Behavioural Biometrics
What Are Behavioural Biometrics? Definition and How They Work
Definition
Behavioural biometrics is a fraud detection and authentication technology that analyses patterns in how a user interacts with a device, typing rhythm, mouse movement, touchscreen pressure, scroll behaviour, and device orientation, to create a unique behavioural profile distinguishing legitimate users from bots, credential stuffers, and account takeover attackers in real time, without any action required from the user.
How it works
Behavioural biometrics operate passively in the background of a digital session, collecting interaction data from the browser or mobile application. Collected signals include: keystroke dynamics (timing between keystrokes, key hold duration, typing speed); mouse movement patterns (trajectory, acceleration, micro-tremors); touchscreen behaviour (swipe pressure, finger size, tap patterns); device gyroscope and orientation data; scroll behaviour; and session navigation patterns.
These signals are processed by machine learning models comparing the current session's behavioural profile against a baseline from the user's historical interactions. A high match produces a low-risk score; anomalous behaviour, the robotic precision of a bot, or the hesitant exploration of an account takeover attacker unfamiliar with the victim's credentials, produces a high-risk score.
Integration is through a JavaScript snippet embedded in web pages or an SDK in mobile apps. Risk scores are returned in real time and feed into authentication step-up decisions, fraud scoring, or transaction monitoring.
Why it matters
Behavioural biometrics address a specific gap: the period between login and transaction completion. Traditional authentication secures the point of entry but not the session itself. If an attacker hijacks a session token after login, or a remote access trojan controls the victim's device, standard authentication doesn't detect the intrusion. Behavioural biometrics monitor the full session continuously.
For payment flows, behavioural biometrics complement 3DS authentication by identifying anomalous checkout behaviour and escalating to friction-based challenges only when risk warrants it, preserving conversion for legitimate users while adding friction precisely where needed.
With PXP
PXP's risk screening, powered by Kount, uses device, behavioural, and network signals to score transaction risk. Talk to our team about how PXP can support your fraud and risk screening.
Frequently asked questions
Is behavioural biometrics the same as device fingerprinting?
No. Device fingerprinting identifies a specific device by collecting hardware and software attributes. Behavioural biometrics identifies a specific user by analysing how they interact with a device. Both are passive fraud detection signals, but they capture different dimensions of identity.
Can behavioural biometrics satisfy SCA requirements under PSD2?
Behavioural biometrics can contribute to the 'inherence' factor (something you are) in a multi-factor SCA combination under PSD2, provided implementation meets EBA technical requirements. In practice, they are most commonly used as a fraud signal feeding into SCA exemption decisions rather than as a primary SCA factor.
How does behavioural biometrics help with bot detection?
Bot behaviour is statistically distinct from human behaviour: bots type at superhuman speeds with precisely uniform timing, move the mouse in geometrically smooth curves, and fill forms in unnatural sequence. ML models trained on human behaviour identify these anomalies with high accuracy, enabling real-time bot detection during account creation, login, and checkout without CAPTCHAs or visible friction.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started