AI-driven fraud in payments means attackers use generative models, bots and synthetic identities, while schemes, acquirers and PSPs answer with machine learning that scores risk in milliseconds. For a PayFac, PSP or ISO, the question is how to combine provider risk scores, pre-chargeback alerts and onboarding checks on one infrastructure, so every merchant on the platform benefits.
Fraud is no longer a side threat in payments. It is a structural cost, global, shifting, and increasingly automated on both sides. The schemes and the largest acquirers now run AI models on billions of transactions, and fraudsters use the same class of tools to mimic humans, pass verification and overwhelm static defenses. This article, updated in October 2026, covers why rules alone no longer hold, how attackers use generative AI, what the regional picture looks like, which techniques fraud engines combine, and how an operator serving merchants should layer its defenses across several providers.
Why are static fraud rules no longer enough in payments?
Static rules fail because they describe yesterday's attack, while fraud now changes faster than a rule set can be rewritten. Blocking large amounts, limiting IP changes or flagging blacklisted accounts still catches the obvious cases, but modern attacks are built to stay under every fixed threshold. Machine learning scores each transaction on hundreds of signals, including device fingerprint, session velocity, behavioral history and the relationships between cards, accounts and addresses, and adapts as the patterns move.
The scale of the problem explains the investment. According to the Nilson Report (January 2026), global card fraud losses reached $33.41 billion in 2024, or 6.43 cents per $100 of volume, and the report expects them to pass $41 billion by 2030. The same publication credits AI tools with giving the card industry "the best fraud fighting models it has ever had", which is why the decline in the loss rate coexists with record attack volumes. For the operators that serve merchants, large global PSPs have set the standard: models trained across an entire merchant base, scoring in real time, with policies on top rather than instead.
How do fraudsters use generative AI against onboarding and checkout?
Generative AI has lowered the cost of every step of a fraud operation: fake identity documents that pass automated checks, cloned voices for social engineering, phishing copy in any language, and bots that reproduce human browsing behavior at checkout. What once required an organized network now fits in a script, and the attacks hit two points of a payment platform at once: merchant onboarding, where synthetic identities try to open accounts, and the checkout, where stolen or synthetic credentials are tested.
The industry sees the shift. In Mastercard's February 2026 research with issuers and acquirers, 61 percent of respondents name synthetic identity fraud as the fastest-growing threat, ahead of impersonation scams (60 percent) and cross-border fraud (54 percent). The same piece cites an estimate from Deloitte's Center for Financial Services that generative AI could fuel $40 billion in US fraud losses by 2027, up from $12.3 billion in 2023. For an ISO or PayFac that boards merchants for acquiring partners, the synthetic merchant is now as real a risk as the stolen card.
How does payment fraud differ by region?
Fraud follows the dominant payment rail of each market, so a PSP active in several countries faces several fraud profiles at once. In Europe, strong customer authentication has pushed fraud toward the transactions it does not cover: according to the joint EBA-ECB report on payment fraud (December 2025), total fraud reached 4.2 billion euros in 2024, card fraud was 17 times higher when the payee was outside the EEA, and for credit transfers users bore about 85 percent of losses, mostly through scams that trick them into authorizing a payment themselves.
In India, the Unified Payments Interface carries the volume: NPCI data reported by Business Standard (October 2026) puts UPI at 24.07 billion transactions in September 2026 alone, which is why Indian banks score location, device and timing anomalies on every transfer. In Brazil, instant payments on Pix have moved fraud toward account takeover and coerced transfers, with banks monitoring transfer timing and geolocation; in several African markets, SIM-swap attacks on mobile money have pushed institutions toward behavioral biometrics. The form changes by region, but the three constants are speed, scale and subtlety.
Which AI techniques do fraud engines combine today?
