After speaking with hundreds of banks, payment providers, and fraud teams over the years, we've identified a common set of questions that consistently arise when discussing behavioural analytics. This FAQ brings together the most frequently asked questions and explains how ThreatFabric approaches behavioural intelligence, fraud detection, privacy, and implementation.

Frequently Asked Questions (FAQ)

Q: What is Behavioural Analytics?

Behavioural Analytics (BA) is the process of analysing how users interact with digital banking channels. Rather than focusing on what a user does, behavioural analytics focuses on how they do it.

This includes signals such as typing rhythm, touch interactions, navigation patterns, device handling, mouse movements, scrolling behaviour, and other interaction characteristics. By analysing these patterns, behavioural analytics helps determine whether the person behind a session behaves like the genuine account holder or whether their behaviour resembles known fraudulent activity.

At ThreatFabric, we view behavioural analytics as a continuous fraud intelligence layer that complements device intelligence and transaction monitoring to detect scams, account takeover, social engineering, and other forms of digital fraud.

Q: What is unique about ThreatFabric's Behavioural Analytics?

Several capabilities distinguish our approach:

First, we use a multi-model architecture rather than relying on a single behavioural score. Our platform combines an Identity Model, which measures whether behaviour matches the legitimate customer, with a Fraudster Model, which measures similarity to known fraudulent behaviour.

Second, our models are built using behavioural signals collected from both mobile and web channels, providing a unified risk view across digital banking journeys.

Third, our risk decisions are fully explainable down to individual sensor categories. Fraud teams can understand why a behavioural score was generated rather than relying on opaque "black box" outputs.

Q: Which fraud & scam types does Behavioural Analytics help detect?

Behavioural Analytics is particularly effective against:

• Authorised Push Payment (APP) scams
• Social engineering scams
• Impersonation scams
• Investment scams
• Romance scams
• Account Takeover (ATO)
• Device Takeover (DTO)
• New Account Fraud (NAF)

These are scenarios where customer behaviour often changes before fraud is completed.

Q: Does Behavioural Analytics only protect users during login?

No.

Traditional behavioural biometric solutions often focus on authentication and login events. ThreatFabric continuously evaluates behavioural signals throughout the entire customer journey, from pre-login interactions through navigation, payment initiation, and transaction approval.

This continuous monitoring is especially important for scam detection because customers may begin their session behaving normally but become manipulated later during the transaction process. Continuous analysis enables detection of behavioural changes associated with social engineering and coercion as they occur.

Q: Other vendors offer Behavioural Biometrics. What makes ThreatFabric different?

Many first-generation solutions focus exclusively on behavioural biometrics. We believe behavioural intelligence becomes significantly more effective when combined with device intelligence.

ThreatFabric combines behavioural models with device-risk indicators such as malware detections, remote access tools, suspicious device characteristics, call intelligence, screen sharing activity, and other pre-transaction indicators. The combination of behavioural and technical signals provides a much richer view of fraud risk.

We also take a privacy-first approach. Unlike some biometric solutions, we do not collect physical biometric identifiers such as fingerprints, facial recognition data, or voiceprints. Instead, behavioural signals are analysed using anonymised behavioural characteristics aligned with privacy-by-design principles.

Q: How accurate is Behavioural Analytics?

Behavioural Analytics should not be evaluated as a standalone control. Its value lies in its ability to enrich existing fraud detection systems with highly predictive behavioural signals.

ThreatFabric's multi-model approach evaluates whether behaviour matches both a legitimate customer profile and known fraud patterns. By incorporating behavioural signals from multiple sensors and combining them with device intelligence, banks can increase detection performance across scam, account takeover, and social engineering use cases.

Many organisations measure behavioural analytics effectiveness through improvements in Value Detection Rate (VDR), which captures both fraud detection performance and financial impact.

Q: What about false positives?

This is one of the most common questions.

Behavioural Analytics should not be viewed as a binary decision engine that automatically blocks customers. Instead, it provides an additional layer of evidence that strengthens existing detection decisions.

For example, an unusual behavioural pattern on its own may not justify intervention. However, when that same behavioural anomaly coincides with an active remote access tool, suspicious device indicators, or unusual transaction behaviour, confidence increases significantly.

