The payments industry’s brightest minds have built some of cybersecurity’s most sophisticated defenses around the moment money moves.
But artificial intelligence is now forcing it to look further upstream. Visa, for example, said Monday (Aug. 3) that it agreed to acquire behavioral-intelligence provider BioCatch for $2.4 billion in cash.
The deal would give the payments network access to thousands of signals generated during a customer’s digital banking session, including how someone types, handles a device, moves a mouse or navigates an application. Those details can reveal whether the person preparing to send money is a legitimate customer, an attacker who has taken control of an account, or even a genuine account holder being manipulated by a scammer.
BioCatch protects 760 million users across 1.8 billion devices and serves more than 350 financial institutions in 21 countries.
As financial activity moves from banking applications into AI-powered conversations and automated workflows, the same APIs that let consumers share financial data with budgeting apps, lenders and payments providers are now being connected to agents capable of interpreting that data and acting on it. The result is a powerful but uncomfortable tradeoff. Financial information is becoming more useful precisely as it becomes harder to contain.
That tradeoff was also visible behind Bank of America’s July 30 announcement of its own plans to acquire England-headquartered information security specialist MDSec Consulting Limited.
Bank of America is buying technical expertise. Visa is buying behavioral intelligence. Both moves suggest that financial institutions no longer view cybersecurity solely as a defensive utility that can be assembled from standardized external tools.
See also: AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away
Visa Buys the Signals Banks Need Before Customers Pay
Traditional payment fraud systems are generally designed to assess a transaction once it has been initiated. They examine information such as the amount, merchant, location, device and historical spending pattern, then determine whether the payment should be approved, declined or challenged.
This information matters because a growing share of fraud does not involve a criminal simply stealing a card number. Account takeover attacks can give fraudsters control of legitimate credentials and devices. Authorized push payment scams can persuade actual customers to approve transfers themselves. Money mule networks can use accounts that appear legitimate until behavioral patterns reveal unusual intent.
PYMNTS Intelligence collaborated with Visa DPS on “The Issuer Risk Playbook,” which found that 42% of bank and nonbank issuers rank fraud and disputes as either their biggest or second-biggest platform-related operating cost after employees. Roughly 60% of issuers across customer lifetime value tiers are either deploying or enhancing AI-powered card fraud detection and prevention, a sign that the capability is turning into a basic requirement of modern issuing.
The strategic implication is that payment security is becoming less about evaluating isolated transactions and more about continuously assessing whether a user’s behavior, identity and apparent intent remain trustworthy.
Read also: Frontier AI Finds Cracks in the Math Behind Bank Security
The Security Perimeter Is Moving Upstream and Coming Alive
AI is compressing the time between discovering a vulnerability and exploiting it. At the same time, financial firms are embedding data and payment capabilities into more third-party applications, APIs and automated systems. The attack surface is therefore expanding in both directions. Criminals can operate faster, while legitimate financial activity is becoming more distributed.
The PYMNTS Intelligence report “Scale Amplification: How Revenue Amplifies Agent-Driven Identity” showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities by adversarial fraudsters.
That changes the value of proprietary security capabilities. The institutions with the best view of user behavior, agent activity, device intelligence and emerging vulnerabilities may be able to identify risk before it appears in conventional transaction data. In an agentic financial system, trust cannot be established once at login. It will have to be recalculated throughout the entire journey from conversation to decision to payment.
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