No single model carries a modern fraud engine; providers combine several techniques, each covering a different blind spot. Behavioral biometrics read typing rhythm, device motion and scroll patterns to separate a human from a script. Graph-based machine learning maps the relationships between users, cards, devices and IP addresses to expose fraud rings that look clean one transaction at a time. Adaptive thresholds learn from every accepted or blocked transaction and tune the balance between fraud losses and false declines. Synthetic identity detection looks for inconsistencies in a new registration even when every document appears valid, and natural language models scan messages and support requests for manipulative language.
The schemes add the collaborative layer. According to Visa (March 2025), the network blocked $40 billion in attempted fraud in 2024 and has invested more than $12 billion in technology over five years, with investigators using generative AI to map relationships across mass transaction data. Mastercard reports that 83 percent of the organizations in its 2026 research say AI significantly reduced false positives and customer churn. These layers do not replace human review, but they decide which cases reach it.
How should a PSP or PayFac layer fraud defenses across several providers?
An operator that runs several acquirers and payment methods should not rely on one provider's engine but combine three layers it controls: provider-side scoring, routing and authentication rules per merchant, and post-authorization alerts, all fed by onboarding checks that keep synthetic merchants off the platform. Each acquirer and fraud provider on the stack brings its own model, trained on its own data. The operator's value is in what sits above them.
On a white-label payment infrastructure such as NORBr, that layer is configured per merchant and per market. Routing rules decide which provider processes a transaction based on geography, payment method, amount and risk level, so high-risk traffic can be sent to the provider best equipped for it while low-risk traffic keeps a frictionless path. Pre-chargeback alerts surface disputes raised by issuers before they become chargebacks, which gives merchants a window to refund and keeps their ratios inside scheme thresholds. Upstream, document review at KYB reads uploaded documents, flags expired identity papers and keeps a version history, which is where synthetic merchants are stopped before they ever transact; the multi-acquirer onboarding article describes that flow. The result for merchants is one checkout and one set of reports, under the operator's brand, with the fraud strategy owned by the operator rather than inherited from a single acquirer.
Why does collaboration between schemes, acquirers and platforms matter?
Collaboration matters because fraud rings operate across providers, sectors and borders, and no single company sees the whole pattern. The schemes' network-level models work precisely because they aggregate anonymized signals from billions of transactions across every issuer and acquirer. Scheme programs that share issuer-side dispute signals with merchants, and industry reporting such as the EBA-ECB exercise, extend that logic to the operators and platforms that board merchants.
For a PSP or PayFac, the practical form of collaboration is a stack where each provider's intelligence is available to every merchant, and where the operator's own data across all providers, such as decline reasons, dispute rates and routing outcomes, feeds back into its rules. That is the difference between adding a fraud tool and running a fraud strategy.
Is proving you are human the next frontier of payment fraud?
Yes, and it reaches beyond payments. Bots now pass CAPTCHA tests, deepfakes defeat selfie checks and generated emails fool trained professionals, so the problem is shifting from authenticating a known identity to establishing that a human exists on the other side at all. Proposals range from device-bound passkeys to biometric proof of personhood, which raises its own privacy questions. For payment operators, the near-term consequence is that identity verification at onboarding and step-up authentication at checkout will keep adding signals, and the infrastructure must be able to add them without a new integration project for every merchant.
The arms race is not ending, but it is becoming more legible. Fraudsters will keep exploiting the weakest link in the chain, and in a chain that runs from scheme to acquirer to PSP to merchant, the operator in the middle decides how strong the links it controls will be.
Sources
- The Nilson Report, "Global Card Fraud Losses at $33 Billion", January 2026
- Mastercard, "AI is helping banks save millions by transforming payment fraud prevention", February 2026
- EBA and ECB, joint report on payment fraud, December 2025
- Visa, "Visa Unveils its Scam Disruption Practice", March 2025
- Business Standard, UPI transactions in September 2026 (NPCI data), October 2026
_%2520a%2520game%2520changer%2520for%2520digital%2520transactions_-Cover.webp){kind=spacer}