BioCatch Reviews

In my current role at TD Bank, I work for banking clients, where we worked on integrating BioCatch behavior biometrics, enhancing fraud detection during high-risk user sessions. We use BioCatch SDK on the front-end side. Currently, I work as a full-stack developer. On this project, we use BioCatch SDK on the front-end side to capture behavioral signals such as typing rhythm and navigation habits, and we send this data to BioCatch platform, which generates a behavioral risk score in real-time. When it comes to the back-end side, we use Java Spring Boot and Node.js. We built APIs to consume their scores and feed them into our risk engine based on a risk level, where the system triggers additional verification such as MFA, multi-factor authentication, step-up authentication.

I have worked with the behavioral authentication feature in BioCatch, where the user interaction is based on how they interact. Instead of relying only on passwords such as OTPs or biometrics such as fingerprints, BioCatch authentication uses behavioral signals collected from user sessions, including movement, touch gestures, scrolling, and hesitations. We also use this authentication decision where in the back-end risk engine, it consumes the scores and makes decisions for MFA or blocking the same user coming multiple times.

Terrestrial steps involve keystroke dynamics, checking typing speed, rhythm, pressure, and holding intervals. Next, we utilize pointer movement to check mouse cursor speed, acceleration, and patterns. We also analyze touch and gesture patterns on mobile devices, checking swipe speed, direction, and pressure. As the next step, we perform navigation checks, where we order the pages visited and the time spent on those pages. Lastly, we examine session levels, including session duration, idle time, and page transition timing, covering the complete login, transaction, and profile updates.

The best features of BioCatch include analyzing how users interact and creating unique profiles for each user, which is what I appreciate most. The real-time risk scoring is impressive. It generates a behavioral risk score from 0 to 1,000 for each session in milliseconds. It also enables real-time decisioning for approving, challenging, or blocking transactions. In my banking domain, it blocks transactions in real time as well. It recognizes the same user behavior across different channels - not only on mobile but also on web or tablet. Supporting multi-channel banking platforms is one of the significant benefits.

On the security measures side, having cross-device functionality helps. Regarding blocking to the user side for fraud prevention, BioCatch never collects any personal information. It only collects behavioral telemetry such as mouse movements and touch gestures, and the data sent to BioCatch is tokenized before every transmission. All communications between the client SDK and BioCatch and the back-end side are fully encrypted using HTTPS or TLS 1.2 encryption. For authorization controls, we currently use OAuth 2.2 for back-end integration with JWT tokens for API keys, and for secure SDK integration, we load only on specific trusted web or mobile pages.

The main benefits I have seen from using BioCatch are its detection of account takeover and bot attacks in real time. There is also a smooth and frictionless customer experience where the customer experiences a smooth login and transaction process. It provides good behavioral risk scores and risk indicators for each session. It also integrates with fraud or authentication engines, and with multi-channel and cross-device coverage, it works across web, mobile, or tablet platforms. It gives an adaptive and continuous learning experience and is privacy-friendly. Overall, it captures every behavioral signal, not only personal identifiable information, but it helps meet different GDPR compliance requirements.

We experienced some stability issues including API latency, SDK initialization failures, and session ID correlation. We mitigated these by synchronous SDK loading, monitoring API performance, ensuring fallbacks for unsupported devices, and regular session validation. Load testing and error logging also help maintain reliability at scale.

Currently, I do not have anything to say on present features of BioCatch because we use it frequently but have not explored it completely. As a Java developer, I work on both front-end and back-end. If something could be developed in BioCatch, I see potential in how users interact with devices, such as typing patterns. Also, integration-friendly aspects, such as the lightweight SDK for web, native, and iOS and Android SDKs, along with continuous authentication, real-time risk scoring, and multiple fraud detection models such as account takeover and bot detection, would be beneficial. It could work across web and mobile platforms while maintaining privacy and compliance.

I have been working with BioCatch for the last three years.

We experienced some stability issues including API latency, SDK initialization failures, and session ID correlation. We mitigated these by synchronous SDK loading, monitoring API performance, ensuring fallbacks for unsupported devices, and regular session validation. Load testing and error logging also help maintain reliability at scale.

