# Behavioral Analytics
Source: https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics

Last updated 23 October 2026.

TL;DR

-   **Behavioral analytics** = Detecting fraud through _how_ users interact, not just _what_ they do
-   Fraudsters steal credentials, but can't steal behavior (typing rhythm, mouse curves, navigation patterns)
-   Use cases: [ATO detection](https://paymentsandrisk.com/docs/fraud/types/account-takeover/), bot detection, fraud ring identification
-   Signals: straight-line mouse paths (bot), instant form completion (paste), erratic typing (unfamiliar)
-   Vendors: BioCatch, BehavioSec (LexisNexis), NeuroID

Detecting fraud through user behavior patterns.

```mermaid
flowchart TD
    A[User Session] --> B[Collect<br/>Behavior]
    B --> C[Mouse<br/>Movement]
    B --> D[Typing<br/>Patterns]
    B --> E[Navigation<br/>Flow]
    C --> F[Behavioral<br/>Profile]
    D --> F
    E --> F
    F --> G{Match Known<br/>User?}
    G -->|Yes| H[Low Risk<br/>Continue]
    G -->|No| I{Bot or<br/>Human?}
    I -->|Bot Signals| J[Block]
    I -->|Human but Different| K[Step-Up<br/>Auth]

    style H fill:#1f6f4a,color:#fff
    style J fill:#b42318,color:#fff
    style K fill:#9a5b00,color:#fff
```

## Overview

Behavioral analytics examines **how** users interact with your platform, not just **what** they do. Fraudsters may have stolen credentials, but they can't steal behavior.

## Types of Behavioral Signals

### Navigation Behavior

| Signal | Legitimate Pattern | Fraud Pattern |
| --- | --- | --- |
| Time on page | Varies, reads content | Minimal, jumps to goals |
| Scroll behavior | Gradual, pauses | No scrolling or erratic |
| Mouse movement | Natural curves | Straight lines, robotic |
| Click patterns | Reads before clicking | Direct to buttons |
| Tab switching | Occasional | Frequent (copy-paste) |

### Input Behavior

| Signal | Legitimate Pattern | Fraud Pattern |
| --- | --- | --- |
| Typing speed | Consistent, personal | Erratic, paste-heavy |
| Typing rhythm | Unique cadence | Automated, unnatural |
| Error correction | Natural mistakes | Few errors (pasted) |
| Form completion | Gradual | Instant (autofill abuse) |
| Field focus order | Natural flow | Random or optimized |

### Session Behavior

| Signal | Legitimate Pattern | Fraud Pattern |
| --- | --- | --- |
| Session duration | Reasonable for task | Very short or very long |
| Page sequence | Exploratory | Direct to high-value |
| Return visits | Pattern exists | First and only visit |
| Time to transaction | Normal deliberation | Immediate |

## Behavioral Biometrics

More advanced signals based on physical behavior:

### Keystroke Dynamics

-   Time between keystrokes (dwell time)
-   Time between key releases (flight time)
-   Typing rhythm patterns
-   Error patterns and corrections

### Mouse Dynamics

-   Movement velocity and acceleration
-   Curve patterns (humans curve, bots don't)
-   Click pressure (on supported devices)
-   Scroll patterns

### Touch Dynamics (Mobile)

-   Touch pressure
-   Touch area (finger size)
-   Swipe patterns
-   Hold duration

## Use Cases

### Account Takeover Detection

```text
Normal User Behavior:
- Knows password (types smoothly)
- Familiar with site layout
- Consistent navigation pattern
- No hesitation on familiar fields

ATO Behavior:
- Password pasted or typed differently
- Explores unfamiliar areas
- Changes sensitive settings immediately
- Different behavioral biometric signature
```

### Bot Detection

| Bot Indicator | Description |
| --- | --- |
| No mouse movement | Keyboard-only navigation |
| Perfect timing | Superhuman speed |
| Linear paths | No natural curves |
| Consistent rhythm | No human variation |
| Missing events | JavaScript events not fired |

