Agentic AI Fraud Detection: BioCatch Launches AiRE

BioCatch launched AiRE (Agentic AI Risk Essentials) on November 10, 2026, a tool that detects AI agents acting for accountholders or for criminals before money moves, giving banks new agentic AI fraud detection inside live sessions.

The release matters because banks have so far built fraud controls on one assumption: a person is behind the screen. BioCatch says close to half of the agentic interactions it detected occurred at account opening, with the rest spread across logins, account management and transactions, including electronic fund transfers, wires and faster payments.

BioCatch’s own 2026 survey, “The future of digital trust,” asked 1,440 global banking leaders about the threat. It found 80% had already encountered attacks using agentic AI, and 84% believed agents could become the industry’s largest exploitable vulnerability within a year (BioCatch survey release).

What AiRE does for agentic AI fraud detection

AiRE watches a session continuously and assesses whether the entity controlling it is a person or an agent. Institutions that use it also receive indicators of potentially risky agentic activity.

BioCatch said the detection draws on five kinds of signal:

behavioral anomalies;
unusual interaction patterns, such as synthetic inputs;
the browser’s permission profile;
agent infrastructure;
agent declaration, where the agent identifies itself.

Detection also covers cloud-based agents such as Muse. The company has not published how it weighs these signals or how it separates a customer’s legitimate agent from one run by a scammer.

Ayelet Eliezer, BioCatch’s Chief Product Officer, said banks need one capability whatever policy they choose. Whether they block agents, allow pre-approved ones or allow any agent, she said, they must first be able to “reliably detect whether the entity controlling a session is a human or an agent.”

AiRE is offered through existing customer integrations. The release does not give a general availability date, and it names no bank customers. It refers only to financial institutions worldwide.

Trust policies for agentic AI fraud detection

The three policies Eliezer described, block, allow pre-approved agents or allow all, are the decisions that fall to a bank’s fraud and product teams. BioCatch said AiRE helps banks set those trust policies using what it observes in a session.

The detection technology is built on behavioral analytics. BioCatch collects more than 3,000 anonymized data points during digital banking sessions. As of the end of the third quarter of 2026, more than 400 financial institutions use BioCatch, which analyzes 20 billion user sessions a month and protects more than 760 million users on more than 1.8 billion devices.

BioCatch added agent differentiation to its BioCatch Connect 2.0 platform in November 2025. That release separated known agents, previously unseen agents and human users. AiRE extends agentic AI fraud detection into a named product with its own risk indicators.

Why agentic AI fraud detection reaches payments rules

The fraud and payments rules in the EU and UK turn on whether a customer authorized a payment. An AI agent that initiates a transfer on a customer’s instructions raises that question directly, and a session-level signal that an agent is present is one input to answering it.

In the UK, the Payment Systems Regulator’s reimbursement regime for authorised push payment (APP) fraud applies to Faster Payments and CHAPS. The regulator set the maximum reimbursement at £85,000 per claim in policy statement PS24/7, which took effect on October 7, 2024. The Bank of England, as operator of CHAPS, set the same limit. Banks building their APP fraud reimbursement processes now have to account for scams carried out through an agent as well as through a person.

In the EU, the Council and Parliament reached a provisional agreement on November 27, 2025 on a new Payment Services Regulation and a revised Payment Services Directive (PSD3). Under the agreed approach, a payment service provider without suitable anti-fraud mechanisms is liable for a customer’s losses. A transaction a fraudster initiates or alters is treated as unauthorized, and the provider is liable for the full amount.

The agreement also requires a refund of the full amount where a scammer impersonates a provider’s employee and persuades a customer to approve a payment. The customer must report the fraud to the police and notify the provider. Providers must also check that a payee’s name matches the identifier and exchange fraud-related information with each other.

These liability rules make the early identification of who or what is controlling a session a cost question for banks, not only a technical one. A bank that cannot tell an agent from a customer cannot show how it applied its fraud controls to the payment.

Visa deal puts BioCatch’s product roadmap in focus

AiRE arrives three months after Visa said on August 3, 2026 that it would acquire BioCatch for $2.4 billion in cash, paid to funds advised by Permira and other shareholders (Visa press release). Visa expects to close the deal by the end of its fiscal second quarter of 2027, subject to customary conditions, including regulatory approvals.

Andrew Torre, Visa’s president of value-added services, said “BioCatch will help our clients stop fraud before it reaches the point of payment.” Visa said the deal complements its existing cyber, fraud, risk and security products. In the announcement, BioCatch CEO Gadi Mazor said: “Together with Visa, we’re even better positioned to advance our mission.”

At the time of the Visa announcement, BioCatch said it served more than 350 banking clients in 21 countries, including more than 100 of the largest banks globally. Banks that already use it are the likely first buyers of AiRE, since it runs through existing integrations.

Agentic fraud tools in the wider bank toolkit

Banks are also deploying agents on their own side of the screen. RegTech Post has covered how banks use AI agents for AML, fraud detection and risk monitoring and the wider case for agentic AI in compliance and risk detection. AiRE addresses the opposite problem: agents arriving from outside the bank, acting for customers or for criminals.

For compliance teams, the same signals feed financial crime controls beyond payments. Agent activity at account opening, where BioCatch detected close to half of the interactions it observed, is an onboarding and money-mule risk as well as a fraud risk.

What comes next for agentic AI fraud detection

BioCatch will hold a webinar on November 12, 2026 on how the industry is preparing for agentic AI. Visa’s acquisition of BioCatch is expected to close by the end of Visa’s fiscal second quarter of 2027.