Based on my experience, I would rate the stability around 8 to 8.5 on a scale of 1 to 10.

When it comes to scalability, the limitations of BioCatch depend on the usage, but as we continue using it, it remains good. BioCatch 2.0 release achieves risk score calculations in under 500 milliseconds. The platform captures thousands of behavioral data points such as keystrokes and device interactions for comprehensive fraud detection. However, to maintain optimal performance, it is crucial to implement best practices.

Regarding tech support for BioCatch, I do not recall escalating any questions. For managing support issues, we need to open new cases, track existing ones, and review ticket history. We also access knowledge resources such as release notes, deployment guides, and customer success materials occasionally.

Positive

I have not used any other solution of the same kind; I am exclusively using BioCatch.

I was not part of the initial setup when BioCatch was introduced because currently, I work as a contractor. They hired me in the middle of the project, so I was not part of any authentication setup from the beginning. I would appreciate the chance to work on BioCatch from scratch, but I have not gotten that opportunity yet.

For the onboarding process, they recruited me for the coding round. They sent me an assessment link with multiple-choice questions and one coding challenge using an online tool for the assessment. This was followed by a direct interview.

Regarding the pricing, I think I heard it is a subscription-based model, where the number of accounts or channels covered impacts the cost, usually per active or per user session.

It is cost-effective. We use BioCatch extensively. From my experience, especially in banking, where we deal with complete user-facing platforms 24/7, BioCatch is vital for authentication, such as MFA or step-up authentication. So for me, it is totally a cost-effective option.

I do not have any answer for evaluating other solutions. Rather than alternatives to BioCatch, I have heard there are some competitors, such as Zighra and SecureTouch for biometrics and authentication, but I never worked with them. I only have experience with BioCatch.

There is always something we could learn more with BioCatch. So far, I do not think I am 100% fully experienced in BioCatch, but if I could get the chance to work entirely on it, there are undoubtedly things we need to learn every time. I want to take a deep dive into the system. I feel I am almost there to learn everything.

For assessing the value of behavioral insights in fraud detection and prevention, we use a variable in code, for example, from a JSON response or JavaScript object. We also access a BioCatch risk score from API response. Once we specify which value we are assessing in real time, if we are on a call, I can show you exactly how to access it with an example in Java, Node.js, or front-end side, where we use this variable value in code.

My advice for using BioCatch effectively would be to start with piloting, ensuring the SDK loads efficiently in the UI, and to monitor session integrity closely. It is better to combine behavioral biometrics with other security layers, such as device fingerprinting, and to actively use risk indicators to guide fraud detection decisions. Finally, it is vital to balance security with customer experience for authentication, especially when the risk is high.

I rate BioCatch 10 out of 10.

The solution is primarily used for the account opening fraud journeys in retail banking and it's for the client account side. The use case was for catching any account opening fraud as the client, a bank, was losing a large amount of money previously. They had been opening accounts and suffered from a lot of financial crime. The bank wanted to catch bad behavior from potentially shady customers. Specifically, the solution was used to catch the fraudulent behavior of all kinds.

When I working with the solution, the tool was being implemented, and therefore, there were no stats readily available to prove the business benefit. That said, so far, other implementations in BioCatch supply a lot of business benefits at the financial institutions or the other institutions. They've typically been able to effectively reduce fraud. I don't have any score numbers on the top of my head, however, anecdotally, it's been quite effective.

One thing the customer behavior tracks is keyboard strokes and the specific shares along to go around with the BT level to catch the users of the function key and other special characters. It can track mouse movements as well as the actual oriental moments of such as the movement of devices, how they are held, and the angles which at they are held. All these are captured for customers and a behavioral profile is built for the customer over a period of time. This would be matched against any fraudulent behavior. If, for example, suddenly a customer account seems to be accessed by our profile, which is not one particular customer account, if the movements or habits are suspect, we can catch the fraud and shut it down.

The behavioral biometrics are the core of the solution. All the moments I've just spoken about, are valuable each of those movements is assigned a score and there is a range of the score, which can be fine-tuned to make a decision to say, if the score is out of a certain range, then it could be a fraud and the total sum of all these behavioral moments will come up with a decision making score and that is fed into another fraud mitigation tool within the banks.  Typically, the information is sent to ARIC, which is the decision-making unit, and it will decide whether or not to allow this particular transaction or the account opening application to go through.

BioCatch is one of the fraud detection tools which also has machine learning capabilities and it has what is called a machine learning model feature. It is run in the background. The consequence of those machine models is it is complex to perform data functions and the activity and programming techniques. The decision-making for determining what's happening within those models is a little bit complex and not at all transparent. It's not easy for businesses to understand how the model is using the data of the bank customers in order to come to the assumption it does.

All of these things are background technologies and the business may not understand what's happening in the background. The customer will never know what tools are being used to monitor the fraud at all, however, the business manager should certainly be interested in knowing how this model is working. People in banks are very particular when it comes to approving these models, as they have to be accountable to the regulators on the other side. They need to understand and explain what customer data is being consumed, why it's being consumed and if it's consumption is endangering any privacy rights.  There needs to be clarity in terms of how much anonymization of the data happens before BioCatch comes in.

I might have a gap in knowledge, and the solution may have been updated since I used it in December of last year.

I've been using the solution for a while. It's been since at least mid-2019.

The solution is quite reliable. It's never let us down and we haven't had any issues using it. As embedded code, it's not something that crashes or freezes. It is stable. It just quietly runs in the background and keeps monitoring the momentum.

The tool does not manifest itself in any of the front end or to the customer, the operational users, as such. The code is embedded in the handheld devices in some app. It is not as if there are a set number of users using any application. The business operations, for example, won't use it. They just come to know when an application has been rejected. Likewise, the customer will also not know that they are being monitored in terms of fraud. As such, when you think of how many people are using it, it's not the same as comparing it to the Microsoft Office or MS Word being used in a company. It's not comparable.

It is scalable, certainly as it's just a matter of embedding the code in more customer journeys. Each of the client's actions (from setting up accounts to making transfers to deposits, etc.) are the points where the code in one of these points can be embedded and the behavior of the customers can be monitored. Likewise, apart from retail banking, it can be done for insurance, it can be done for other financial items, and the use of other websites )like Netflix), those actions also can have biometrics embedded, just to be sure that the usage is from a generic customer. Therefore it's scalable in that it can also be applicable to different aspects or actions.

It's my understanding that the company does plan to increase usage in the future.

Technical support was always very good. They would always only be on our front line. They were very helpful in providing feedback and giving an oral report regarding issues. They have an extensive language for the IRD installations and for self-help, etc. There's a very good sense of help even in cases regarding big volumes of data.

I have worked in other banks, and have used ThreatMetrix as well, which is a device profiling tool, similar in BioCatch. The difference is it profiles the devices rather than the behavior of the person. It may profile the handheld devices or the devices from where the customer is accessing the bank application. 

The initial setup is straight forward in terms of sponsoring the initial set of rules and the wanted behavior record. The complexity comes on the side of the development of the models. BioCatch does not expose these models to its customers. It tells the banks to limit data or to create the bridges between the bank's data stores and BioCatch itself. They will consume the data, and they'll consider the model on their side and then they'll all put a stock score and send it back to the bank's IT systems. The models are not exposed to the customer.

Every bank has its own tech team and they have the data science team and a model growing team which will actually be the governing body for all the models. There's a team detailed in the bank which is better for deployment.

I wasn't part of the negotiating team when it came to dealing with pricing. It's my understanding that what is generally negotiated is terms that specify the number of calls per month or year. These would typically be in the per millions as the company was quite sizable.

The solution is AWS-based and the installations are managed by BioCatch themselves. The solution supplies what is called an SDK for integration into the mobile journeys on the mobile phone apps, or handheld devices and closer supplies and can be integrated into the web pages of the account opening application forms of the bank. Once the customer starts hitting those points for inputting them, BioCatch can alert you. 

I would recommend the solution. It's certainly an up-and-coming option that has worked well for us.

I would just warn that the implementation is quite complex and something to be aware of. That said, it's very effective in reducing fraud once it's set up.

Overall, I'd rate it eight out of ten. 

I'd rate it higher if it had more integration on the IT, model scaling, and data usage side of things. They do need to practice better transparancy.