Beyond the password: Why behavioral biometrics is becoming banking’s last line of defense

By Divija Vijaya Ganiga, IEEE Senior Member

A fraudster does not need to break down the door if they already have a working copy of the key.

That is the uncomfortable reality behind account takeover fraud, commonly known as ATO. It also explains why ATO losses continue to rise even as multi-factor authentication becomes standard across the financial industry.

The numbers make the seriousness of the problem clear. The 2025 AFP Fraud and Control Survey reported that 79% of organizations experienced actual or attempted payments fraud during 2024. Among organizations that lost funds, 20 percent recovered none of the money. More than one million identity theft cases were also reported in the United States in 2024.

The market is responding accordingly. Estimates suggest that global spending on behavioral biometrics could reach approximately $3.4 billion to $4.0 billion in 2026, with the market growing at an annual rate of roughly 25% to 28%. Banking and financial services represent the largest end-use segment, accounting for close to 44% of the market, while fraud detection remains the leading application at approximately 42%.

The industry has clearly recognized that the problem is serious enough to require significant investment. The more important question is where these defenses should operate within the transaction lifecycle. Although deepfake-enabled attacks and AI-driven scams are increasing, only 17% of finance teams currently use AI for fraud prevention, largely because of implementation costs and infrastructure limitations.

The gap between “valid” and “you”

Over the past decade, financial institutions have strengthened authentication through passwords, one-time passcodes, device fingerprinting, and multi-factor authentication.

These controls are effective at answering one question:

Does this person possess valid credentials?

They are far less effective at answering a second and more important question:

Is this the person who is supposed to be using them?

A public J.P. Morgan Payments article on account takeover captured this distinction clearly: authentication may confirm that someone has the key, but it does not necessarily confirm who is using it or why.

The article also described how J.P. Morgan’s Payment Control Center applies behavioral monitoring to factors such as payment velocity, transaction timing, beneficiary history, and payment amounts. These signals can help identify anomalies after authentication but before funds are transferred.

This represents an important layer of protection and reflects the broader industry shift toward behavior-based fraud controls. However, it also highlights a remaining blind spot. Payment-pattern monitoring can identify suspicious behavior when money is about to move, but it may not detect a compromised session at the moment it begins.

Closing the gap at the point of login

This is the gap I have focused on through my research and inventive work continuously verifying identity from the moment of login using behavioral biometric signals such as keystroke dynamics, mouse movement patterns, and session interaction behavior.

Rather than relying exclusively on a one-time authentication check, my patented method establishes a behavioral baseline for a legitimate user and identifies deviations from that baseline in real time. Monitoring begins during login and continues throughout the session, potentially identifying a fraudulent actor before they reach the payment stage.

This approach is not intended to replace transaction-level monitoring. It is designed to operate as an additional layer in front of it.

Credentials can be stolen through phishing, SIM swapping, session hijacking, or other attacks and still pass conventional authentication checks. Once inside an account, however, a fraudster’s behavior rarely matches that of the legitimate user. The way a person types, moves a mouse, navigates an application, or interacts with account features can create a distinctive behavioral pattern.

Detecting a mismatch early at the session level reduces the attacker’s window of opportunity before the activity reaches a payment-control system.

I have also studied the related challenge of protecting the AI systems increasingly used to perform fraud detection.

In a peer-reviewed IEEE conference paper (Defensive Architectures for LLM-Based Fraud Detection Against Data Poisoning and Prompt Injection), I proposed a resilient defensive architecture for large language model-based fraud detection systems. The research addresses a different but connected vulnerability: adversaries manipulating the data or prompts used by AI models through methods such as data poisoning and prompt injection.

These attacks could weaken or misdirect the systems designed to detect fraud. As financial institutions rely more heavily on large language models for fraud triage, case investigation, and decision support, protecting the detection system itself is becoming as important as improving the underlying detection logic.

Why layered behavioral defense matters now

These developments are not taking place in isolation.

Major payments companies have already invested significantly in behavioral biometrics. Mastercard’s acquisition of NuData Security in 2017 represented a direct investment in session-based and behavioral signals as tools for fraud prevention. Companies such as BioCatch have built their businesses around the same principle.

This level of investment from some of the largest organizations in the payments ecosystem sends a clear message: behavioral analysis is moving beyond a specialized research area and becoming an important part of financial-security infrastructure.

The challenge the industry has not yet fully solved is how to connect these layers into a single, continuous chain of trust. That chain should include behavioral verification at login, behavioral monitoring during transactions, and resilient AI systems supporting both.

Any gap between these layers creates an opportunity that a patient and sophisticated attacker may be able to exploit.

As AI gives fraudsters new tools to test stolen credentials at scale and imitate legitimate behavior more convincingly, financial institutions will need to move beyond the idea of authentication as a single gate.

Identity should instead be treated as something that is continuously verified, from the first keystroke to the final payment approval.

The views expressed in this article are the author’s own and do not necessarily reflect those of her employer.

About the author

Divija Vijaya Ganiga is a Senior Member of IEEE and a researcher in AI-driven financial security. Her work includes published Indian Patent Application No. 202641014348, titled “System and Method for Automated Fraud Detection Using Generative Artificial Intelligence Model.” The proposed architecture combines behavioral fingerprinting, transaction context, agentic AI, and generative AI to support interpretable fraud-risk assessment. She has also published peer-reviewed research on defensive architectures for large language model-based fraud-detection systems.

Her research was recognized with the AI in Finance & FinTech Innovation Award at DASGRI 2026, hosted by Goldsmiths, University of London.

Article Topics

AI fraud  |  banking  |  behavioral analysis  |  behavioral biometrics  |  biometrics  |  financial services  |  fraud prevention  |  IEEE