Capital

Visa Just Bought the Way You Type

Visa is buying behavioural biometrics firm BioCatch for 2.4 billion dollars from Permira-advised funds. The company reads keystrokes and touch gestures across 19 billion sessions a month for more than 350 banks.

CapitalBy Servola Tech Desk2026-08-034 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Key takeaways

Visa is paying 2.4 billion dollars in cash for a company that reads keystrokes, touch gestures and device handling across 19 billion sessions a month. If your bank is one of its 350-plus clients, the behavioural profile of your customers gets a new ultimate owner before the end of Visa's fiscal second quarter of 2027.
Permira-advised funds took control of BioCatch about two years ago at a valuation near 1.3 billion dollars and are selling at 2.4 billion. The detection product did not roughly double in two years; the strategic value of the data did.
The asset is the join, not the detection. A card network that already sees the transaction is acquiring the layer that sees the behaviour leading up to it, and no independent vendor can offer a bank that combination.
Article 4(14) of the GDPR defines biometric data to include behavioural characteristics that allow unique identification of a person. Whether keystroke dynamics fall inside that definition in your deployment is a question your data protection officer should already be able to answer in writing.
The deal closes by the end of Visa's fiscal second quarter 2027 and is subject to regulatory approval, so nothing changes contractually this year. Use that window to read your Article 28 processor terms and find the change-of-control clause before you need it.

What Visa is actually buying

BioCatch does not read what a customer types. It reads how they type it. The company's own description is behavioural and device intelligence: thousands of signals covering keystrokes, touch gestures and device handling, processed by machine learning to tell a genuine account holder from someone who has taken the account over. The scale is the part worth writing down. BioCatch protects 1.8 billion devices and 760 million users, serves more than 350 banking clients across 21 countries including over 100 of the world's largest banks, and analyses 19 billion user sessions every month.

Andrew Torre, Visa's president of value-added services, framed the purchase around a number and a position. Account takeovers and scams, he said, cost the global economy over a trillion dollars a year, and the acquisition lets clients stop fraud before it reaches the point of payment. That last phrase is the strategic one. Visa's existing view of a customer begins when a payment is attempted. BioCatch's view begins when the session does, minutes or hours earlier, and consists of physical habits the customer could not describe if asked.

The price nearly doubled in two years

Permira-advised funds took control of BioCatch roughly two years ago in a deal that valued the company near 1.3 billion dollars. They and the other shareholders are selling to Visa at 2.4 billion in cash. That is close to a doubling in about two years, in a category where the underlying technique, watching how a person interacts with a device, has been commercially available for a decade.

Fraud detection did not become twice as good in that period. What changed is who wants the data and what they can put next to it. A private equity owner monetises a fraud vendor by selling more seats to more banks. A payment network monetises the same vendor by connecting its signal to the authorisation decision it already controls. The second buyer can pay more for the identical product because the product is worth more inside the network than outside it, and that difference, not any improvement in accuracy, is most of the gap between 1.3 and 2.4 billion dollars.

The asset is the join

For a European bank the practical consequence is about supplier concentration rather than fraud rates. Until now, behavioural intelligence and card authorisation came from different companies, which meant a bank could switch one without disturbing the other and could play them against each other on price. After close, one company holds both halves for any client that uses Visa and BioCatch together, and it is the only company that can.

That is not automatically bad. Joined signals genuinely do catch scams that either layer alone would miss, and a bank buying both from one vendor may get a better product and a simpler contract. It is simply a lock-in decision that most institutions will make passively, by renewing two contracts that have quietly become one. The banks that handle this well will price the combination deliberately at the next renewal, while the alternative vendors still exist to be quoted against.

What to read before the close

Start with the classification question, because it determines everything downstream. Article 4(14) of the GDPR defines biometric data as data resulting from specific technical processing of physical, physiological or behavioural characteristics that allows or confirms unique identification. Behavioural characteristics are named in that definition. Whether your particular BioCatch deployment sits inside it depends on what the system is doing in your configuration, and that is a question your data protection officer should be able to answer in writing today, not one to open after a change of ownership.

Then read the contract. The transaction is expected to close by the end of Visa's fiscal second quarter of 2027 and remains subject to regulatory approvals, so you have a long window in which nothing contractual changes. Use it. Find the change-of-control clause in your Article 28 processor terms, confirm whether sub-processor changes require notice or consent in your agreement, and establish whether your customers were told their behavioural signals would be processed by a payment network. If the answer to that last one is no, the time to fix the disclosure is while the deal is still pending.

Frequently asked questions

Is this a fraud story or a data story?

Both, but the money says data. The fraud case is real and Visa states it plainly. The price, however, reflects what the behavioural signal is worth when joined to payment authorisation, which is a capability only a network can build. Read the deal as an acquisition of a data position that happens to be sold as fraud prevention.

Does the acquisition change our processor obligations automatically?

No. A change of ownership does not by itself rewrite your Article 28 terms, and your institution remains the controller. What changes is the ultimate parent of a processor in your chain and the commercial logic behind it. Your obligation is to know whether your agreement requires notification or consent for that, which is a contract question you can settle now.

When does anything actually happen?

Not this year. Visa expects to close by the end of its fiscal second quarter of 2027, and the deal is subject to regulatory approvals, which for a payment network acquiring a fraud vendor across 21 countries is not a formality. Treat the interval as preparation time rather than as a reason to wait.

The headline version of this deal is a card network arming itself against AI-driven scams, and that version is true. The version that matters to an institution buying either product is narrower: a signal about how your customers physically behave is moving inside the company that also decides whether their payments go through, and the price paid says that combination is worth roughly a billion dollars more than the signal alone. Banks have until 2027 to decide whether they want to buy both halves from one supplier. The ones that decide it deliberately will pay less than the ones that discover it at renewal.

VisaBioCatchPermirabehavioural biometricsfraud preventionGDPRArticle 28vendor concentrationpaymentsaccount takeover

A Police Dashboard on 700 Foreigners Sat Open

A police surveillance dashboard in Zhangjiakou held profiles on more than 700 foreign residents and 300 foreign journalists, and it was left unsecured. The vendor patent behind it is the part that should change how you brief staff travelling to China.

4 min read

Law & Regulation

Your Vendor Decides When Your 72 Hours Start

CareCloud's records system was hit on 16 March. It determined on 24 June that data was taken. Letters went out from 30 July. Your GDPR clock is 72 hours.

6 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles