Payments industry seeks to keep pace with fraudsters

Financial institutions need federal rule changes – and coordination with other industries – to attack online fraud more comprehensively, fraud-fighting professionals said Wednesday in an online panel discussion.

In other nations, a cross-sector approach has delivered “some good lessons learned,” said Donna Turner, a consultant with Risk Insight Solutions and former chief operating officer for Early Warning Services, the bank-owned parent of Zelle and Paze. “We got to get there through a cross-sector approach to this, which we’ve seen in other geographies.”

Turner and other panelists spoke Wednesday during a virtual event focused on how the battle against fraud has changed with artificial intelligence, Attacking Fraud in the AI Age, which was hosted jointly by Payments Dive and Banking Dive. 

Combining anti-fraud efforts across banks, telecommunications and social media companies could prove effective as fraud actors continue innovating with new AI-enabled tools, said Paul Benda, executive vice president of risk, fraud and cybersecurity for the American Bankers Association.

“If we really want to prevent this, we have to get the signals from the telecoms, from the social media companies, into the banks,” Benda said. “We have to share the account data back and forth so that we can trace this down to the end, and then we can stop sending funds to those accounts that we know are actively being used for fraud.”

Mark Kwapiszeski, executive chief information officer at PNC Bank, and David Maimon, head of fraud insights at SentiLink, a San Francisco-based fraud and risk solutions firm, were also on the panel.

Kwapiszeski said that financial institutions need to improve their anti-fraud coordination to reap a more proactive posture in the battle, “so that we can start taking down the entire fraud network,” he said.

“An area that I would love to see us kind of get more into, is, how could we use AI across the institutions to really get better pictures of how the network is actually holding together, and just like any other criminal enterprise, if you take down certain parts of it, it all kind of comes crumbling down,” Kwapiszeski said.

Legislatively, financial institutions need a modernized safe harbor provision to offer enhanced liability protections as they coordinate their anti-fraud efforts, Turner argued. The industry’s current, limited safe harbor protections derive from the Bank Secrecy Act, which allows financial institutions to share data related to suspected money laundering or terrorist activity.

Benda contended that the BSA’s safe harbor limitations argue for a different regulatory approach to empower information-sharing among banks and non-banks.

The current BSA provision has timelines that don’t prevent or stop fraud and only financial institutions are covered by it, and not other sectors, Benda said. “It’s never going to be a functional tool in preventing fraud,” he said.

The government’s role in combating financial fraud gained new relevance last week when President Donald Trump issued an executive order on cybercrime, mandating a federal review within 60 days of tools and capabilities that could be mustered against “transnational criminal organizations.” 

The order also called for an “action plan” within 120 days “to prevent, disrupt, investigate, and dismantle” the criminal groups perpetrating online frauds.  

Trump has also nominated a Justice Department attorney, Colin McDonald, to lead a new national fraud enforcement division within the department. McDonald is awaiting a Senate vote on his confirmation.

Americans are bilked out of $119 billion annually, the Consumer Federation of America estimated in a new study published Thursday.

The amount is based on an FBI report of $16.6 billion in 2024 losses due to internet scams, and then was increased to take account of Bureau of Justice Statistics percentages for estimated losses that are unreported.

California, Texas, New York and Florida were the states hardest hit by the online fraud, according to the FBI’s Internet Crime Complaint Center data, but less heavily populated states also incurred significant losses. Nevada and Wyoming suffered high per capita losses and some states, such as Michigan and South Carolina, seemed to be targeted for scams for various reasons, according to the consumer organization’s report.

“The devastating scale of losses represents a crisis that demands swift and unflinching attention, as people increasingly feel unsafe online,” CFA Director of AI and Privacy Ben Winters said in a press release accompanying the report. “These statistics show that action across the economy - increasing platform liability, shutting down data brokers, improving reporting mechanisms, regulating generative AI, and beefing up consumer protection enforcement resources – are not only exciting ideas but mandates for a safe future.”

The federation’s report pointed to social media outlets, specifically Meta’s Facebook, Instagram and Whatsapp, as tools used by scammers to trick consumers, especially the elderly, into handing over their money. The company didn’t immediately respond to a request for comment.

