Behavioral biometrics in fraud detection: mouse, keystroke, and touch dynamics

A fingerprint reader checks one thing once. You press a finger to glass, a sensor reads the ridges, and a yes-or-no decision comes back. Behavioral biometrics asks a different question, and asks it continuously: not who unlocked this session, but who is driving it right now. The premise is that the way you move a cursor, the rhythm of your typing, the pressure and arc of your thumb on a phone screen are products of a nervous system steering a pointing device through a perception loop, and that loop is yours. Two people with the same password type it differently. The same person, stressed or coached over the phone by a fraudster, types it differently than they do alone.

That is the bet a bank places when it embeds a behavioral SDK into its mobile app. The login already passed. The credentials are correct, the device is recognized, the one-time code was entered. And yet the bank wants to keep watching, because the most expensive fraud in 2026 happens after authentication: an account takeover where the criminal has the real password, a victim being talked through a transfer by a scammer, a remote-access tool moving the mouse from another continent. This post is the pillar overview of how that watching works. We will start with what each channel measures (mouse, keystroke, touch, and the sensor signals underneath them), then the distinction between one-time and continuous authentication that defines the field, then the two vendors who built the commercial category, BioCatch and BehavioSec, and finally the privacy question that follows behavioral data everywhere it goes: when does a typing rhythm become biometric data in the legal sense, and who consented to it being collected.

The channels: what each one measures

Behavioral biometrics is not one signal. It is a family of input streams that share a property: each is a side effect of a human operating a machine, dense enough to carry identity, and emitted constantly without the user doing anything special to produce it. Four channels carry most of the weight.

Keystroke dynamics

The oldest of the four, and the simplest to describe. Every key you press generates two events the browser can timestamp, a keydown and a keyup. From those two events per key, the whole feature set falls out. The time a single key is held, from its press to its release, is the dwell time (also called hold time). The time between one key’s action and the next key’s action is a flight time, and there are four ways to measure it depending on which edges you pick.

The standard taxonomy, as laid out in the recent keystroke-dynamics survey, names the four digraph latencies precisely. Press-to-press (PP) is the interval from the press of the first key to the press of the second. Press-to-release (PR) runs from the first key’s press to the second key’s release. Release-to-press (RP) is the gap from releasing the first key to pressing the second, which is the interval most people mean when they say “flight time.” Release-to-release (RR) measures release to release. A detector usually collects all of them, because the redundancy stabilizes the profile against noise.

*The two edges per key (down, up) generate one dwell time and four inter-key latencies. A detector that logs every `keydown`/`keyup` pair has all of these for free.*

What makes this identifying is that the distributions are structured, not random. A doubled letter is faster the second time. Letters typed by alternating hands have shorter flight times than same-finger reaches. Skilled typists hold keys for less time than slow ones. The benchmark that anchored this whole subfield is the CMU dataset from Killourhy and Maxion, presented at DSN 2009: 51 subjects each typed the fixed password .tie5Roanl four hundred times across eight sessions, with at least a day between sessions to capture day-to-day variation. They then ran fourteen anomaly detectors over it. The best, a scaled Manhattan distance classifier, reached an equal error rate of 9.62 percent; a nearest-neighbor detector using Mahalanobis distance came in at 9.96. Those numbers are worth holding onto, because they set the honest ceiling for keystroke timing alone on a short fixed string. Roughly one in ten is the error floor when typing rhythm is the only signal. That is far too weak to authenticate on its own, and it is exactly why production systems fuse channels rather than betting on one.

There is a deeper split in keystroke work between fixed-text and free-text. Fixed-text means the same string every time, a password, where you can compare timing against a stored template directly. Free-text lets the user type anything, which is harder (you cannot line up digraphs against a template) but is what continuous authentication actually needs, because a real session is not someone retyping a password four hundred times. The dedicated treatment of dwell, flight, and the typing-rhythm fingerprint lives in keystroke dynamics: dwell time, flight time, and the typing-rhythm fingerprint.

Mouse dynamics

Where keystroke dynamics has two events per key, mouse movement is a near-continuous stream. The browser fires mousemove events as the cursor travels, each with coordinates and a timestamp, and from that trace you reconstruct a trajectory: position over time, and by differentiation, velocity, acceleration, and the curvature of the path. The features that classify a user come out of the geometry and the kinematics together. How sharply the path curves. How fast the cursor accelerates out of a stop and how it decelerates into a target. Where it pauses. Whether it overshoots a button and corrects, and how big the correction is.

