather than staying a vendor your bank picked.
Since 7 October 2024 British rules have required the sending bank to refund authorised push payment scam victims up to 85,000 pounds, and the receiving bank must pay back half of that refund within five working days. The institution holding the account that received the money carries real cost.
That 50 percent share gives your own bank a direct financial reason to doubt money arriving in your account, so expect more holds and more questions on legitimate inbound payments, decided by a scoring layer you have no contract with.
BioCatch scores behaviour rather than payments, reading keystrokes, touch gestures and how a device is held across 760 million users and 1.8 billion devices. None of those signals appear on a bank statement you can audit.
The transaction is expected to close by the end of Visa's fiscal second quarter of 2027 and needs regulatory approval, so ask your payment provider now whether BioCatch sits in its fraud stack and what happens to that contract on a change of control.

A 2.4 billion dollar purchase of other people's keystrokes

Andrew Torre, who runs value-added services at Visa, put a number on the problem before he put one on the deal. Account takeovers and scams cost the global economy over a trillion dollars a year, he said, and AI is enabling these attacks at unprecedented scale. On 3 August Visa signed a definitive agreement to acquire BioCatch from funds advised by Permira and other shareholders for 2.4 billion dollars in cash.

BioCatch does not examine the payment. It examines the person making it. The company reads keystrokes, touch gestures, the angle at which a device is held and thousands of other application, behavioural, device and network signals, then decides in real time whether the human in the session is the account holder or somebody steering them. It runs that judgment across 19 billion sessions a month, 760 million users and 1.8 billion devices, for more than 350 banking clients in 21 countries including over 100 of the largest banks in the world. Gadi Mazor, BioCatch's chief executive, framed the product as real-time insight into customer intent.

Britain already decided who pays, and it is not only the sender

The Payment Systems Regulator settled the money question in Britain almost two years ago. Since 7 October 2024, a payment service provider whose customer is tricked into authorising a payment to a fraudster must reimburse that customer up to 85,000 pounds, normally within five working days, with claims admissible for thirteen months after the last authorised payment. The rule covers Faster Payments and CHAPS, and providers can stop the clock for more information but must reach a final decision inside 35 working days.

The part that gets less attention is the split. The sending provider refunds the victim, and the receiving provider then reimburses the sending provider for half of that amount within five working days of being notified. Fraud losses stopped being purely the sender's problem the day that rule took effect. Every institution that holds an account into which scam proceeds land now books a share of the refund, which turns behavioural intent scoring from a security nicety into a line that shows up in the cost of running a payments business.

The scheme and the scorer are becoming the same company

Visa is not an ordinary buyer of security software. It writes scheme rules, allocates liability between the parties to a transaction and prices the network its members must use. Owning a leading behavioural intent model means the company that helps define who is responsible for a disputed payment also supplies a widely used signal on which that responsibility turns. Both roles are legitimate on their own. Held together, they narrow the number of places a bank can go for an independent second opinion about its own customers.

Permira's side of the announcement shows why the asset commanded that price. The firm took a minority position in BioCatch in early 2023, moved to majority control in 2024, and saw revenue and gross profit each rise roughly threefold during its ownership. Stefan Dziarski, the Permira partner who leads its Ascent strategy, called the sale validation of an approach that backs product-led mid-market growth companies. It is the firm's fifth strategic exit of 2026, in a twelve-month period during which it has distributed 16.6 billion dollars to investors. A business whose revenue tripled while regulators were busy reassigning fraud liability was not growing by accident.

What a business should actually do before 2027

Nothing changes on Tuesday. The transaction is expected to close by the end of Visa's fiscal second quarter of 2027 and remains subject to customary regulatory approvals, which for a deal of this size and this buyer is not a formality. The practical risk in the meantime is not the acquisition. It is that most businesses do not know whose model is already judging their incoming payments, and will not find out until a payment is held.

Three questions are worth putting to your payment provider in writing this month. Ask whether BioCatch supplies any part of the fraud or behavioural scoring applied to your accounts. Ask what the escalation path is when a legitimate inbound payment is delayed on a behavioural signal, and how long a review takes. Ask what the change-of-control provisions in your agreement do when a supplier is bought by the card scheme itself. If you receive customer payments at volume, a rule that puts half the refund on the receiving bank is a rule that will eventually be felt by the businesses that bank serves.

Frequently asked questions

Does this deal mean Visa can see my company's banking behaviour?

Not today, and not automatically after closing. BioCatch's contracts are with banks, and the signals are generated inside those banks' own digital channels. What changes is ownership of the model and the commercial relationship around it. The question to ask your provider is which supplier scores your sessions, not whether Visa has some direct view of your accounts.

Does the 85,000 pound reimbursement rule apply to business accounts?

The regime is aimed at consumers, microenterprises and charities rather than large corporates, so most sizeable businesses are outside the reimbursement right itself. The effect described here reaches you from the other direction: your bank's exposure as a receiving provider shapes how it treats money arriving in your account, whatever your own claim rights are.

Should we delay signing a payments contract until the deal closes?

No. Sign on the commercial terms in front of you, but read the assignment and change-of-control clauses before you do, and make sure a supplier substitution does not silently reset service levels on fraud review times. That is normal vendor hygiene, and it costs nothing to do now.

The headline number is the 2.4 billion dollars, and it is the least interesting figure in the announcement. The one that matters is 50 percent, because that is the share of a British scam refund carried by the bank that received the money, and it is what turned behavioural scoring from a product into infrastructure. Visa did not buy a fraud tool. It bought the layer where a regulator's liability rule meets a customer's payment, and it bought it while that rule is still settling.

VisaBioCatchPermiraAPP fraudBehavioural biometricsPayment Systems RegulatorVendor concentration

Six Percent Is Banned on European E-Money

X Money opened across 41 US states paying up to 6 percent APY. The same structure cannot legally pay a cent of interest under EU e-money rules.

5 min read

Capital

Small Firms Borrowed Bigger, So iwoca Borrowed Too

iwoca closed a 250 million pound facility with an unnamed UK bank and Waterfall Asset Management. The interesting number is not the facility, it is the loan sizes small firms are now asking for.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles