Visa’s $2.4B BioCatch Deal: Fraud Prevention Is Now a Profit Centre
Visa just paid $2.4 billion for software that watches how you type. That sounds creepy until you realise the alternative is letting AI-powered crooks eat your margins alive.
Visa Is Not Buying Fraud Software. It Is Buying the Moment Before Fraud.
Visa has just paid $2.4 billion in cash for BioCatch, a company whose core trick is watching how people behave on a screen.
How you type. How you swipe. How you hold a device. How you hesitate before sending money.
If that makes you slightly uncomfortable, good. It should. But it should also make you pay attention, because this is where the money is heading: not into cleaning up fraud after it happens, but into stopping it before the payment even exists.
On August 3, Visa agreed to buy BioCatch from Permira and other shareholders. BioCatch uses behavioural biometrics, device signals and machine learning to distinguish a legitimate customer from a scammer, an account takeover or a mule-account operation. Visa says the deal is part of a push to stop threats upstream, before they hit the payment rails. ([capitalbrief.com](https://www.capitalbrief.com/briefing/visa-to-buy-israeli-fraud-prevention-firm-biocatch-for-usd24b-8a85c940-84b7-4056-a1da-03c043751598/?utm_source=openai))
That is the actual story here. Not “Visa buys cybersecurity company.” That’s lazy shorthand.
The story is that the biggest payments businesses are being forced to become trust businesses. And trust is becoming a very expensive asset.
The $2.4 Billion Bet Is Bigger Than BioCatch
BioCatch was not some unknown startup with a slide deck, a hoodie and a dream.
It had surpassed $185 million in annual recurring revenue by the end of 2025, added more than $20 million of new ARR in the final quarter alone, and brought in 90 new customers during the year. The company said three of the four largest US banks by assets were using its technology. ([biocatch.com](https://www.biocatch.com/press-release/biocatch-finishes-2025-with-best-quarter-in-company-history?utm_source=openai))
At the purchase price, Visa is paying roughly 13 times BioCatch’s 2025 ARR. That is not cheap. Nor should it be.
People who only know how to compare price-to-revenue multiples will look at that number and start sweating into their spreadsheets. They’ll call it another AI-era overpayment. They may even be right if Visa treats BioCatch like a bolt-on product and lets it become another forgotten tab in an enterprise dashboard.
But Visa is not paying for a fraud dashboard. It is paying for a decision advantage.
The old fraud model was built around obvious signals: an unusual location, a suspicious IP address, a big transaction, a password reset or a dodgy device. Useful, sure. But criminals are not standing still while banks congratulate themselves for blocking a card in Romania.
Modern scams increasingly involve real customers, real devices and apparently authorised payments. A person gets manipulated by a fake bank representative, a cloned voice, a polished phishing message or an AI-assisted romance scam. The transaction looks legitimate because, technically, the victim initiates it.
That is the nightmare.
BioCatch’s value is in observing behaviour before and during that moment. A criminal may have the right password. They may have a clean device. They may even have convinced the customer to transfer the money. But they may not move through a banking session like that customer normally does.
That is a much harder problem to solve with a blunt rule engine. It is also a much more valuable problem to solve if you run the pipes through which money moves.
Visa Is Building a Moat Where the Fraud Happens First
Visa’s core payments network is a magnificent business, but it is not immune to pressure. Payments are getting faster. Account-to-account transfers keep growing. Stablecoins are no longer a joke you only hear from blokes at crypto conferences. Banks, fintechs and merchants want more than transaction processing; they want risk reduced, customers retained and losses prevented.
That is why “value-added services” matter.
A payment network that only charges a toll at the point of transaction is useful. A payment network that helps a bank identify fraud, authenticate users, protect accounts and stop a scam before money leaves is much harder to replace.
Visa has said it has invested more than $13 billion in technology and infrastructure to combat evolving cyber threats. The BioCatch acquisition gives it one more piece of that machinery — and a useful one, because it operates earlier in the chain than the transaction itself. ([capitalbrief.com](https://www.capitalbrief.com/briefing/visa-to-buy-israeli-fraud-prevention-firm-biocatch-for-usd24b-8a85c940-84b7-4056-a1da-03c043751598/?utm_source=openai))
This is what smart M&A looks like when it works: buy something that improves the economics of the thing you already own at scale.
Visa has distribution. It has bank relationships. It has transaction data. It has a global brand built on reliability. BioCatch brings behavioural intelligence and a specialised fraud-prevention product used by financial institutions around the world. BioCatch’s own platform is designed to detect account-opening fraud, account takeover, social-engineering scams and mule accounts. ([biocatch.com](https://www.biocatch.com/company?utm_source=openai))
Put those together properly and Visa doesn’t simply sell more software licences. It can make itself more central to a bank’s daily operations.