The foundational academic work is Ahmed and Traore’s 2007 paper in IEEE Transactions on Dependable and Secure Computing, which built a 39-feature representation from four categories of raw mouse behavior (clicks, drags, movement between clicks, and silence periods) and fed it to a feedforward neural network. On 22 users and 2,000 mouse actions per profile they reported a 2.46 percent equal error rate, considerably better than short-string keystroke timing, because a continuous trajectory simply carries more bits than a handful of inter-key gaps. That gap between the two channels (mouse richer, keystroke sparser) is a recurring theme, and it is why mouse data tends to anchor desktop profiles.

The reason a real mouse path is hard to synthesize connects to motor control. A human arm reaching for a target obeys a speed-accuracy tradeoff, formalized as Fitts’s law: movement time grows with distance to the target and shrinks with target size, in a specific logarithmic relationship. A real path also shows the submovement structure of a feedback loop, a fast ballistic phase toward the target followed by slower corrective adjustments near it. Naive synthetic movement (a straight line, a Bézier curve with no corrections, constant velocity) lacks that structure and is visible as such. We cover the geometry in mouse-movement biometrics and the motor-control argument in why a real mouse path is hard to fake: Fitts’s law.

Touch dynamics

On a phone there is no mouse, and the keyboard is a glass rectangle, so the channel shifts to the touch surface itself. Touch dynamics treats each swipe, tap, and scroll as a gesture with measurable properties: the start and end coordinates, the velocity and acceleration along the stroke, the pressure (on devices that report it), the contact area of the fingertip, the curvature of a swipe, and the duration of the gesture.

The reference study is Touchalytics, by Frank, Biedert, Ma, Martinovic, and Song, published in IEEE Transactions on Information Forensics and Security in 2013. They proposed a set of 30 behavioral touch features extracted from raw touchscreen logs of 41 users on Android phones, then classified with a kNN and an SVM. Their reported equal error rates are the headline result: 0 percent for authentication within a single session, 2 to 3 percent across sessions, and below 4 percent a week after enrollment. The week-later number matters because it speaks to template drift, the question of whether your gesture signature is stable enough to recognize you days later, and the answer was largely yes.

*The numbers come from separate studies on separate datasets and populations, so the bars are not apples-to-apples. They do show the rough ordering: continuous channels (touch within a session, mouse trajectories) carry more discriminating signal than short-string keystroke timing.*

Touch sits on top of a second layer of mobile signal. While a thumb is moving, the phone’s accelerometer and gyroscope register the micro-motions of the hand holding it: the small tilt as you reach for a far corner of the screen, the tremor, the way the device settles. BioCatch’s earliest patents lean on exactly this combination, and we treat the motion-sensor side separately in device-orientation and accelerometer signals in mobile bot detection. The dedicated touchscreen piece is touchscreen biometrics: pressure, swipe velocity, and gesture signatures.

Scroll and navigation

A fourth, thinner channel rides alongside the others: how you scroll, and how you navigate. Scroll behavior has a rhythm (wheel notches versus a trackpad’s inertial flick versus a touchscreen drag), and the velocity profile of a scroll is itself a small biometric. Navigation is higher-level: which fields you fill first, whether you tab or click between them, how long you dwell on a page before acting, whether you use keyboard shortcuts. None of these alone is strong. Fused into a profile, they add bits, and (more importantly for fraud) they change sharply when the person at the controls changes, even if every device and network signal stays constant.

One-time versus continuous authentication

The split that defines behavioral biometrics as a discipline is between two ways of using all this signal. One-time authentication treats behavior the way a password is treated: collect a sample at a gate, compare it to a template, decide. Type your password and let the system check not just the characters but the rhythm. This is real, it works on fixed text, and the CMU numbers above describe its accuracy ceiling. But it shares the password’s fundamental weakness, which is that it checks once. After the gate, it has nothing to say.

Continuous authentication is the model that the commercial field actually sells, and it inverts the question. Instead of a single check, it monitors the behavioral stream for the entire session and keeps scoring it against the user’s profile, looking for the moment the behavior stops matching. This is what BioCatch means by analyzing interactions “throughout the entire session, not just at login,” and what BehavioSec describes as authenticating “not on what they do, but on how they do it” continuously. The value is not in being a better front door. It is in catching the cases where the front door was opened legitimately and then someone else walked through.