The strongest fraud detections typically result from combining multiple independent signals rather than relying on a single alert source.

Q: Are your fraud models federated across customers?

No.

Each institution receives models tailored to its own digital channels, customer journeys, and fraud patterns. Models are trained specifically for the bank's environment rather than being shared across different organisations.

However, intelligence regarding fraud methodologies, attacker behaviour, and emerging scam techniques benefits from ThreatFabric's broader fraud research and threat intelligence capabilities. This helps improve fraudster profiling without exposing customer-specific data between institutions.

Q: Are user models identical for all customers?

No.

ThreatFabric creates a unique Identity Model for every individual user. The model learns the customer's normal behavioural patterns and establishes a personal behavioural baseline.

This per-user approach enables the platform to distinguish genuine behavioural variation from genuine fraud attempts with much greater precision.

Q: How can I measure results from Behavioural Analytics?

Most customers evaluate Behavioural Analytics using metrics such as:

• Value Detection Rate (VDR)
• Fraud loss reduction
• Scam detection rates
• Reduction in operational investigations
• Customer friction reduction

ThreatFabric customers commonly experience VDR improvements of 20% or more after behavioural signals are incorporated into decisioning workflows, with particularly strong performance in scam and social-engineering scenarios.

Q: How is the solution implemented?

Implementation is designed to be straightforward.

ThreatFabric uses a single SDK strategy for iOS and Android. Device intelligence and behavioural intelligence are collected through the same SDK, eliminating the need for multiple integrations or overlapping data collection frameworks.

Risk scores and signals can then be integrated into existing fraud orchestration, transaction monitoring, and decisioning platforms.

Q: Do I need different solutions for web and mobile?

No.

ThreatFabric supports behavioural analytics and pre-transaction intelligence across both web and mobile channels using a unified platform. This provides fraud teams with a consistent view of risk regardless of where customer interactions occur. This is especially helpful against hybrid multi-channel attacks.

Q: Is your web technology as effective as the Mobile SDK?

Mobile environments naturally provide access to a broader set of sensors than browser environments. This can offer additional context for behavioural analysis.

However, ThreatFabric's web technology has been carefully optimised to capture meaningful behavioural and interaction signals in browser-based environments. As a result, web channels still provide strong behavioural intelligence and effective fraud detection capabilities.

Q: How much training do the models require?

ThreatFabric's Fraudster Models are trained using historical fraud intelligence and are available immediately.

Identity Models require individual behavioural baselines to be established. In practice, meaningful user models typically emerge after approximately 15-20 qualifying sessions, with accuracy continuing to improve as additional behavioural history is collected.

Q: Can your models detect new scam techniques?

Yes.

Our behavioural models focus on detecting the underlying building blocks of fraud rather than memorising individual scam scripts.

Social engineering scams may evolve continuously, but they often share common behavioural characteristics such as hesitation, uncertainty, coercion, cognitive overload, coaching, and manipulation. Behavioural Analytics identifies these fundamental indicators regardless of the specific scam narrative being used.

This means new scam variants can often be detected without retraining models for every new fraud methodology.

Q: Does Behavioural Analytics require customer consent?

In many jurisdictions, behavioural analytics used for fraud prevention can be processed under legitimate interest and fraud-prevention frameworks rather than requiring explicit customer consent. This is because the technology is deployed for security and fraud-monitoring purposes rather than identification or marketing.

Q: Are you collecting biometric data?

No.

ThreatFabric does not collect physical biometric identifiers such as fingerprints, facial recognition data, retina scans, or voiceprints. Behavioural models use anonymised behavioural interaction patterns rather than personally identifying biometrics.

Q: Why combine Device Risk with Behavioural Analytics?

Because fraud leaves traces in both the device and the user behaviour.

A compromised device may show malware, remote-access tools, VPN usage, screen-sharing software, or call activity. At the same time, scam victims often exhibit behavioural signals such as hesitation, confusion, or guided navigation. Combining both perspectives delivers stronger fraud detection than either approach alone.

Myth vs Reality

As behavioural analytics becomes more widely adopted across the financial services industry, several misconceptions continue to surface. Here are some of the most common myths we hear from banks and fraud teams.

Myth #1: Behavioural Analytics is just another form of behavioural biometrics.