### Fraud Ring Detection

Shared behavior patterns across accounts:

-   Similar navigation sequences
-   Identical typing rhythms
-   Same form completion patterns
-   Matching session characteristics

## Implementation

### Data Collection

If implementing behavioral analytics in-house, your developer will track events like:

-   Keystroke timing (time between key presses)
-   Mouse movement patterns (speed, curves, pauses)
-   Form interaction (field focus order, completion time)
-   Session navigation (page sequence, time on page)

**What to tell your developer:** "We need behavioral analytics. Evaluate vendors like BioCatch or NeuroID first. They have pre-built models. If building in-house, start with keystroke and mouse tracking on login/checkout pages."

### Building Baselines

1.  **Collect** behavior data during normal usage
2.  **Build profile** for each user/segment
3.  **Score** new sessions against baseline
4.  **Alert** on significant deviations

### [Risk Scoring](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring/)

Illustrative score mapping, not a vendor standard. Fit the deviation bands and point weights to your own session data, including legitimate keyboard-only and autofill use, then validate against confirmed outcomes before they affect decisions.

| Deviation Level | Behavioral Score Impact |
| --- | --- |
| < 1 std dev | No impact |
| 1-2 std dev | +10 risk points |
| 2-3 std dev | +25 risk points |
| \> 3 std dev | +50 risk points |

These scores combine with [velocity rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/), [device signals](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/), and other factors in your overall [risk scoring](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring/) model.

## Privacy Considerations

Data Sensitivity

Behavioral data can be highly personal. Consider:

-   Disclosure in privacy policy
-   Purpose limitation
-   Data minimization
-   Retention periods

## Vendor Landscape

-   BioCatch
-   BehavioSec (LexisNexis)
-   NeuroID
-   Darktrace
-   Recorded Future (behavioral)

## Next Steps

**Implementing behavioral analytics?**

1.  [Start with navigation behavior](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#navigation-behavior) - Easy to collect
2.  [Add input behavior](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#input-behavior) - Typing patterns
3.  [Integrate with risk scoring](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring/) - Combine signals

**Detecting specific threats?**

1.  [Use for ATO detection](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#account-takeover-detection) - Behavior mismatch
2.  [Add bot detection](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#bot-detection) - Robotic patterns
3.  [Find fraud rings](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#fraud-ring-detection) - Shared behavior

**Evaluating vendors?**

1.  [Review vendor landscape](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#vendor-landscape) - BioCatch, NeuroID, etc.
2.  [Consider privacy requirements](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#privacy-considerations) - Data sensitivity
3.  [Plan baseline building](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/#building-baselines) - Collection first

* * *

## Related Topics

-   [Account Takeover](https://paymentsandrisk.com/docs/fraud/types/account-takeover/) - ATO detection use case
-   [Data Enrichment](https://paymentsandrisk.com/docs/fraud/detection/data-enrichment/) - IP, email, phone signals that complement behavioral data
-   [Device Fingerprinting](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/) - Device-level signals
-   [Rules vs. ML](https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml/) - Detection approaches
-   [Risk Scoring](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring/) - Combining behavioral signals
-   [Velocity Rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/) - Pattern detection
-   [Manual Review](https://paymentsandrisk.com/docs/fraud/detection/manual-review/) - When behavior triggers review
-   [Card Testing](https://paymentsandrisk.com/docs/fraud/types/card-testing/) - Bot detection use case
-   [Identity Verification](https://paymentsandrisk.com/docs/fraud/detection/identity-verification/) - Step-up verification triggers
-   [Evidence Framework](https://paymentsandrisk.com/docs/fraud/detection/evidence-framework/) - Behavioral Tier 2 indicators
-   [Fraud Metrics](https://paymentsandrisk.com/docs/fraud/metrics/) - Measuring detection performance
-   [Fraud Vendors](https://paymentsandrisk.com/docs/fraud/vendors/landscape/) - Behavioral analytics vendors