Featurespace

The removal test leaves nothing at all. The company began as machine learning research in a university engineering department and the product is the model: Adaptive Behavioral Analytics builds a behavioural profile for each individual customer, Automated Deep Behavioral Networks extend it across peer groups and scam patterns, and the system is described as adapting by itself to changing behaviour and new attack types.

There is no rules engine, case management system or data platform underneath that would survive the models being taken out. The design premise is itself model dependent, since profiling what normal looks like for a specific person and detecting deviation from it cannot be expressed as static rules.

The boundary is described concretely in a deployment rather than asserted in policy. Every payment is evaluated in real time, and where a payment is judged suspicious the system tells the bank to stop it and flags it as suspicious so it can be investigated further, which places the machine on the recommendation side and an identifiable institution on the decision side, with a named investigation step after the flag.

That is a clear division for a product operating at full transaction volume. What is missing is the specificity Federato publishes: no threshold at which a payment is held automatically rather than flagged, no sampling or audit of decisions the model made without escalation, and no statement of how a stopped payment is released once investigated.

This vendor publishes numbers in both error directions, which almost nothing else in this index does. On the detection side a named institution reports a 90 percent reduction in phishing losses year on year. On the false positive side the company has published that false declines of genuine customers reduce by up to 70 percent, which is the cost most fraud vendors leave entirely unmeasured, and it matters because the two objectives trade against each other.

The mechanism is also described in enough detail to be interrogable, with profiling of past, current and projected customer actions and peer group comparison named as distinct components. What is absent is the formal package: no validation documentation, no model risk artifacts for an institution's own validators, and no statement of how a self adapting model is revalidated as it changes.

Named institutions with quantified per customer outcomes, which is the standard this axis sets and few reach. Eika Gruppen, an alliance of 46 Norwegian banks, deployed ARIC across every payment initiated through online and mobile banking and recorded a 90 percent reduction in phishing losses in 2024 against 2023, with its chief architect quoted on the record. NatWest implemented the platform for enterprise wide transaction monitoring and payments fraud detection in 2020.

Other named deployments include a major card processor and a payments scheme. The platform is stated to be deployed to organisations operating in more than 180 countries, and a historic published figure claims false declines of genuine customers reduced by up to 70 percent. Fifteen years of operation and acquisition by a global payments network are corroboration of a different kind: a strategic buyer with the expertise to test the technology examined it first.

The models are described as self learning and adapting by themselves, and no boundary statement was located. The pre acquisition question was already open, since a platform learning fraud patterns across banks in 180 countries plainly benefits from breadth, and nothing states whether one institution's fraud experience informs models serving another. The acquisition sharpens it considerably.

Published material describes integrating the platform's approach with the acquirer's global network intelligence into a single unified framework, which is an explicit statement that data from outside the customer relationship enters the model, and no account is given of what flows in which direction, what an institution's own data contributes to the shared layer, or whether participation is optional.

No data protection agreement, retention schedule, subprocessor list or deletion commitment was located, and the payload is among the most intrusive in this index by design. The platform builds a persistent behavioural profile of each individual customer covering how they spend, where they log in from and when they typically transact, and scores every payment against it.

The acquisition adds a second layer, since the stated direction is integrating behavioural data with the acquiring network's global network intelligence, which means profiles built for one institution's customers sit alongside network level transaction data about the same people. Nothing published describes what is combined, what is retained or what the customer is told.

No attestation, certification, trust centre or enumerated framework was located in vendor material. As with Zeta, the certifications almost certainly exist, because a platform scoring card transactions inline for acquirers and processors could not operate without payment card industry attestation and its parent operates under that regime globally, but nothing is published where a prospective buyer can read it. The grade reflects disclosure rather than a judgement that controls are absent.

One regime is named and addressed as a dedicated product rather than a talking point. ARIC Scam Detect exists specifically for authorised push payment scams, identified as the fastest growing fraud type globally, which is the reimbursement liability shift that reallocated scam losses onto payment firms and created this market segment.