However, in a statement Wednesday, Meta described how it’s introducing new tools on Facebook and Whatsapp to help fight fraud, partnering with law enforcement to stop criminals and taking down ads on its social media sites that have violated its policies.

The Consumer Federation of America used its report as a call to action for policy-makers and regulators.

Some of them heralded the report as a basis to support initiatives they’ve already introduced, including a bipartisan bill introduced last month by Sens. Ruben Gallego (D-AZ) and Bernie Moreno (R-OH). Their proposed Safeguarding Consumers from Advertising Misconduct Act would push online sites to increase fraud prevention and hold them accountable when it happens.

“Social media has become a prime hunting ground for scammers to swindle Americans out of nearly $119 billion a year. This report makes it clear that accountability is long overdue,” Gallego said in the federation release. “If companies are making money by pushing ads onto users’ feeds, they have a responsibility to make sure those ads aren’t fraudulent.”

Earlier this month, President Donald Trump issued a directive to help fight “cybercrime, fraud, and predatory schemes” targeting Americans and businesses in the country. The move put the Administration on the hook to review the issue and take action.

“The United States shall counter attacks on Americans with a commensurate response that includes law enforcement, diplomacy, and potential offensive actions,” the directive said.

A top California regulator, Christina Tetreault, who is deputy commissioner for the state’s Office of Financial Technology Innovation, also underscored the fraud problem and the need to combat online criminals during a virtual event hosted by Payments Dive and Banking Dive Wednesday that focused on such fraud in the age of artificial intelligence. 

California absorbs the highest losses, with some $18.1 billion stolen across the state, or about $460 per person, according to the federation’s report. 

“It’s an all-hands-on-deck moment,” Tetreault said during the event. “Many of these scams and fraud are being done from overseas, [from] these vast scam compounds, and there's an entire criminal enterprise industry that’s working 24/7 to separate Californians from their money – that absolutely keeps me up at night.”

She noted the benefit of the president’s directive, and outlined steps her state is taking to address the fraud, including using consumer awareness campaigns, cross-industry collaboration and technology tools to fend off the fraud.

Sponsored content

By Spreedly

There’s a growing idea that advanced AI is going to ride in on a white horse and finally put digital fraud out of its misery, which, for everyone involved, would be a pretty wonderful outcome. The reality is that it’s going to be more complicated than that.

AI and agentic commerce are just reshaping the playing field. As AI agents get out there and start browsing, comparing, and clicking “Buy” on behalf of the good people of the internet, the opportunity for fraud isn’t necessarily shrinking or growing, it just seems like it’s mutating into something else entirely.

That mutation is taking space from other means of purchasing, though. Analysts project that roughly $750 billion in US consumer spend will move through AI powered search experiences by 2028. During the 2025 holiday season alone, traffic to retail sites from generative AI tools jumped 693.4% YoY. It’s definitely taking a bite out of what we’ve come to know as “traditional methods” in the digital age.

While payments professionals like you and I are paying close attention, you can bet your holiday bonus that criminals are mapping the terrain like a Florida Keys dive crew that knows exactly where the shipwreck is.

The New Threat Actors: Who is Weaponizing AI?

The profile of the digital fraudster is becoming a lot more sophisticated. It’s gone from Jessie James to Bonnie & Clyde to Frank Abagnale faster than an FBI Most Wanted photo can turn into a Netflix docuseries.

In the agentic era, we’re not going to be up against a kid in a hoodie guessing passwords in a basement (very often). The real threat is likely to come from state-backed operators in regions where hard currency is scarce and digital extraction is a part of the local economy. There are groups who have spent years exploiting online financial loopholes to move money across borders, and they have the funding, technical depth, and strategic patience to build large scale AI-driven commerce fraud that looks less like petty theft and more like economic policy.

Below that level, and much noisier, are decentralized hacker communities that treat new technology the way the Lockpicking Lawyer treats anything labeled “secure.” The moment agentic commerce scales, they’ll point generative models at checkout flows, identity logic, and orchestration layers, hunting for shared weaknesses and patterns they can industrialize. What used to take two weeks of manual testing and 17 boxes of hot pockets is now something that can be automated, iterated, and refined in hours.

It means we’re looking at risk that sits well below the margins of experimentation. This report warns that by 2028, misconfigured or compromised AI systems could be capable of disrupting critical infrastructure in a G20 country. At that scale, payments infrastructure carries implications that extend into broader economic stability, operating as part of the underlying financial plumbing that keeps modern markets moving.

