🧠 BioCatch — How Banks Detect Fraud With Behavioural Biometrics

Sunday, 02 August 2026

BioCatch is a fraud-detection platform used by major UK banks. It watches how you interact with your banking app — your typing rhythm, mouse movements, even how you hold your phone — to spot when a fraudster has taken over your account.

You've probably been protected by it without ever knowing. This guide explains how it works, what it tracks, and what it means for your privacy.

What is BioCatch?

BioCatch is a cybersecurity company that provides behavioural biometrics to banks. Instead of checking what you type, it checks how you type. It builds a unique "behavioural profile" of each customer, then flags when the person using the account doesn't match it.

It's used by banks worldwide — including many of the biggest UK high-street banks — to detect:

Account takeover — a fraudster logging in with stolen credentials
APP fraud — the victim being manipulated into sending money
Scam calls / vishing — the customer behaving unusually while on a call with fraudsters
Malware — automated bots acting differently from humans

How it works

When you use a banking app, BioCatch quietly analyses hundreds of signals:

Signal	What it reveals
Typing speed and rhythm	Your unique keystroke pattern
Mouse/touch movements	How you scroll, tap, and navigate
Device angle and pressure	How you hold the phone
Time of day patterns	When you normally bank
Copy-paste behaviour	Fraudsters paste stolen details
Session anomalies	New device, VPN, unusual location

It compares each session against your established profile. If something is off — but not off enough to block you — the bank can:

Step up verification (ask extra questions, a one-time code)
Slow the transaction to check
Alert a fraud analyst to call you
Block the payment if the risk is high

Why banks use it

Traditional fraud checks look at what you do (login location, device, amount). Behavioural biometrics add how you do it. That matters because:

Stolen credentials are everywhere (data breaches) — knowing the password isn't proof of identity
Fraudsters are fast — automated transfers happen in seconds
Victims are often coached — during vishing calls, the victim behaves differently (reads out codes, hesitates, types oddly), and the bank can spot it in real time

What it means for your privacy

This is the trade-off, and you should know it:

It's behavioural, not biometric identity — it doesn't use fingerprints, faces, or voice
It runs in the background of your banking app — you can't opt out while using the app
Data is typically pseudonymised and used for fraud prevention, not advertising
Banks must comply with UK GDPR — behavioural data is personal data and protected
It stays inside the bank's fraud systems — it's not shared with random third parties

If you're concerned, check your bank's privacy policy for "behavioural biometrics" or "fraud analytics" — banks are required to explain what they collect and why.

The real-world impact

BioCatch-style systems have helped banks:

Stop APP fraud in progress — flagging a customer being coached by a scammer
Catch account takeovers before money moves
Reduce false declines — genuine customers get blocked less

It's one of the reasons banks now recover more scam payments — and why fraudsters keep inventing new tricks.

Does it help you get money back?

Sort of. If your bank's fraud systems failed to stop a scam, the APP fraud rules still protect you — see how to get your money back after a scam. Behavioural detection is the bank's first line of defence; the refund rules are the safety net.

Protect yourself regardless

Don't rely on the bank's systems alone:

Never share one-time codes — the #1 thing fraudsters need
Use app-based 2FA where offered
Check your bank app regularly for unfamiliar devices or sessions
Be suspicious of calls from "your bank" — see our scam call guide
Report scams fast to Action Fraud

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.