Directory of behavioral biometrics and account takeover prevention vendors

BioCatch analyzes how a person physically and cognitively interacts with online and mobile banking, covering typing cadence, navigation patterns, hesitation and signs of duress, and turns those signals into real time fraud risk for the bank. Its Connect platform targets account opening fraud, account takeover, social engineering scams and money mule accounts, adds device intelligence and strong customer authentication, and runs BioCatch Trust, an inter bank intelligence sharing network that lets participating banks act on behavioral financial crime signals collectively. In August 2026 Visa announced an agreement to acquire BioCatch from funds advised by Permira for $2.4 billion in cash, with completion expected by the end of Visa's fiscal second quarter of 2027, after which BioCatch is to be integrated into Visa's fraud and risk portfolio.

Callsign recognizes returning bank customers by how they behave rather than by what they know. Its Intelligence Engine combines behavioral biometrics, device fingerprinting and telecommunications signals, and an Orchestration Layer decides what authentication or intervention a given interaction needs. It covers account login, payments, account creation and zero trust network access, against account takeover, social engineering scams, malware and bots, SIM swap and call diversion, and synthetic identity, with compliance support for PSD2 and Strong Customer Authentication. Its dynamic interventions detect social engineering in real time and warn the customer before they transfer money, and it publishes a Digital Trust Index on digital exclusion.

Darwinium moves the fraud decision out of a vendor's cloud and into the customer's own network perimeter. Rather than shipping a tag or a software development kit that calls an interface at chosen moments, it runs as an edge worker inside the content delivery network the business already operates, naming Cloudflare and Amazon CloudFront among them. Everything crossing that perimeter is therefore visible in one place, from the first page a visitor lands on through account creation, login, detail changes, listings, checkout and payment, and the platform can act on the journey as it happens rather than scoring a moment after the fact. The company puts deployment at as little as 15 minutes and native mobile software development kits were added in 2026 to extend the same coverage inside applications. The data architecture is the second half of the design, and it is strong. Customer data is encrypted at the edge using hybrid public key encryption where Darwinium holds only the organization's public key, so by its own account it can encrypt but cannot decrypt without the customer's involvement. Analyzed data can be stored encrypted in the organization's own storage under its own keys. The stated consequence is that the vendor never sees customer data in the clear and does not become a target worth attacking. What the models produce is identity from behavior. The company calls these digital signatures, recognizing a returning user even when device, browser or behavioral elements change, and describes itself as an intent engine rather than an identity one, consuming third party signals a customer already runs rather than displacing them. Financial lines are named and separately developed: retail banking and fintech as industries, and account takeover, payment fraud and scam detection as use cases, the last combining transaction intelligence, behavioral biometrics and what the vendor calls victim propensity modeling to alter a suspected scam journey in real time. Agent intent detection extends the same question to automated traffic. Founded 2021 in San Francisco by Alisdair Faulkner and colleagues from ThreatMetrix, with offices in London and Sydney and $26 million raised through a Series A led by U.S. Venture Partners.

Incandor builds behavioral intelligence infrastructure for banks, fintechs, neobanks and digital banks, on the argument that institutions verify identity at account creation but have no continuous signal for who is actually operating an account afterwards, while identity itself has become a commodity attackers buy in bulk. It constructs a behavioral map of every user from physical interaction signals including mouse dynamics, keystroke timing, scroll patterns and how a phone is held, requiring no fraud labels or historical data, so detection works from the first session. Each individual forms a unique cluster regardless of which account they use, which surfaces account takeovers, mule handoffs, shared operators and coordinated rings, and supports bot detection and identification of sessions under stress or coercion. Rather than returning a risk score, it exposes the map as a programmable interface so a fraud team combines behavioral signals with its own transaction and customer data. It collects only behavioral signals, not what users type, read or view.

Incognia answers the identity question with geography. Its premise is that where a person is, over time, is a harder credential to fake than what device they are holding, because people handle important account actions from places they habitually occupy. The platform learns a user's trusted locations, typically home and workplace, from background location signals and motion sensors collected through a mobile software development kit. It treats a departure from that pattern at the moment of login or payment as a risk indicator, and the company reports that 90 percent of device authorizations on its network occur at a trusted location. Incognia ID is sold as a persistent identity that survives factory resets and device swaps, paired with tamper and location spoofing detection, and clusters of devices are surfaced to expose device farms. The company describes the combination as identity affirmation rather than identity validation, and is explicit that the signal supports an identity claim rather than proving the claimant is present. A banking and fintech line covers account takeover, device authorization at high risk events and new account fraud. It also includes a transaction risk model that scores a payment high, low or unknown from hundreds of inputs. Incognia reports that the Brazilian fintech will bank cut fraud losses by 90 percent and mobile account takeover by 80 percent with its risk based authentication. Food delivery, ride hailing and marketplace lines are sold from the same network and are not covered in this profile. The network spans close to a billion devices and more than 500 million mapped places. Its services agreement names Amazon Web Services in the United States as host and deletes personal data within 180 days, and it has a SOC 2 Type II report covering all five trust services criteria. Founded in 2010 by Andre Ferraz and Alan Gomes, it pivoted to fraud prevention in 2020 and has offices in California, New York, Sao Paulo and Recife.