AI as digital street smarts

To fight fire with fire, defensive AI is going to need to be like a cashier at a bodega with actual street smarts, analyzing complex workflows in microseconds and flagging risk before money moves.

We’re already seeing the industry respond. AI has already become foundational to fraud detection in financial services, with the vast majority of banks now using machine learning models to monitor transactions and detect anomalies. Trained on incomprehensibly large datasets, they’re spotting faint anomalies in the flow of transactions and strengthening defenses as conditions change.

Stronger machine-to-machine validation is going to be sitting at the center of this shift, operating like air traffic control for automated transactions, where secure handshakes and advanced cryptograms confirm an AI agent’s legitimacy before a payment is cleared.

Institutions pull ahead when they connect risk signals across the full transaction lifecycle, carrying that discipline beyond retail checkout and into B2B cash flow strategy.

Navigating the AI arms race

As fraud networks deploy new AI agents to probe defenses, financial institutions will have to train and retrain their models the way Formula 1 teams tune engines between laps. This isn’t a software patch you install and forget. It’s a live system that learns, adjusts, and recalibrates in real time. The organizations that win will be the ones that treat adaptation like a muscle, not a milestone.

At the same time, security can’t act like a smoke alarm that goes off every time someone makes toast. Fraud controls that swing too hard generate false positives and block legitimate customers, quietly chipping away at both revenue and trust. The real edge will belong to systems that can read context at speed, approving the right transactions with confidence while isolating the truly suspicious ones without drama.

The future of digital transactions will rest on platforms that see the whole chessboard, not just the last move. Fraud doesn’t begin at authorization, and it certainly doesn’t end at settlement, which means risk has to be tracked across the entire buyer’s journey, from first signal to final clearing. The platforms that lead in this era will weave continuous intelligence into every transaction, ensuring their systems stay aligned with a threat landscape that never stands still.

Dive Brief:

• American Express is tapping its customers to help stay apprised of the latest fraud trends, an executive said in a Monday interview.
• The credit card giant collects data from conversations with card holders who have been the subjects of fraud attempts or have been fraud victims, said Gerardo Mejia, executive vice president of fraud operations for the bank and credit card issuer.
• "It's a way to learn what's happening," he said. "How are the attacks happening, and how are the bad actors evolving? We need to learn from the customers how much information they share with them, or what was the tactic [scammers] were using, or what are the things that they thought about as they were interacting with the bad actors."

Dive Insight:

All of this information helps the New York-based company build sturdier defenses, Mejia said.

U.S. consumers reported losing $12.5 billion to fraud in 2024, according to the Federal Trade Commission, a 25% increase over 2023. The FTC has not released figures for 2025.

Generative artificial intelligence has the potential to supercharge fraud, according to experts, creating a sense of urgency in the fight to stay ahead of bad actors. 

"Back in the day, big institutions had access to the latest technology," Mejia said. "Now, almost everybody has access to similar technology."

Amex is mostly seeing the same kind of text message, email and romance scams that have bedeviled other payment companies and credit card networks in recent years, he said.

Scammers typically try to build a relationship with an unsuspecting consumer and then trick them into sending money. Now, artificial intelligence can hold a conversation, produce more realistic messages and allow a single fraudster to perpetuate fraud on a widespread scale. 

Banks and payment companies are starting to look for red flags to stop fraudulent transactions before money is lost. Customers sharing their experience helps companies like American Express decide what those red flags are, Mejia said.

In the past couple of years, lawmakers have pressured payment players to better tackle scams and fraud. 

Senators have dragged executives from companies such as Early Warning Services — which operates the peer-to-peer payment service Zelle — in front of congressional committees to grill them on what they are doing to keep users safe. 

Conversations with customers are crucial, Mejia said. "Just as we are trying to innovate, on the other side of the desk, the bad actors are also innovating," he said.

Customer experiences provide a critical data set that Amex can use to spot any changes in the way fraudsters operate and develop countermeasures, Mejia said.