*The continuous model keeps comparing the live behavioral stream to the enrolled profile. The interesting event is the divergence partway through a session that the password already let in.*

This is the structural reason behavioral biometrics found its home in banking fraud rather than general access control. The threats it answers are the ones a credential cannot stop. Account takeover, where the attacker has correct credentials harvested by phishing or malware, looks identical to the legitimate user at the login gate and only diverges in how the session is operated. Authorized-push-payment scams, where a victim is on the phone with a fraudster being walked through a transfer they will later regret, produce a behavioral signature of someone acting under direction: long hesitations, dictated input, segments of typing that do not match the account holder’s normal rhythm. BioCatch markets exactly these tells (dictation, duress, hesitation) as detectable. And remote-access-tool fraud, where a criminal controls the victim’s own machine through legitimate remote-support software, produces a distinctive degradation: hand-eye coordination goes “edgy,” the cursor jumps in a way a local pointer does not, and the rhythm of interaction stretches around the network round trip. None of these can be caught by checking the credential, because the credential is correct.

It is worth being precise about what continuous behavioral scoring does and does not deliver. It does not produce a clean yes/no the way a password match does. It produces a risk score, a probability that the current behavior matches the enrolled user, which a fraud engine combines with device, network, and transaction signals before deciding whether to step up authentication or block. The behavioral channel is one input to a fusion model, almost never the sole arbiter. That design choice is also a privacy hedge, and it surfaces again at the end of this post.

How the commercial systems are built: BioCatch and BehavioSec

Two companies turned behavioral biometrics from an academic curiosity into a banking product line, and they took noticeably different routes.

BioCatch, founded in Israel in 2011, built around the idea that you should not only watch behavior but provoke it. Its early and central patent, US 8,938,787 B2 (“System, device, and method of detecting identity of a user of a mobile electronic device”), describes generating a cognitive biometric signature from a mix of physiological and behavioral parameters: left/right handedness, press-size, hand tremor, eye-hand coordination, usage preferences, and device-interaction patterns. The mechanism that made BioCatch distinctive is what it trademarks as the Invisible Challenge: the system injects a subtle, deliberate anomaly into the session (a small irregularity the user does not consciously notice) and measures how the user responds to it. Because the response to an unexpected stimulus is a reflex shaped by the individual’s sensorimotor control loop, it is hard to fake and hard to replay. Instead of passively waiting for enough natural behavior to accumulate, the system manufactures a moment that forces behavior to reveal itself.

The exact field layout BioCatch transmits is not public. What is documented, from the company’s own materials and patents, is the shape: a lightweight SDK embedded in the bank’s web and mobile apps collects on the order of thousands of behavioral parameters per session (the figures cited range across “more than 2,000” and “more than 3,000” depending on the year and the document), passively and continuously, and ships them to a backend where machine-learning models compare the live session to a profile. The reported headline figures are vendor numbers, not independently audited error rates, so treat the 3,000-data-points figure as a description of breadth rather than a precision claim. The RAT-detection capability is described concretely enough to reason about: when a session is being driven through a remote-access tool, the hand-eye coordination is skewed and the cursor jumps as it responds to the remote operator, and that signature is what the “RAT catcher” logic keys on. BioCatch also extends the same telemetry into mule-account detection, the spotting of accounts used to receive and launder fraudulent funds, which is the subject of a family of later patents.

BehavioSec, founded in Sweden in 2008 and spun out of academic work at Luleå University of Technology, took the more classical biometric-template route. Its system learns how a specific user types and swipes, converts mobile signals from the touchscreen and motion sensors into rules, and authenticates continuously against that learned model. In May 2022, LexisNexis Risk Solutions (part of RELX) acquired BehavioSec and folded it into the ThreatMetrix stack, where the stated rationale was that BehavioSec’s mobile, sensor-derived behavioral capabilities complemented ThreatMetrix’s browser-based device intelligence. That acquisition matters for the structure of the market: behavioral biometrics increasingly ships not as a standalone product but as one layer inside a larger fraud and device-intelligence platform, fused with device fingerprinting, network reputation, and identity data. The behavioral score is rarely consumed alone.

*The pipeline most vendors run. The internal payload field names and the exact model are proprietary; the stages are inferred from vendor documentation, patents, and the academic feature taxonomy.*

It is fair to ask how much of the marketing translates into measured accuracy, and the honest answer is that the strongest public numbers are still the academic ones. The vendors publish parameter counts and case studies, not equal error rates on shared benchmarks. So the rigorous claim is narrow: the academic literature shows that mouse trajectories and touch gestures carry enough signal to distinguish users at single-digit error rates within and across sessions, that keystroke timing alone is weaker, and that fusing channels and fusing behavioral scores with non-behavioral signals is how production systems reach the reliability a bank will act on. The leap from those benchmarks to “thousands of parameters, real-time, at population scale” is a leap the vendors assert and customers validate privately.

