When the world's largest payment network spends $2.4 billion on a single acquisition, it is worth asking what they are buying and why they could not build it themselves.
On 3 August 2026, Visa announced it would acquire BioCatch, an Israeli behavioural intelligence company, for $2.4 billion in cash from funds advised by Permira. As Andrew Torre, Visa's President of Value-Added Services, stated: "Account takeovers and scams cost the global economy over $1 trillion annually, and AI is enabling these attacks at unprecedented scale. BioCatch will help our clients stop fraud before it reaches the point of payment."
BioCatch does not do what most eCommerce merchants think of when they hear "fraud prevention." It does not check addresses, flag suspicious IP addresses, or apply velocity rules. Instead, as Disruption Banking described, "it analyses thousands of real-time signals during digital banking sessions. These include keystrokes, touch gestures, device handling and signs of coercion." BioCatch currently protects 1.8 billion devices and 760 million users, serving more than 350 banking clients across 21 countries.
For eCommerce merchants, this acquisition matters not because of what BioCatch does today, but because of what it signals about where fraud prevention is heading.
Behavioural biometrics is becoming infrastructure
BioCatch currently serves financial institutions primarily through add-on integrations. What makes this acquisition strategically significant is that Visa is integrating behavioural intelligence into its core payment infrastructure. That means behavioural signals will eventually influence authorisation decisions across Visa's network, not just for the institutions that chose to deploy BioCatch as a separate tool.
For eCommerce merchants, this represents a meaningful shift. Today, fraud prevention at the merchant level typically involves address verification (AVS), CVV checks, 3D Secure authentication, and third-party fraud scoring. These tools work on transactional data: what is in the order, where it is shipping, whether the card details match. They do not analyse how the buyer behaved during the shopping session.
When behavioural biometrics becomes part of the payment network itself, the fraud signal available at authorisation time gets dramatically richer. A transaction that looks clean on paper, with the correct billing address, a valid CVV, and shipping to the cardholder's address, might still be flagged because the behavioural patterns during the session do not match the cardholder's established profile.
The context for this investment is stark. As TechTimes reported, the Nasdaq 2026 Financial Crime Report found $4.4 trillion passed through the global financial system through illicit channels in 2025, a 42% increase over two years. UK APP fraud alone cost victims £576.4 million in 2025. Visa has invested more than $13 billion in technology and infrastructure to combat fraud over the past five years. BioCatch is the next logical step.
What this means for merchant fraud operations
Several directional shifts are already clear.
-
Authorisation rates should improve for legitimate transactions: One of the biggest hidden costs in eCommerce fraud prevention is false declines. When the payment network has richer behavioural data, it can be more confident in approving genuine transactions, even ones that trigger traditional risk signals.
-
Sophisticated fraud will become harder: As BioCatch CEO Gadi Mazor stated: "Banks are winning the fight against traditional fraud, but criminals have adapted, shifting from hacking systems to manipulating people, and authorised losses are surging as a result." Behavioural biometrics makes it significantly harder for fraudsters using stolen credentials, bots, or remote access tools.
-
The gap between merchants using basic fraud tools and those with advanced fraud stacks may narrow: When behavioural intelligence sits in the payment network rather than in the merchant's own fraud stack, smaller merchants who cannot afford sophisticated fraud prevention tools benefit from the same intelligence that large enterprises deploy.
What eCommerce merchants should do now
The deal is expected to close by mid-2027, subject to regulatory approvals. But there are practical steps merchants should consider now.
-
Audit your current fraud tooling: Understand what signals your fraud prevention relies on and where the gaps are. If you are primarily using rules-based fraud detection, you are already behind the curve.
-
Evaluate whether your checkout collects useful behavioural data: If your checkout captures session data, including time on site, page navigation patterns, and form interaction behaviour, you are providing your fraud tools with richer signals.
-
Watch for changes to Visa's authorisation APIs and merchant-facing fraud tools: As BioCatch integrates into Visa's platform, new capabilities will surface. Merchants integrated with Visa's developer ecosystem will be positioned to adopt them early.
The bigger picture
Visa's BioCatch acquisition is part of a broader shift in how the payments industry thinks about fraud. The old model, where fraud prevention was primarily the merchant's problem, solved with bolt-on tools, is giving way to a model where intelligence is embedded in the payment infrastructure itself.
The $2.4 billion price tag tells you how seriously Visa takes this shift. eCommerce merchants should take it seriously too.
About On Tap
On Tap is a growth-focused eCommerce consultancy helping mid-market and enterprise merchants build fraud prevention strategies that protect margins and customer trust. From fraud tooling audits and payment stack assessments to checkout optimisation and risk management strategy, On Tap helps merchants stay ahead of an evolving threat landscape.
If you want to evaluate your current fraud prevention approach, get in touch.