Dive Brief:

• Fraud loss rates have climbed for debit cardholders, according to a Kansas City Federal Reserve Bank analysis issued Wednesday that is based on Federal Reserve Board data released in December. The actual loss rates detailed in the report differed depending on whether the transactions moved over a dual-message network, like that offered by card giant Visa, or a single-message network, such as Star or NYCE.
• That 2023 data set for non-prepaid debit fraud showed the loss rate for cardholders rose over 2021 when debit cards were used to pay for goods or services online or in stores. Meanwhile, it wasn’t always the case that the loss rates rose for merchants and card issuers, according to the Kansas City report comparing 2021 and 2023 data.
• Overall, the incidence of debit card fraud climbed for e-commerce purchases between 2021 and 2023, but in some cases in-person fraud rates on debit card transactions declined during that period, the analysis said.

Dive Insight:

The Kansas City analysis dug into the debit data issued by the Federal Reserve Board in December as part of its biennial report on debit card use last year. That report rekindled debate over the central bank’s decision to reset a cap on debit card interchange fees that revolve to some degree around fraud rates.

The latest debit card analysis from the Kansas City Fed bank explained how the arrival of EMV chips implanted in cards as of 2015 was part of an effort to decrease fraud for in-person commerce. Despite that effort, debit card fraud has continued to climb across use scenarios. (The analysis didn’t address credit card fraud.)

“Card-not-present fraud rates of non-prepaid debit cards have continued to climb,” the Kansas City report said. “In contrast, card-present fraud rates have reversed their previous trend, declining for dual-message networks and increasing for single-message networks.”

The Kansas City report noted that fraud is most prevalent among ”financially vulnerable consumers,” according to a different Fed study published last year, with those victims also more likely to incur losses.

“Uncovering which types of consumers are more likely to experience debit card fraud and incur fraud losses may help explain why cardholders’ fraud loss rates have been increasing and inform efforts to mitigate them,” the latest Kansas City Fed report concluded.

Combatting payments fraud isn’t likely to get easier this year, and some professionals acknowledge it could get tougher as artificial intelligence spawns new threats.

U.S. consumers and businesses remain juicy targets for fraudsters rolling victims by way of duplicitous imposter scams, check washing operations and synthetic identity schemes, among other ploys. The increasing acceptance of digital assets in the marketplace, as the Genius Act brings stablecoins into payments, may provide yet another avenue for taking advantage.

Criminal use of artificial intelligence, with its deepfake potential to sharpen fraudsters’ tricks, is expected to spool up in 2026, even as the payments industry embraces AI for agentic commerce. As companies jockey for an AI edge, they’ll teeter between positive prospects and perilous possibilities in a period of transition.

“Where there is confusion, there is opportunity,” industry consultant Peter Tapling said regarding AI’s arrival. “It’s moving fast, and it’s going to take time,” he observed during an interview Monday. He explained that the AI age has set in quickly for the industry, but is still developing. 

Classic fraud types, such as check tampering, remain problematic despite President Donald Trump’s executive order last year forcing the federal government to stop sending paper checks. About two-thirds of businesses encountered check fraud in 2024 and it was the method most frequently cited for fraud that year, according to the latest survey on the subject from the Association for Financial Professionals. 

Nonetheless, this year the industry will likely be focused on new, emerging threats. The payments industry has become arguably obsessed with AI-powered agentic commerce, and the possibilities it poses for creating agents that will not only shop, but also buy goods and services on behalf of consumers and businesses. Card networks, processors and fintechs are racing to harness the increased payments volume potential.

At the same time, AI presents dangers for the industry. Criminals have already made big strides industrializing their fraud schemes and scaling those attacks. Now, AI may allow for directing even more believable come-ons at victims, seeking to dupe them into sending money under false pretenses. 

How AI is benefitting fraudsters

Bad actors are increasing their personalization in payment cons and better mimicking of trusted contacts to be more convincing, says Colin Parsons, who is head of fraud product strategy at the financial software firm Nasdaq Verafin. That’s true even for savvy individuals, he said.

This growing sophistication shows up in fraudsters’ use of synthetic or stolen identities to open accounts; creating fake bank websites to elicit customer information; and in impersonating grandchildren to dupe the elderly, he explained.

“Those situations just continue to become more sophisticated, and harder for an individual to understand that they’re not actually interacting with the person that they think they are through the chat, or through a phone call, through email,” Parsons said in an interview this month.

