Behavioural biometrics is software that recognises a person by how they use a phone or a computer: how they type, swipe, tap and hold the device. It can tell the real customer apart from an impostor who knows the password, and a person apart from a bot. It runs quietly at every login and throughout the session, without asking the user to do anything.
Every person uses a phone in a slightly different way. Some type fast with two thumbs, and some slowly with one finger. People press the screen with different force, swipe at different speeds and hold the phone at different angles. The software measures these patterns inside the app: the time between key presses, the pressure and size of each touch, the path of each swipe and the readings of the phone's motion sensors. Over the first few sessions, it builds a profile of how this customer normally behaves. In each new session, it compares the behaviour with the profile and returns a risk score.
The software does not record what the person types. It records only the timing and the movement. When a customer types a password, the software stores how it was typed, not the password itself.
Here is a typical case. A retired schoolteacher in Mysuru receives a call from someone who claims to be from her bank. The caller asks her to install a screen-sharing app "to fix a KYC problem". Once the app is installed, the caller controls her phone from far away and opens her banking app. He knows her password, because he persuaded her to read it out. But the behaviour is wrong. The screen moves in straight, even strokes with no touch pressure, which is how remote control looks. The typing rhythm does not match her profile. And the phone is lying flat on a table, while she normally holds it in her hand. The software returns a high risk score. The bank's app stops the ₹2,40,000 transfer and asks for an extra check, which the caller cannot pass.
Bots are even easier to spot. A script fills in a form with perfectly regular timing and moves in exact straight lines. The same signals help bot management stop fake sign-ups.
Behavioural biometrics works together with device fingerprinting. Fingerprinting recognises the device, and behavioural biometrics recognises the person using it. Many customer identity and access management (CIAM) systems use the risk score to decide when to ask for a second proof of identity, through multi-factor authentication (MFA).
Behavioural biometrics is different from physical biometrics, such as a fingerprint or a face. A physical biometric is checked once, when the user unlocks the phone or the app. Behavioural biometrics keeps checking throughout the session.