Where it overlaps with bot detection

Behavioral biometrics grew up in banking fraud, but the same input streams drive a parallel field, bot and automation detection, and the two have converged. A detector that can tell one human from another can certainly tell a human from a script, and the human-versus-bot question is the easier one. Mouse dynamics is the textbook example: a real cursor path has the submovement structure and Fitts’s-law timing of a motor-control loop, while a naive automated path is a straight line or a smooth curve with no corrective phase. Keystroke timing splits the same way, a fixed-delay typing loop leaving identical inter-event gaps where a human leaves a cloud, which we cover in detecting automation via timing.

This is why behavioral signals show up inside the commercial anti-bot stacks, not just the fraud ones. Akamai’s client-side agent ships mouse and touch telemetry in its sensor payload; the fields and their sources are catalogued in Akamai’s sensor_data payload. The distinction worth keeping is one of identity versus class. Bot detection asks a yes/no about a category (human or not). Behavioral biometrics asks about an individual (this specific human or not), which is a strictly harder problem and the reason its accuracy numbers are softer and its privacy footprint is larger. The same mousemove stream feeds both questions; the difference is what you train the model to answer.

The adversarial pressure also differs. Against bot detection, the attacker’s goal is to synthesize human-like input convincingly enough to pass as a generic human, and there is an active literature on doing exactly that. Against behavioral biometrics in a fraud setting, the attacker would need to reproduce a specific victim’s idiosyncratic rhythm, which is far harder, because it is not enough to look human. You have to look like one particular person whose data you do not have. That asymmetry is the strongest argument for behavioral biometrics as a fraud control, and it is independent of any vendor’s parameter count.

The privacy question

Behavioral biometrics carries a problem its proponents are quieter about than its accuracy. The same property that makes it useful (it identifies a specific person from how they behave) makes it biometric data in the legal sense, and biometric data is regulated more tightly than most telemetry. The catch is that the regulation does not map cleanly onto the technology, and the seams are where the litigation lives.

Under the GDPR, biometric data is defined in Article 4(14) as personal data resulting from specific technical processing of physical, physiological, or behavioural characteristics that allow or confirm unique identification. The word “behavioural” is in the definition, so typing rhythm and gesture dynamics are squarely in scope when used to identify. But Article 9, which elevates biometric data to a special category requiring stricter handling, attaches only when the processing is “for the purpose of uniquely identifying a natural person.” That qualifier is the entire ballgame. A system that uses behavioral signals to score risk, and importantly does not store a one-to-one identifying template, can argue it is not processing special-category data at all, because it is not uniquely identifying anyone in the Article 9 sense. This is not a loophole the vendors invented; the EDPB’s own guidance draws the line at purpose. Behavioral measurements used for general analytics or anomaly scoring, rather than one-to-one identification, may fall outside Article 9 even while remaining personal data under the general regime. The architecture choice (risk score, not stored template) is partly a privacy-engineering decision to stay on the lighter side of that line.

The United States has no federal GDPR analogue, but it has Illinois, and Illinois has BIPA. The Biometric Information Privacy Act of 2008 regulates the collection of biometric identifiers by private entities and, uniquely, gives individuals a private right of action with statutory damages, meaning a plaintiff can sue without showing actual harm. That private right is what made BIPA the most consequential biometric-privacy statute in the country, with settlements running into the hundreds of millions for tech companies. BIPA’s defined identifiers center on physical biometrics (fingerprints, face geometry, voiceprints, retina and iris scans), so whether a typing rhythm or a swipe signature falls inside its scope is genuinely contested rather than settled. The exposure for a behavioral-biometrics vendor or the bank deploying it is real but legally murkier than for face recognition, and that ambiguity is itself a risk: a category that is probably-not-covered until a court decides otherwise.

There is a second-order privacy concern specific to behavioral data, separate from identification. Keystroke and mouse dynamics leak more than identity. The same timing data that identifies a typist can, in some studies, reconstruct what was typed from the rhythm alone, and behavioral streams have been shown to carry signal about a user’s emotional and physical state, fatigue, even early indicators of neurological conditions that affect motor control. A bank that collects 3,000 behavioral parameters per session to catch fraud is, as a side effect, sitting on a stream that encodes far more about its customers than the fraud question requires. Most of that is never extracted. The point is that it could be, and that consent obtained for fraud prevention does not obviously cover inference about a customer’s health. The discipline of minimization (collect what the fraud model needs, derive nothing else, store no raw stream longer than necessary) is the responsible answer, and it is not enforced by anything other than the vendor’s own engineering and the regulator’s attention.

