BioCatch

Behavioral and device signals from 20 billion sessions a month feed inference about hesitation, confusion and coercion, and about how mule accounts are run. DeviceIQai, launched in March 2026, separates human, hybrid and AI agent sessions and spots deepfakes fed through virtual cameras. Strip the models out and only raw telemetry would be left.

BioCatch scores and the bank decides. Fraud teams write rules on the score in Rule Manager and test them first in a Rule Simulator, review sessions in Analyst Station and investigate in Fuse, and the Push API lets them build their own responses. No score threshold is stated, and no route is described for revisiting a customer wrongly flagged as a mule.

Each session gets a risk score from 0 to 1,000, and banks send fraud and genuine verdicts back through the Truth Marking API to tune it. Mule accounts are sorted into a five persona taxonomy that separates willing participants from coerced victims. No model documentation, validation summary or detection rate outside named case studies is published, and model calibration is sold as a support service rather than described.

NAB stopped a $40,000 scam and cut remote access fraud losses by 40% between fiscal 2022 and 2023, according to its head of detection and intelligence, Josie Francese. Itaú reports up to 50% fewer fraud disputes. BCU, a credit union, reports Zelle fraud down by up to 95%, with monthly losses falling from $80,000 to under $10,000. Wells Fargo joined as a customer in January 2026, when the company also reported annual recurring revenue above $185 million.

BioCatch Trust shares behavioral risk signals between participating banks without sharing personal data, and DeviceIQ draws on device signals seen across banks. The data processing addendum lets BioCatch make data non identifiable and treats aggregated data as outside the bank's data. Nothing says whether one bank's sessions train models that score another bank's customers, and inferring confusion or coercion is more sensitive than fingerprinting a device.

A public data processing addendum makes the bank the controller and BioCatch the processor, requires the bank to tell its customers about BioCatch, and returns or deletes data at termination with one copy kept for legal reasons. The website privacy policy still covers only site visitors and business contacts, not the people whose sessions are scored. The addendum's subprocessor and security schedules are published as titles with no content, and no retention periods are given.

BioCatch's trust page names SOC 2 Type 2 and ISO 27001 alongside GDPR, and describes encryption, hashed account identifiers, data masking and role based access. No report or certificate can be opened without asking, and no trust portal is published. Its data processing addendum promises breach notice within 48 hours and allows a customer audit once a year.

Strong customer authentication is sold against PSD2 and PSD3, with one time password profiling and 3D Secure checks, and scam detection is pitched at the UK's scam reimbursement rules. No certification or regulator opinion is cited for the authentication product. A fraud advisory board formed in November 2026 includes former tax and anti money laundering officials. Visa's pending acquisition will change the contracting entity once it completes.

Typing rhythm, hesitation and navigation fluency vary with age, motor impairment and assistive technology, so behavior read as unusual can fall harder on older and disabled customers. A legacy feature predicts a user's behavioral age and compares it with the declared age. Nothing is published on accessibility, demographic error rates or fairness testing.

Analyst Station lets a fraud team review the session behind a flag, and the Insights Query Engine gives a bank its own BioCatch data in Snowflake, so a wrong flag can be investigated. Nothing stands behind the score itself. Customers whose payments are held or accounts closed as suspected mules are not told their behavior was scored, and no correction route reaches them.

Signals come first hand from the bank's own channels through BioCatch's SDK and go to BioCatch servers running on Microsoft Azure and Google Cloud, with BigQuery and Vertex AI named for analysis and Snowflake holding query data. No model provider is named for the AI written case summaries added in late 2025. The subprocessor schedule in its data processing addendum is published as a title with no list.

Alkami, Lumin Digital, Q2 and Tyfone are named digital banking partners, and more than 70 community banks and credit unions came to BioCatch through Alkami. Nasdaq Verafin takes BioCatch alerts and scores into its platform under a September 2025 partnership, and Alloy joined as a partner in January 2026. An Azure Marketplace listing lets banks spend Microsoft commitments on it. The getScore, Push and Truth Marking APIs are named, but no public developer documentation is published.

The SDK sends session data to BioCatch servers on Microsoft Azure and Google Cloud. The privacy policy says information may be stored and processed in any country where the company has facilities or staff, and the data processing addendum has the bank consent to transfers worldwide under standard contractual clauses. No hosting region, residency option or on premises deployment is published.

Contact requests stand in for any published price. Whether billing follows sessions, users or transactions is not stated.

Retail banks are the core, with community banks and credit unions reached through Alkami, and fintech and payments customers such as Nequi and Onbe. A Q3 2026 fact sheet counts 415 financial institutions in 21 countries. Branch, call center and in person origination sit outside a product that watches digital sessions.