Behavioral analytics is the analysis of how people and devices act over time, such as how a customer logs in, types, moves through an app, spends money and whom they pay, in order to build a picture of normal behaviour and spot activity that does not fit. In financial services it is used mainly for fraud prevention, account security and anti-money laundering, and also for marketing and product design. The British spelling is behavioural analytics.
In fraud work the term covers two related ideas. Transaction behavioral analytics looks at patterns in payments, such as usual amounts, times, merchants and payees. Behavioral biometrics looks at the physical way a person interacts with a device, such as typing rhythm, swipe pressure and how they hold a phone. Both feed into anomaly detection and are usually run inside a wider fraud management system. In cybersecurity, a similar approach applied to employees and systems is known as user and entity behaviour analytics.
Behavioral analytics in plain terms
Think of a bank teller who has served the same customer for years. She knows the customer comes in on Fridays, withdraws about the same amount and always chats about her grandchildren. If one day a nervous stranger with the customer's card asks for everything in the account, the teller notices straight away, even though the card is genuine.
Behavioral analytics gives a computer that same sense of familiarity for millions of customers at once. It learns each person's habits, from how quickly they type their password to which shops they use, and raises a flag when the pattern suddenly changes. It does this quietly in the background, so honest customers are rarely disturbed.
What is measured
Firms combine several kinds of behavioural signal:
- Transaction patterns. Typical payment amounts, frequency, time of day, merchant types, countries and payees. A first payment to a new beneficiary for a large amount stands out.
- Session behaviour. How a user moves through an online banking session, for example going straight to the transfer page and raising limits, which is unusual for a genuine customer.
- Behavioral biometrics. Typing speed and rhythm, mouse movement, scrolling, touch pressure and phone angle. These can show that a different person is using the account, or that a bot or remote-access tool is in control.
- Device and network context. Whether the device, browser and location match previous sessions, drawn from a digital fingerprint.
- Signs of coaching. Hesitation, long pauses, switching between apps or an active phone call during a payment can suggest the customer is being guided by a scammer.
Uses in payments and banking
The main use is stopping account takeover. Even when a criminal has the right password and one-time code, perhaps from phishing or SIM swapping, their typing and navigation usually differ from the real customer's. The system can then ask for extra authentication or block the payment.
A second use is fighting authorised push payment fraud. Here the real customer is making the payment, so passwords and devices all look right. Behavioral analytics can still catch signs that the person is acting under pressure or following instructions, which is why banks in the UK and EU have invested heavily in it since reimbursement rules for scam victims were tightened. It also helps detect mule accounts, whose pattern of money arriving and leaving quickly differs from ordinary use, and new accounts opened with synthetic identities.
Regulation encourages this kind of monitoring. Under the EU's regulatory technical standards on strong customer authentication, payment providers must run transaction monitoring that considers signals such as abnormal spending patterns and unusual locations, and providers that want to skip authentication for low-risk transactions under the transaction risk analysis exemption must show low fraud rates from real-time risk scoring. The European Banking Authority has also indicated that some behavioural biometrics may serve as an inherence factor in strong customer authentication when they meet the standards' requirements.
How models are built
Most systems create a baseline profile for each customer and each device, then score every new event by how far it departs from that baseline and from patterns seen in confirmed fraud cases. Machine-learning models, including supervised models trained on labelled fraud and unsupervised models that look for outliers, turn hundreds of signals into a risk score. Simple rules such as velocity checking often run alongside. The score drives a decision: allow, step up to multi-factor authentication, delay for review, or block.
Limitations and privacy
Behavioral analytics needs time and data to learn what is normal, so it is weaker for brand-new customers. Genuine changes in behaviour, such as travel, an injury that changes typing or a new phone, can cause false alarms. Models can also reflect bias in their training data, and they are hard to explain to a customer who has been blocked.
Privacy law shapes how the data can be used. Behavioural and biometric information is personal data under the GDPR, and biometric data used to identify a person is a special category with stricter rules, so firms must justify collection, limit retention and protect it under data privacy rules. In the US, state laws such as Illinois's Biometric Information Privacy Act add consent requirements for some biometric uses. Used carefully, behavioral analytics is a core tool of modern fraud risk management because it adds protection without asking customers to do anything extra.