That is the prize.
Not a sexy product launch. Not a new app. Dependency.
Permira Has Just Been Given a Very Good Lesson in Timing
There is another part of this deal that founders and investors should study closely.
Permira bought a majority position in BioCatch in May 2024 at a $1.3 billion enterprise valuation. The firm had initially invested in 2023, then doubled down as BioCatch passed $100 million in ARR and reached EBITDA profitability. ([biocatch.com](https://www.biocatch.com/press-release/permira-acquire-majority-position-biocatch-1-3bn-valuation?utm_source=openai))
Roughly two years later, Visa has agreed to pay $2.4 billion.
That is about an 85% uplift on the 2024 valuation, before getting too clever about ownership percentages, fees, timing and the details of the cap table.
The lazy conclusion is that private equity got lucky.
The better conclusion is that Permira bought a company with three things buyers pay up for: a genuine category position, recurring revenue and an urgent tailwind.
Fraud is not a discretionary budget line. When the losses climb, the customer complaints pile up and regulators start asking questions, the purchase order gets signed. That doesn’t mean every cybersecurity business deserves a double-digit ARR multiple. Plenty are interchangeable, overmarketed or built around a single feature that Microsoft will bundle away in six months.
But a company with embedded bank relationships, proprietary behavioural data and workflow relevance is different.
That is a real asset.
The lesson for investors is simple: do not confuse a hot sector with a durable business. “AI security” is a theme. High switching costs, measurable ROI and a product customers use every day are a business.
BioCatch had evidence of that ROI. In one published partnership case, nearly 50 US financial institutions using the BioCatch-Lumin Digital setup prevented an estimated $46 million in fraud losses during 2025. ([biocatch.com](https://www.biocatch.com/blog/biocatch-and-lumin-digital-partnership-prevents-46-million-in-fraud-in-2025?utm_source=openai))
Again: that is the commercial point. If you can clearly demonstrate that your product saves a customer money, you are no longer begging to be called innovation. You are infrastructure.
The Overlooked Angle: This Deal Makes Privacy a Competitive Issue
Here’s the bit most deal coverage will skate past.
Behavioural biometrics can be incredibly useful. It can also feel like the digital equivalent of somebody watching over your shoulder while you use your banking app.
That tension matters.
The next generation of fraud prevention will require businesses to collect more signals, make faster risk judgments and increasingly decide whether a customer should be trusted before the customer understands what is happening. Done badly, that creates false positives, opaque decisions and a nasty customer experience for innocent people locked out of their own money.
Done well, it prevents devastation.
So the competitive advantage will not belong only to the company with the best model. It will belong to the company that earns enough customer and regulatory trust to deploy that model at scale.
That is why Visa’s purchase is more than a technology transaction. It is a governance transaction. Visa now has to prove it can turn sensitive behavioural intelligence into better fraud outcomes without becoming clumsy, creepy or careless.
There is no free lunch here. The more invisible the protection becomes, the more accountable the owner of that protection needs to be.
Why Founders Should Care — Even If You Never Touch Payments
I’ve built businesses and invested in plenty of them. The companies that get bought for serious money rarely win because they had the flashiest product. They win because they sit on a painful, recurring problem that a much bigger company cannot afford to ignore.
BioCatch did not try to become Visa. It solved a problem Visa increasingly needed solved.
That is a better strategy than trying to be everything.
Founders love talking about total addressable market. Fine. But acquirers care about something more practical: can this product become essential inside my existing customer base?
BioCatch had a clean answer. It could help banks and payment businesses reduce fraud earlier, protect customers better and make their existing systems more valuable.
That is strategic fit. Not vibes. Not “synergy.” Actual commercial logic.
What This Means for You
If you are a founder, ask yourself one blunt question tomorrow morning: what expensive problem do I solve before it becomes visible in the customer’s P&L?
If the answer is vague, your product is probably a nice-to-have. Fix that.
Build proof of value into the business. Track dollars saved, time removed, losses avoided, conversion improved or risk reduced. BioCatch is valuable because it can connect its product to a financial outcome. You should be able to do the same.
If you are an operator, stop treating fraud, compliance, cybersecurity and customer experience as separate departments with separate dashboards. They are becoming one operating problem. The customer who loses money to a scam does not care which team owned the failure.
And if you are an investor, be careful with the phrase “AI opportunity.” It is doing far too much work at the moment. Look for the business that owns unique data, sits inside a critical workflow, produces recurring revenue and has a buyer who gets stronger by owning it.
Visa’s $2.4 billion BioCatch deal is a reminder that the best companies do not merely sell tools. They sell certainty when uncertainty is expensive.
That is worth a lot of money. And, clearly, Visa agrees.