Behavioral Biometrics

People can be distinguished not only by their appearance but also by their habits. Behavioral biometrics is the technique that measures exactly such habits on a computer or smartphone. This includes how fast someone types, how long they hold down keys, how they tilt the phone in their hand, or the curve with which they drag the mouse across the screen. From many such small details a pattern emerges that is fairly typical for each person. A program compares this pattern with what it has seen from the person so far. If it doesn’t match, the process is considered suspicious. The difference from a fingerprint or a face scan is important: there, what is measured is what a body looks like; here, what is measured is how someone behaves.

Why banks look at typing and swiping patterns

Passwords and codes have a weakness: they can be stolen. Whoever knows the login credentials looks, to an ordinary system, like the real customer. Behavioral biometrics closes this gap because a fraudster hasn’t also stolen the behavior along with it. They type differently, scroll differently, and hold the device differently. That is why many banks and payment services deploy such systems in the background.

The second advantage is convenience. The check runs continuously in the background while the app is being used and doesn’t require any additional input. Experts call this continuous authentication: identity is not verified just once at login, but again and again. Only when something stands out does a follow-up query or a lockout occur. For the honest user, the technology therefore usually remains invisible.

The approach is especially effective against two forms of fraud. First, against automated programs, so-called bots, which fill out forms unnaturally evenly and quickly. Second, against remote takeover, in which a fraudster builds trust over the phone and then takes control of the victim’s computer. In both cases, the behavior deviates strongly from the familiar pattern.

From keystroke to comparison profile

First, the app or website collects measurements. Typical ones are the time between two keystrokes, the duration a key is held down, the speed and direction of swipe movements, as well as data from the phone’s motion sensors. Importantly, the content of what is typed is not needed for this, only the timing. From hundreds of such values, a numerical profile emerges.

This profile is evaluated by a machine learning method, that is, a program that derives patterns from many examples instead of following fixed rules. During a learning phase spanning a few sessions, it memorizes what is normal for this user. After that, it calculates a deviation score for each use. A small value means: it matches. A large value triggers an additional check.

This is never one hundred percent reliable, and that is a common misconception. Someone who is tired, sitting on a train, or has a new phone types differently than usual. That is why behavioral biometrics almost always serves as only one of several signals. It complements passwords, device identifiers, and location—it doesn’t replace them.

Where the technology runs today

Behavioral biometrics is most widespread in online banking and payment transactions. Providers such as BioCatch or BehavioSec sell such systems to banks, which build them invisibly into their apps. Fraud filters used by online shops, as well as checks on whether a human or a bot is behind a login, also work with similar signals. In schools, it can turn up in online exams to detect attempts at cheating.

In the news, the term usually comes up in connection with data protection. Behavioral data is considered particularly sensitive in the EU when it serves to uniquely identify someone. The General Data Protection Regulation requires explicit consent for this in many cases. Critics also point out that typing patterns can yield clues about stress or illnesses. Anyone who reads financial and tech news will therefore often find the term playing two roles: as a tool against fraud and as a point of contention in data protection.