OneSpan is a Chicago based, publicly listed security vendor built on the authentication business formerly known as Vasco, serving more than 10,000 customers including over half of the hundred largest global banks. The portfolio spans hardware and software authenticators, mobile application shielding, a mobile security developer toolkit, identity verification, electronic signature and digital agreement workflows. The inference layer is a named and separately purchasable product line. Risk Analytics scores transactions in real time using machine learning and data modeling over device integrity, application signals, user behavior, malware indicators, transaction detail, beneficiary payment history and server side analytics, then drives workflows that act immediately according to policies and rules the bank defines, with automated alerts routed into a single case management interface for analyst review. Intelligent Adaptive Authentication couples that risk engine to multi factor authentication so that higher risk activity automatically triggers a stronger challenge rather than a uniform one, shipped with preconfigured rule sets and predictive models tuned separately for mobile, online and corporate banking. The company positions both against named regulatory regimes, including European strong customer authentication rules and a central bank mandate in the United Arab Emirates, and publishes a customer engagement modernizing authentication for an Italian bank under the revised European payments directive.

Oz Forensics builds facial biometric liveness detection and face matching software sold to banks, fintechs, identity verification vendors, telecommunications operators, gaming operators and government agencies in more than 30 countries. Founded in 2017 and headquartered in Dubai, it was acquired in September 2024 by Unico, a Brazilian digital identity company, and continues to ship under its own name. Oz Liveness establishes that a real person is present and defends against presentation attacks, injection attacks, deepfakes and three dimensional masks; Oz Biometry performs one to one verification and one to many identification; document character recognition sits alongside. It sells a hosted service, on premises licenses, an Instant API that stores no data, and listings on the AWS and Huawei cloud marketplaces, and reports more than 3 million authentications a day. External validation includes presentation attack detection testing at levels 1, 2 and 3 by iBeta and BixeLab, injection attack detection testing by BixeLab against CEN/TS 18099, and NIST face recognition evaluation of its matching model. Its trust center publishes the laboratory reports, ISO/IEC 27001:2022 and SOC 2 Type 2 credentials and a subprocessor list. Named customers include Alvos, Caina and Unico.

Reality Defender detects synthetic media in real time, running an ensemble of models against live voice on contact center calls, participants in video meetings, and images and documents in verification flows. In financial services it is deployed against voice cloning that defeats phone based authentication, executive impersonation in video conferences used to authorize transfers, and generated media aimed at identity verification checks, and it is designed to sit alongside an institution's existing security and liveness infrastructure rather than replace it.

ThreatMark builds a behavioral baseline for each banking customer and watches for departures from it, profiling how a person physically uses a device, keystroke rhythm, navigation habit, touch and pointer movement and session pattern, and combining that with device and threat signals and transaction context into one continuously updated view it calls behavioral intelligence. Its stated premise is that the fraud that matters has moved off the bank's platform: criminals now manipulate the customer into authorizing the payment, which defeats controls built to detect unauthorized access, and its own research puts social engineering in most fraud at 55 percent of surveyed institutions. It publishes material on authorized push payment, instant payment, investment, romance and purchase scams and peer to peer fraud, alongside account takeover, remote access attacks, session hijacking, SIM swap, financial malware, money mules and new account fraud. Five components are published: the Behavioral Intelligence Platform; ScamFlag, a generative agent in the banking app that reads a screenshot a customer submits, checks links and account numbers against public sources and an internal database, and returns a scam assessment; Smart Insights for analysts; the Cyber Fraud Fusion Center for phishing and malware disruption; and FraudIntel for cross border scheme detection and intelligence sharing. Behavioral signal is sold as the inherence element for European strong customer authentication, with transaction risk analysis supporting the associated exemptions. Named customers include Ceska sporitelna, Slovenska sporitelna and Banca Comerciala Romana in the Erste Group, CSOB in the KBC Group, J&T Banka, Creditas, DFCU Financial, Tri Counties Bank and the Cooperativa Policia Nacional, and the company reports more than 40 million users protected. It states ISO 27001 and SOC 2 credentials. Founded in 2015 in Brno, ThreatMark lists its head office in Charlotte, North Carolina, with offices in Brno and London.

Wink authenticates people at the moment of payment rather than at account opening, combining face, palm and voice recognition into a biometric layer that can identify a customer from a population without a card, phone or password. It is distributed through payments infrastructure rather than sold direct, embedded in Fiserv's Clover point of sale, in SUNMI, WizarPOS, PAX and ID TECH terminals and in Elo kiosks, with on device processing at the edge in some deployments, and partners with Vouched to verify the humans behind AI agents. Alongside the biometric layer Wink operates its own payment gateway, which merchants can own or rent, states more than 220,000 merchants and 400 million transactions a month, and offers a zero chargeback guarantee backed by Riskified.