Behavioral mismatch is a difference between how a user normally acts and how a new request behaves. Security systems compare patterns such as login time, device, location, typing style, transaction size, or support-caller behavior. When a request does not fit the expected profile, it can be treated as suspicious.
This matters because many attacks succeed by copying identity signals while missing the rest of the person’s routine. A scammer may sound right or use a familiar photo, but still trigger a mismatch through unusual timing, a new device, a different payment pattern, or a request that does not match past behavior. Defenders use these mismatches to drive step-up authentication, block risky actions, or send them for review. In practice, behavioral mismatch is one of the clearest clues that a request may be fraudulent even when credentials or media look convincing.