Behaviour scoring that flags coached or hijacked sessions in small-bank apps
TL;DR Swipewise is a software kit that sits inside a small bank's mobile app and watches how a session behaves - typing rhythm, swipes, pauses and remote-control tools. It sends a risk score to the bank before money moves. Urban co-operative and small finance banks pay per active user, through their app vendor.
Indians lost ₹22,845.7 crore to cyber fraud in 2024, up from ₹7,465.1 crore in 2023, with more than 22.6 lakh incidents reported[1]. Many of these frauds start with phishing or a phone call. The fraudster either steals the login or talks the real customer through a transfer, often with a screen-sharing app running.
Passwords and OTPs can't catch either case, because the credentials are genuine. Large banks buy behaviour analytics from global vendors. Smaller banks run apps built by a handful of vendors and rarely have a fraud data team.
What it does, in regulatory terms: a risk signal supplied to the bank, which stays the issuer responsible for authentication. Swipewise is not itself an authentication factor and holds no funds.
An SDK, added by the bank's app vendor, collects behaviour and device signals during a session. It learns each customer's normal pattern and flags breaks - a remote-access tool open, copy-pasted beneficiary details, long hesitations before a large transfer to a new payee. The bank's rules then decide whether to add a step, delay the payment or call the customer. A shared analyst desk reviews alerts for banks too small to staff one.
I reframed the seed, which pitched behavioural biometrics to stop phishing. Behaviour data can't stop a phishing message, but it can catch what happens after. Accuracy also drifts with mood, fatigue and device[2], so you sell it as one signal among several, never as proof of identity.
The users are bank customers who never see it. The payer is the bank's chief risk or IT officer, usually buying through the app vendor that already maintains the app. Global vendors focus on large retail banks[3]. Swipewise would charge a per-active-user fee with a floor, plus the desk as an option. There's no public Indian price to go by.
RBI's authentication directions, issued on 25 September 2025 with compliance due by 1 April 2026, let issuers add risk-based checks beyond the two-factor minimum and encourage newer factors[4]. They also place responsibility squarely on the issuer, so small banks now carry the loss if their checks are weak.
No public figure exists for behaviour analytics spending by Indian banks. The narrow signal is the loss trend above[1] and the new rule[4]. Adjacent: the best-known behavioural biometrics vendor says it serves more than 350 retail banks and protects 680 million accounts worldwide[3]. That shows banks pay for this, not that small Indian banks will.
That vendor leads the category, with products aimed at account takeover, scams and mule accounts, and lists no Indian customers on its site[3]. Several Indian fraud-analytics firms sell transaction monitoring to banks. The gap is a behaviour signal packaged for the app vendors that serve co-operative and small finance banks.
| Difficulty | Hard (54/100) |
| Starting capital | ₹2–3.6 Cr |
| Time to launch | 12–18 months |
Models need months of real session data before they say anything useful, and you only get that data after a bank trusts you, which is a proper chicken-and-egg problem. Each app vendor must agree to embed your SDK. Bank security reviews are long, often three to six months before any live traffic.
Swipewise needs no licence of its own, but it sells into banks, so their rules land on you as a vendor.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let the model block a payment or call anyone a fraudster on its own. Behaviour drifts with fatigue and device, so the bank's rules and people make the final call.
Want to work out the AI layer for Swipewise? Talk to Yash →
I'd back this for a team with fraud-model experience and a relationship with at least one app vendor serving small banks. If you're a first-time founder without banking contacts then it is not for you. Prove first that one vendor will embed the SDK and that, on six months of data, alerts catch confirmed fraud without flagging more than 1 in 200 genuine sessions.
Plan for roughly ₹2–3.6 Cr, mostly on the model team, security reviews and the 12–18 months before banks send live traffic.
No licence of your own. But banks will audit you under RBI's IT outsourcing rules, and the DPDP Act treats behaviour data as personal data.
Yes, small banks everywhere face scam-led transfers. Check the local authentication and data protection rules first, since they decide who carries the loss.
The free Swipewise validation kit has the line-by-line capital breakdown, the effort scoring, the RBI and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for bank risk heads and app vendors, and 5 assumptions to test. Download the kit →
Thinking about building Swipewise or something close to it? The make-or-break work is getting app vendors to embed your SDK so you can collect enough data to be accurate, and that's where I can help you plan the first few deals. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.