The deepest tension is about consent itself. Behavioral biometrics is designed to be invisible. The whole value proposition is that it runs without friction, that the user never notices the SDK measuring their swipes, that the Invisible Challenge is invisible by name and intent. But consent under both the GDPR and BIPA is supposed to be informed and specific. A system engineered to be unnoticed is in structural tension with a legal standard that requires the subject to know what is happening and agree to it. Banks paper this over with terms-of-service language, but the EDPB has consistently held that consent to biometric processing must be freely given, specific, informed, and unambiguous, and a clause buried in a forty-page agreement satisfies none of those well. The fraud-prevention legal basis (legitimate interest, or a legal obligation to detect money laundering) is usually the firmer ground, not consent. Which is a quiet admission: the systems that watch how you move are mostly not relying on you having agreed to be watched.

What it comes down to

Behavioral biometrics works because a human operating a machine cannot help but leave a signature in the time and geometry of every input, and that signature is dense enough to identify and stable enough to recognize days later. The academic record is solid on the core claim: touch gestures and mouse trajectories separate individual users at single-digit error rates, keystroke timing alone is weaker, and the modern systems get their reliability by fusing channels and by fusing behavioral scores with everything else a fraud engine knows. The commercial story, BioCatch provoking behavior with invisible challenges and BehavioSec learning templates now folded into LexisNexis, is a story of taking that record and scaling it into bank infrastructure, where the precise field layouts and the audited accuracy numbers stay private.

The part that will keep moving is not the signal processing. It is the legal status of the data. A typing rhythm is behavioral characteristic data under the GDPR’s own definition, and whether it triggers the strict regime turns entirely on a purpose distinction (identification versus scoring) that the vendors have every incentive to stay on the soft side of. BIPA’s private right of action makes Illinois the place that question gets litigated, and it is not yet settled whether a swipe signature is a biometric identifier in the statutory sense. So the systems run, quietly, on a legal basis that leans on legitimate interest rather than the informed consent their own invisibility makes hard to obtain. The technology is mature. The question of who agreed to it is not.

---

Sources & further reading

• Killourhy, K. and Maxion, R. (2009), Comparing Anomaly Detectors for Keystroke Dynamics (DSN-2009) and benchmark dataset — the canonical fixed-text keystroke dataset; 51 subjects, password .tie5Roanl, best detector 9.62% EER.
• Frank, M., Biedert, R., Ma, E., Martinovic, I. and Song, D. (2013), Touchalytics: On the Applicability of Touchscreen Input as a Behavioral Biometric for Continuous Authentication — 30 touch features, 41 users, 0% intra-session and below 4% one-week EER.
• Ahmed, A. and Traore, I. (2007), A New Biometric Technology Based on Mouse Dynamics — IEEE TDSC; 39-feature neural-network model, 22 users, 2.46% EER.
• Survey authors (2025), Keystroke Dynamics: Concepts, Techniques, and Applications — defines dwell/flight and the four digraph latencies (PP, PR, RP, RR), and the fixed-text versus free-text distinction.
• BioCatch (2023), Behavioral Biometrics: A Primer on Dynamic Fraud Detection — vendor overview of continuous, post-login behavioral analysis and the dictation/duress/hesitation scam tells.
• BioCatch (2020), Protect Online Banking from Remote Access Tool Attacks — describes 2,000+ passively collected parameters and the hand-eye-coordination basis for RAT detection.
• Biometric Update (2015), BioCatch granted patent for behavioral biometric authorization of mobile device users — US 8,938,787 B2; cognitive signature from handedness, press-size, hand tremor, eye-hand coordination.
• LexisNexis Risk Solutions (2022), LexisNexis Risk Solutions Acquires Behavioral Biometric Innovator BehavioSec — the May 2022 acquisition and integration into ThreatMetrix.
• Biometric Update (2022), LexisNexis buys BehavioSec, adds behavioral biometrics to fraud detection portfolio — BehavioSec history (Sweden, 2008) and the touchscreen/sensor-to-rules approach.
• ICO, What is special category data? — regulator guidance that biometric data is special category only when used to uniquely identify.
• IAPP, US Data Privacy Litigation: Biometrics and consumer health data litigation — BIPA’s private right of action and the state of the litigation.
• Sherman et al. (2021), Biometrics: Trust, but Verify — survey covering behavioral biometric modalities, evaluation, and privacy concerns.