Digital Transactions Authoritative, insightful and timely information for payments professionals
Fraudsters are becoming better organized and building industrial-strength infrastructures to commit fraud, making their actions harder to detect and prevent, says Visa Inc.’s Fall 2025 Biannual Threats Report.
The report, which pulls data from the Visa’s global network, identifies the five biggest fraud threats facing the payments ecosystem: the industrialization of fraud from artisan to assembly-line attacks; the development of a monetization playbook to maximize the value of stolen cardholder credentials; the increase of synthetic content generated by artificial intelligence; the erosion of legacy defenses; and the vulnerability of third parties—such as service providers, processors, merchants, and non-financial ecosystem participants—to attack.
The five threats “reveal how criminals are adapting faster, operating at greater scale, and exploiting structural vulnerabilities in ways that challenge conventional defenses,” the report says. As a result, “criminals are faster, smarter, more coordinated, and more sophisticated than ever before,” it warns.
The move by criminals to create assembly-line fraud attacks depends on their use of such technology as botnets, synthetic identities, templated scam scripts, and AI tooling, which can simultaneously be deployed across multiple attack types with the efficiency and scalability of a tech startup.
“Criminals operate with R&D cycles, go-to-market strategies, and continuous improvement processes,” the report says. “This industrialization means defenses must also transform: moving from case-by-case fraud detection to intelligence-driven disruption of criminal infrastructure before it scales.”
Fraudsters’ monetization playbook indicates they are not just stealing cardholder data, they are strategically timing the use of it to maximize their financial gains and avoid detection. Criminals are routinely aging stolen cardholder data at least 12 months before using it. When criminals begin to use the data, they look to exploit instant payment channels, such as real-time payments, digital wallets, and cryptocurrency.
“The12-month lag between compromise and exploitation creates a persistent, latent risk pool that traditional real-time fraud detection struggles to address,” says the report. “Consumers believe ‘if my card hasn’t been used fraudulently yet, I’m safe’ — but their data may already be in a criminal warehouse waiting for the optimal monetization moment. And when that moment comes, the money moves so fast that by the time fraud is detected, recovery is difficult, if not impossible.”
Fraudsters’ growing use of AI is making it harder to verify legitimate transactions and communications across the payment ecosystem. As a result, a trust vacuum is emerging.
“If AI can fake anything — websites, identities, conversations, documentation — how do consumers and institutions distinguish real from fake? Traditional due diligence (Does this look professional? Does this person sound legitimate? Are the documents in order?) no longer provides a reliable signal,” the report says.
The erosion of legacy fraud defenses is a sign that fraud techniques and scams are evolving faster than traditional defenses, such as rules-based controls, human review of transactions, and perimeter defenses, can detect and stop them.
“This creates an arms race where defenders are in danger of falling behind— not because they’re not investing, but because the pace of adversary innovation is outstripping the pace of control evolution,” the report says.
The increasing vulnerability of third parties within the payments system is a sign that fraudsters see them as weak links, warns the report. Because third parties operate across multiple payment networks and jurisdictions, a breach at one can impact the entire ecosystem, thereby creating cascading risks. For example, a compromised third-party payment gateway can expose millions of accounts to fraudsters, while a poorly vetted merchant can become a scam platform.
“This creates a trust paradox: consumers trust their bank’s security, but their payment data is often exposed through a merchant, processor, or vendor they’ve never heard of and have no relationship with,” notes the report.
