ThreatMark
ThreatMark builds a behavioral baseline for each banking customer and watches for departures from it, profiling how a person physically uses a device, keystroke rhythm, navigation habit, touch and pointer movement and session pattern, and combining that with device and threat signals and transaction context into one continuously updated view it calls behavioral intelligence.
Its stated premise is that the fraud that matters has moved off the bank's platform: criminals now manipulate the customer into authorizing the payment, which defeats controls built to detect unauthorized access, and its own research puts social engineering in most fraud at 55 percent of surveyed institutions. It publishes material on authorized push payment, instant payment, investment, romance and purchase scams and peer to peer fraud, alongside account takeover, remote access attacks, session hijacking, SIM swap, financial malware, money mules and new account fraud.
Five components are published: the Behavioral Intelligence Platform; ScamFlag, a generative agent in the banking app that reads a screenshot a customer submits, checks links and account numbers against public sources and an internal database, and returns a scam assessment; Smart Insights for analysts; the Cyber Fraud Fusion Center for phishing and malware disruption; and FraudIntel for cross border scheme detection and intelligence sharing. Behavioral signal is sold as the inherence element for European strong customer authentication, with transaction risk analysis supporting the associated exemptions.
Named customers include Ceska sporitelna, Slovenska sporitelna and Banca Comerciala Romana in the Erste Group, CSOB in the KBC Group, J&T Banka, Creditas, DFCU Financial, Tri Counties Bank and the Cooperativa Policia Nacional, and the company reports more than 40 million users protected. It states ISO 27001 and SOC 2 credentials. Founded in 2015 in Brno, ThreatMark lists its head office in Charlotte, North Carolina, with offices in Brno and London.
Capability Axes
Capability grades
15 of 15 axes rated · 5 graded A or B
A per person baseline learned from keystrokes, navigation and device handling, updated continuously, flags when someone types and scrolls unlike themselves, which no rule can express. Its ScamFlag agent is generative, reading a screenshot and reasoning about context, and without models only device fingerprinting and threshold rules, the approach it sells against, remain.
Scores surface for fraud analysts, Smart Insights supports their decisions and ScamFlag returns recommended actions for the customer to choose, while transaction risk analysis steps up authentication under the bank's own policy. That boundary is inferred from product shape rather than stated, and what a customer can do when a legitimate payment is blocked is not described.
ScamFlag is put at about 99 percent detection accuracy, conditioned on evidence quality, but no false positive rate is published, though here a false positive is a locked out customer. False positive reduction is marketed without a figure, and validation method and drift disclosure are absent.
Jan Adamovsky of Slovenska sporitelna reports detection 70 percent better than competing products in its test, Teo Filip of Ceska sporitelna cites account takeover damage cut by more than 90 percent, and Tipsport's detection time fell from 16 hours to 20 minutes. QKS Group's 2026 SPARK Matrix names it a leader in behavioral biometrics, and one testimonial claims zero losses.
FraudIntel shares intelligence across banks to expose mule networks, so one bank's customer signal informs another's defenses, with nothing on what crosses or in what form. Whether behavioral profiles train models for other customers is not stated either.
Privacy and cookie policies are published, and ScamFlag images are stored securely and deleted automatically after a set period. Neither the legal basis for continuously capturing how a person physically uses a device, likely biometric data under European law, nor the retention of behavioral profiles is addressed.
ISO 27001 certification and a SOC 2 attestation are stated in text, with a versioned code of conduct, a whistleblower page and a security contact for vulnerability reports. A trust center and the SOC 2 type, period and scope are not published.
Behavioral signal is sold as the inherence element for European strong customer authentication, and a Creditas executive says central bank auditors responded positively. No position is stated on the EU operational resilience regime or the AI Act, and no license is claimed.
Flagging departures from how a person holds, taps and types will also flag a hand tremor, failing eyesight or a carer helping an elderly parent, which looks like someone else operating the session. Elderly and disabled customers, the people its scam tools exist to protect, are likely to bear those false positives, and no breakdown by age or impairment is published.
Terms of service, warranty, indemnity and liability cap are all unpublished, and the policies that are published allocate no risk to ThreatMark. When it wrongly decides a customer is not who they claim, that customer is locked out or a legitimate payment is blocked.
Trained on scam samples, the ScamFlag agent checks links against public sources and its own database, but no model provider, family or version is named. Customers upload screenshots of private conversations, and whether those images stay in ThreatMark's environment or reach a third party model is not stated.
Capture of behavior must sit inside the bank's web and mobile channels and ScamFlag embeds in banking apps, yet no API documentation, SDK reference or sandbox is published. Which digital banking platforms are already supported is not named.
Deployment model, hyperscaler, region and residency go unstated, and offices in three countries describe staff locations, not data. FraudIntel's cross border detection implies behavioral data moving between jurisdictions by design.
Five components are described separately, but no price, tier, unit or term is published, and entry is a contact form. Charging by protected users would track a bank's book while charging by transactions tracks activity, and which applies is not said.
Universal banks, challenger banks, mutuals and community institutions are named across Europe, the United States and Ecuador, with material for security, fraud and digital channel teams. The base centers on central and eastern Europe, and insurance, wealth and payment institutions get no material.
Alternatives to ThreatMark
Vendors in the same categories as ThreatMark whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
Cybera sells banks, crypto platforms and cyber insurers two products aimed at authorized payment scams.
Fraudio is an Amsterdam company founded in 2019 by João Moura and Nathan Trousdell, both from the payments industry, selling fraud and financial crime detection to the payment chain rather…
Accertify is an enterprise fraud prevention and payments company based in Itasca, Illinois, and led by president Mark Michelon.
Sift, formerly Sift Science, sells fraud decisioning to business to consumer digital companies.
Coris supplies merchant risk infrastructure to the parties that underwrite merchants rather than to merchants themselves, covering software platforms with embedded payments, independent…
Incognia answers the identity question with geography.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
Not published. No price, tier, unit or contract term is shown; engagement starts with a contact form.
|
Quoted per customer. Five components are described separately, the Behavioral Intelligence Platform, ScamFlag, Smart Insights, the Cyber Fraud Fusion Center and FraudIntel, with no indication of whether they are licensed as one platform. ThreatMark states more than 40 million users protected across its customers, a scale figure rather than a price. | Not tiered on any published pricing. ThreatMark publishes a privacy policy, a cookie policy, a versioned code of conduct and a whistleblower channel, and states that images submitted to ScamFlag are deleted automatically after a set period. Nothing addresses the legal basis for continuous behavioral collection, retention of behavioral profiles, or what FraudIntel shares across institutions, and no data processing agreement, sub processor list or hosting location is published. It states ISO 27001 and SOC 2 credentials. | No implementation, integration, onboarding or professional services fee is published. Behavioral capture requires an embed in the bank's web and mobile channels, and ScamFlag integrates into existing banking apps, so the work sits in the bank's own release cycle. The Cyber Fraud Fusion Center reads as an ongoing managed service, and nothing says whether it is bundled or charged separately. | Vendor Published |
ThreatMark publishes no price, tier, unit or term as of 2 October 2026, and its entry route is a contact form to sales. Two plausible bases would bill very differently: protected users tracks the size of a bank's retail book whether customers transact or not, while transactions tracks activity, and nothing published says which applies. Nothing indicates whether its five components are licensed together or separately.