Reality: Behavioural biometrics is only one part of the picture.

Many first-generation solutions focus exclusively on authenticating users based on behavioural patterns. ThreatFabric takes a broader approach. Our behavioural intelligence combines user-specific identity modelling with fraudster behaviour modelling and integrates these signals with device risk intelligence. The result is a platform designed not just to verify who the user is, but to identify scams, manipulation, account takeover, device takeover, and other fraud scenarios.

Myth #2: Behavioural Analytics only works at login.

Reality: The most valuable signals often appear after login.

Customers who are being socially engineered frequently authenticate successfully using their own credentials. The behavioural indicators associated with coaching, manipulation, hesitation, uncertainty, or duress often emerge later in the session while navigating the application or authorising a payment. Continuous behavioural monitoring across the entire journey allows these risks to be identified before a transaction is completed.

Myth #3: Behavioural Analytics requires collecting highly sensitive biometric data.

Reality: Modern behavioural analytics can be privacy-preserving by design.

ThreatFabric does not collect physical biometric identifiers such as fingerprints, facial recognition data, or voiceprints. Instead, behavioural models analyse anonymised interaction characteristics such as typing rhythm, navigation behaviour, touch interactions, and device handling patterns. User inputs themselves are not recorded.

Myth #4: Behavioural Analytics produces too many false positives to be useful.

Reality: Behavioural signals are most effective when used as part of a broader fraud intelligence strategy.

A behavioural deviation alone may not indicate fraud. However, when behavioural anomalies are combined with supporting evidence such as a remote access tool, malware infection, active phone call, suspicious device characteristics, or unusual transaction activity, confidence in the fraud assessment increases significantly. The goal is not to make decisions based on a single signal, but to combine multiple independent indicators.

Myth #5: Behavioural models must be retrained for every new scam tactic.

Reality: Effective behavioural models focus on human behaviour, not scam scripts.

Fraud tactics constantly evolve, but many forms of social engineering create the same behavioural effects on victims: hesitation, uncertainty, cognitive overload, manipulation, coaching, or duress. By detecting these underlying behavioural patterns rather than looking for specific scam narratives, behavioural analytics can identify previously unseen fraud scenarios without requiring retraining for every new scam variation.

Myth #6: Behavioural Analytics and Device Risk solve the same problem.

Reality: They answer different questions.

Device Risk helps determine whether the device can be trusted. Behavioural Analytics helps determine whether the person behind the device appears genuine.

Device intelligence may identify malware, remote access tools, screen sharing software, suspicious device configurations, or location anomalies. Behavioural analytics evaluates whether the user's actions are consistent with historical behaviour and whether they resemble behaviours observed in confirmed fraud cases. Together, they provide a much stronger fraud signal than either technology alone.

Myth #7: Web behavioural analytics is significantly weaker than mobile behavioural analytics.

Reality: Mobile and web channels provide different telemetry, but both can deliver meaningful fraud intelligence.

Mobile applications naturally provide access to more sensors and contextual information. However, modern web behavioural analytics can still capture rich interaction data including navigation behaviour, mouse dynamics, session patterns, browser interactions, and user workflows. ThreatFabric has optimised its web technology to achieve strong signal quality across browser-based banking channels.

Myth #8: Behavioural Analytics is a black box.

Reality: Fraud teams need explainability, not mystery scores.

ThreatFabric's behavioural models are designed to provide transparent and explainable risk outcomes. Analysts can understand which types of behavioural signals contributed to elevated risk scores rather than relying on opaque AI outputs. This improves analyst confidence, supports operational investigations, and simplifies governance.

Myth #9: Behavioural Analytics replaces transaction monitoring.

Reality: Behavioural Analytics strengthens transaction monitoring.

Transaction monitoring focuses on the transaction itself. Behavioural analytics focuses on everything that happened before the transaction. The combination creates a much more complete fraud decisioning framework by bringing pre-transaction intelligence into the risk assessment process.

Final Thought

The biggest misconception about behavioural analytics is that it is simply another fraud signal. In reality, it provides visibility into the human element of fraud.

By understanding how customers interact with digital channels and combining those insights with device intelligence, financial institutions gain a powerful new layer of defence against scams, account takeover, and other forms of authorised fraud that traditional controls often struggle to detect.