Behavioural Biometrics

Behavioural biometrics is the measurement and analysis of the way a person uses a device, rather than what they know or what they physically look like, in order to confirm who they are or detect that something is wrong. Signals include typing rhythm, the pressure and angle of touches on a phone screen, swipe speed, how a mouse moves across a page, how a phone is held and the order in which fields in a form are filled. Banks, card issuers and payment firms use it mainly to detect account takeover, bots and scams while a customer is logged in.

It differs from physical biometric authentication, such as fingerprint or face recognition, which checks a body feature once at login. Behavioural biometrics usually runs passively and continuously in the background. It is related to, but narrower than, behavioral analytics, which studies patterns across accounts and transactions rather than the physical interaction of one user with a device.

Think of how you recognise a family member's footsteps on the stairs before you see them. Everyone walks a little differently: some are quick and light, others slow and heavy. You do not need to see a face to know who is coming.

Behavioural biometrics does something similar with phones and computers. Each of us types, taps and scrolls in a personal way. A banking app can learn your habits over time, such as how fast you type your password or how you hold the phone. If someone else picks up your phone, or a criminal controls your account from far away, the rhythm looks different. The app can then ask for an extra check or stop a payment, while you, the real customer, carry on as normal.

A software development kit inside a mobile app, or a script on a website, collects interaction data during a session. Typical signals include:

• Keystroke dynamics. The time a key is held down and the gaps between keys.
• Touch and swipe features. Pressure, contact area, speed and curvature of finger movements.
• Pointer movement. Mouse speed, acceleration and the path taken to buttons.
• Device handling. Phone angle and motion measured by its sensors.
• Navigation habits. Whether a user pastes or types data, uses shortcuts or moves between fields in a familiar order.

Machine-learning models compare the session with the user's own history and with population patterns, producing a risk score. The score is combined with other inputs, such as device fingerprinting, location and transaction data, in a fraud detection engine. A low-risk score may let a payment go ahead without friction; a high score may trigger a step-up check, a hold or a call from the bank.

• Account takeover. Detecting that a session is being run by someone other than the account holder, for example after a phishing attack has stolen passwords.
• Bots and credential stuffing. Scripts and automation tools move and type in ways that real people do not.
• Remote-access scams. Signs that a fraudster is controlling the device through remote-access software, such as unusual pauses or cursor jumps.
• Coached victims. In authorised push payment (APP) fraud, a genuine customer making a payment while on the phone to a scammer may hesitate, switch between apps or type amounts unusually, which can prompt a warning.
• Onboarding fraud. During digital onboarding, applicants who paste personal data that a real person would know by heart may be flagged for synthetic identity fraud review.

Under the EU's PSD2, strong customer authentication (SCA) requires two of three independent elements: knowledge, possession and inherence. In an opinion published in June 2019, the European Banking Authority said that inherence covers behavioural as well as physical characteristics, and gave examples such as the way a user types or handles a device, provided the method is reliable enough to be a genuine authentication element. In practice, many firms use behavioural biometrics mainly as a risk signal, for transaction risk analysis or to support SCA exemptions, rather than as the sole inherence element. It can also feed into delegated authentication by wallets and merchants that perform the check on an issuer's behalf.

Behavioural data can be personal data, and where it is processed to identify a person uniquely it may fall within special category biometric data under the General Data Protection Regulation (GDPR), which requires a valid legal basis and safeguards. In the United States, state laws such as Illinois's Biometric Information Privacy Act (BIPA) have prompted litigation over biometric data collection, though how they apply to behavioural signals depends on the facts. Firms typically explain the processing in privacy notices and set limits through a data retention schedule.

Accuracy also varies. Behaviour changes with injury, age, stress, a new device or simple tiredness, which produces false alarms. People with disabilities or those using assistive technology may be flagged more often, raising fairness concerns. Skilled attackers can try to mimic behaviour or replay recorded data. For these reasons behavioural biometrics is normally one layer among several, not a stand-alone control.

• European Banking Authority
• European Data Protection Board