The impact of AI on payments is complicated by tandem trends happening in payments, says Forrester analyst Lily Varon, noting agentic commerce and the evolution of passwords. These trends sometimes challenge the existing rules for payment authentication, authorization and fraud liability, among other core principles, in the payments processing system, Varon said.

“We've got a few different streams of things happening at once,” Varon said in an interview last month. ”AI is improving the quality of deep fakes; [and] the growing adoption of AI tools is facilitating the creation of them,” she said. “And even though the main vector for fraud, with deep fakes, will be social engineering, it can and will impact payment authentication as well.”

Password practices evolve

That’s happening as passwords and passcodes are increasingly seen as ineffective, Varon noted. So, as the industry tries to move toward a future without passwords – historically seen as the best way to authenticate users — it’s grappling with how best to verify users.

That issue is exacerbated by the notion of agentic commerce because it entails shopping and payments by formerly suspect bots that now are empowered to complete transactions on consumers’ behalf. 

“There's a lot of excitement about agentic AI and how it might apply it to payments, but there's also a lot of concern about how it might be taken advantage of, just as deepfakes have taken advantage of generative AI's ability to process voice and image and text,” Tapling said.

Biometrics may bolster defenses

Varon predicts biometric authentication will help bridge the gap, as more service providers and consumers embrace FIDO passkeys, which are Fast Identity Online standards linked to cryptographic keys tied to particular devices that are accessed by fingerprints, face scans or other such physical attributes. 

AI is also bolstering anti-fraud defenses by spotting fraud. “Artificial intelligence is really allowing technology providers and institutions to leverage this new technology and use it in a way that's very positive for identifying fraud,” Parsons said. 

Tapling noted the same, saying AI is used against fraud both on the frontlines, interacting with consumers, and also in the back-office. He pointed to the New York company Reality Defender using AI to detect deepfakes. “We're now using AI to identify AI,” he explained. “They've built an AI model that senses, ‘is the video that I'm looking at a deep fake?’”

Companies are also employing AI, with help from financial crime software companies like Unit 21, to improve tracking of fraudulent transactions, Tapling said. “There's all kinds of ways that we can use AI, both at the time of a transaction event, to try and give me more signals or enrich the signals that I have, but also at the back end,” he said.

Fighting push-payments scams

One of the most pernicious frauds to gain traction in recent years is push-payment fraud, those instances where criminals hoodwink consumers and businesses into voluntarily sending money to crooked accounts. It’s been particularly difficult to fight because of the voluntary nature of the money transfers.

It has attracted the attention of Congress members as stories of victims facing major losses in such scams have proliferated. 

Organizations have sought to educate the public about such snares and companies have acted to upgrade systems and tools to confront such swindling. Concerns have climbed as speedier payments systems have become available.

Since the Federal Reserve launched its instant payments system FedNow in 2023, users have called for such increased capabilities. The Fed said this month that it’s working on anti-fraud upgrades to FedNow.

The central bank has added a feature that gives FedNow users “the ability to verify a beneficiary name associated with the account of an intended payment,” according to a Jan. 15 press release. 

The central bank also has a FedNow pilot program underway that will let banks and credit unions that use the system “pre-check” a receiver account before sending a payment over the real-time system, according to the release.

Sharing information to fight fraud

Apprehension among financial institutions about the exchange of information – whether due to privacy laws, competitive instincts or other considerations — has long hampered communication and cooperation that many believe could better thwart payments fraud.

Federal Reserve Vice Chair for Supervision Michelle Bowman pointed to the barriers standing in the way of a stronger collective financial institution front in the battle against fraud.

“When banks share the latest information about fraud prevention among themselves — if some of the data is currently classified as [confidential supervisory information] — the disclosure can be prohibited, even if sharing it could make all banks more resilient to emerging fraud risks,” she said in a Jan. 7 speech in California.

She suggested in that speech, which was focused on modernizing regulations, that the federal government needs to change its approach to better address fraud. The Fed is reviewing how to better define instances where such information might be shared.

Verafin also attempts to help financial institutions share intelligence to fight fraud.

“The primary way that we see for financial institutions to prevent this type of fraud [via individuals] is by leveraging the intelligence across networks, understanding what's happening, not only within their institution, but outside of their institution, and working together to prevent financial crime,” Parsons said.