The platform also operates inside enterprise transaction monitoring at a systemically significant bank, which sits in the anti money laundering supervisory path. Against that, no supervisor, statute or guidance instrument is named anywhere, and the payment card industry obligations that necessarily apply to a processor scoring card transactions are not addressed in located material.

The accessibility finding recorded for BioCatch applies here in its strongest form, because the mechanism is the same and the scale is larger. A system that flags deviation from an individual's established behavioural baseline will flag most often the people whose behaviour legitimately changes: the elderly, those experiencing cognitive change or illness, those recently bereaved or relocated, those travelling, and anyone whose circumstances shift.

The Norwegian deployment makes the tension explicit, noting that phishing attacks primarily target elderly customers, so the population the product protects is also the population most likely to trigger it wrongly, and a blocked payment for that customer can mean an unpaid bill or an inability to move their own money. Nothing published addresses demographic error rates, accessibility, or how a customer repeatedly flagged for legitimate behaviour is handled. Third instance of this finding after BioCatch and Reality Defender.

No guarantee, indemnity or falsifiable commitment binds the vendor to its output. What sits above the floor is a described human path that reaches the affected customer indirectly: a suspicious payment is flagged for investigation rather than silently cancelled, so a wrongly stopped payment has a route back through a person at the institution.

The limits are that the route is the bank's rather than the vendor's, nothing describes how long an investigation takes or how a customer learns why their payment stopped, and no mechanism exists for a customer repeatedly flagged by their own behavioural profile to have that profile corrected. The person scored has no relationship with Featurespace and no way to see or contest the profile held about them.

The core is unusually short and clearly stated: the analytics are proprietary and were developed from the company's own university research, with Adaptive Behavioral Analytics and Automated Deep Behavioral Networks named as its own techniques rather than assembled from third parties, which forecloses the foundation model question that dominates this axis elsewhere.

The acquisition adds a named external input rather than obscuring one, since published material states the direction is combining the platform with the acquiring network's global network intelligence, so the most significant third party data source in the chain is identified. What is not disclosed is the mechanics: no subprocessor list, no hosting arrangement, and no statement of what network data enters a given institution's model or on what basis.

The integration position is deep at the point that matters, since the platform sits inline on payment initiation and scores every transaction submitted through online and mobile banking in real time, which requires connection to the institution's payment path rather than to a reporting layer. Deployment across an alliance of 46 banks and inside a systemically significant institution demonstrates it works against very different technology estates.

What is not published is any named integration: no core banking platform, payment hub, case management or fraud operations system appears anywhere, and no developer documentation or interface reference was located, so a prospective buyer cannot establish what connecting it involves.

No hosting model, cloud provider, region selection, residency commitment or on premise option was located. That gap is material at this footprint: a platform deployed to organisations operating in more than 180 countries and holding individual behavioural profiles for retail bank customers crosses many data localisation regimes, and the European deployments in particular sit under transfer rules the published material never mentions. Acquisition by a network with its own global processing infrastructure raises the question again rather than settling it.

No pricing, packaging or basis of charge is published, and the acquisition has made the question harder rather than easier. The platform is now offered inside a payment network's value added services portfolio, where pricing is typically negotiated as part of a broader commercial relationship, so an institution cannot establish what the fraud capability costs on its own terms or whether adopting it is bundled with other network services. Nothing addresses whether charging is per transaction scored, per protected account or as a platform fee.

The buyer set spans banks, acquirers, payment processors and financial institutions generally, and the deployment footprint reaches organisations operating in more than 180 countries. Coverage is deep as well as wide: the platform scores card fraud, payment fraud, account takeover and authorised push payment scams, and the Norwegian deployment demonstrates it operating across every payment initiated through online and mobile banking rather than on card rails alone.

It reaches both very large single institutions and alliances of small community banks buying collectively, which are different procurement shapes. Distribution through a global payments network now extends the addressable base further.