The way you type is now a security password

A fraudster can steal a password. They can steal a PIN. They can even steal fingerprint data, if a breach is bad enough. 

What’s much harder to steal is something smaller. The exact rhythm of how someone moves a mouse. The pressure behind their typing. The tiny pause before they hit submit on a form. That’s the whole idea behind behavioral biometrics. One of the companies that helped build this field started in Tel Aviv.

BioCatch was founded in Israel in 2011. Since then, it’s grown into a clear example of something specific. A narrow, technical idea out of Israel’s cybersecurity scene can end up running quietly behind the scenes at banks and digital platforms most people have never heard of by name.

The company doesn’t chase headlines the way flashier start-ups do. It just keeps catching fraud that standard security checks miss entirely.

Most online security still works the way it has for decades. A password. Maybe a code sent to your phone. Maybe a fingerprint scan. All of that checks one thing. Does this person have the right credentials. None of it checks something else. Is this person actually behaving like themselves.

Behavioral biometrics flips that question around. It looks at how someone uses a device, not just what they type into it. The angle someone holds their phone. How fast they swipe between screens. The particular rhythm of keystrokes while filling out a form, including pauses most people don’t even notice they’re making. 

Each pattern is small on its own. Together, they form something close to a fingerprint. One that’s extremely hard for a fraudster to fake, even with someone’s real login information already in hand.

Any platform handling real-time transactions at scale needs this kind of protection. Insurance providers. E-commerce sites. Digital payment apps. All of them need to verify that the person behind a transaction is actually who the account belongs to. 

Even specialized sectors with their own fraud concerns, like Novatech Solutions casinos for Canadians, operate in an environment where account security matters just as much as it does at a traditional bank. Online Casino Groups have pointed to verification as one of the clearer signs that an operator takes account protection seriously, rather than treating it as an afterthought bolted on later.

Canada shows why this technology matters well beyond Israel. Fraud losses have climbed fast across the country. Scams keep getting more convincing. Canada’s major banks have taken notice.

Royal Bank of Canada moved away from old, static fraud rules. It built a real-time system instead. That system watches behavior patterns a simple login check would miss. RBC compares these signals to a digital fingerprint. Unique enough to catch a stolen account, even when the password is correct.

TD Bank took a similar path. After buying a machine learning company, it built behavioral analysis straight into its fraud systems. Two of Canada’s biggest banks investing this heavily says something simple. This isn’t a small experiment. It’s becoming standard practice across Canadian banking.

Traditional fraud detection has a blind spot. It got more obvious as data breaches piled up over the past decade. Say a criminal has someone’s correct username, password, and security answers, all stolen from one of the many breaches that happen every year. A standard login check sees nothing wrong. The credentials match. The system lets them straight in.

Behavioral patterns don’t share that weakness. They’re not something a data breach can leak. A stolen password is just a string of characters sitting in a file somewhere. The specific way someone’s hand moves a mouse isn’t something that sits in a database waiting to be stolen. 

That difference is exactly why banks and payment processors leaned into this kind of detection over the past several years. Account takeover fraud, where a criminal breaks into a real customer’s existing account, has become one of the fastest-growing categories of online crime.

Financial institutions remain BioCatch’s main market, for good reason. Banks lose real money every year to account takeover fraud. This is different from someone creating a brand-new fake account. The login details are genuine. The person using them isn’t. Behavioral biometrics catches exactly this kind of fraud particularly well, since nothing about the credentials themselves looks wrong.

BioCatch isn’t an isolated success story. It’s one example of a pattern that shows up across Israel’s cybersecurity sector again and again. 

A small team solves a narrow, deeply technical problem. Often, that team has backgrounds in Israel’s military intelligence units. That solution ends up embedded in infrastructure used by companies the general public has actually heard of, even if nobody’s heard of the company that built the underlying technology running quietly underneath.

That pattern is part of why Israel’s cybersecurity exports keep growing year after year. This holds true even as headlines tend to focus on flashier consumer technology coming out of other countries. 

The real value sits in unglamorous, highly specific problems. Fraud detection. Identity verification. Threat intelligence. These get solved well enough that major institutions build real security around tools most of their customers will never see directly.

As more of daily life moves through a phone or a browser, one gap keeps mattering more, not less. The gap between “has the right password” and “is actually the right person.” 

Behavioral biometrics doesn’t eliminate fraud completely. Nothing does. But it closes a real gap that traditional security checks were never built to cover. It does this using signals that are nearly impossible for an attacker to copy convincingly, no matter how much stolen data they’re working with.

A company founded in Tel Aviv over a decade ago helped pioneer that whole approach. It now sits quietly behind the login screens of banks and platforms most people interact with regularly, in Canada and well beyond it. 

Most of those people have no idea that the way they type their password is, in its own small way, part of what’s keeping their account secure right now.

This article was written in collaboration with James Evans