The numbers stopped making sense around 2024
For years, fraud grew at roughly the same rate as digital commerce. More transactions meant more fraud attempts, but the ratios held. Then AI entered the picture, and the math broke. Merchants dealt with an average of 3.7 different fraud attack types in 2025, up from a baseline where most businesses only worried about one or two. Deepfakes, synthetic identities, coordinated bot campaigns, and AI generated phishing now run simultaneously against the same target.
Zero dollar authorization testing is up sharply. Fraudsters validate stolen card credentials by submitting $0 or micro authorizations that slip past most velocity filters. Once a card passes the test, it enters a "clean list" that sells at a premium in underground markets. The merchant whose gateway was used for validation never sees a chargeback, so the problem stays invisible until the scheme scales.
What the new attacks actually look like
Synthetic identity fraud is the hardest to catch because the identity is not stolen from a real person. Fraudsters combine a real government ID number with a fabricated name, date of birth, and address, then build credit history over months before cashing out. Traditional identity checks return a clean match because the synthetic profile has been in the system long enough to look legitimate.
Deepfake attacks have moved from novelty to operations. Voice clones now pass telephone verification at financial institutions, and face swaps clear video KYC checks in real time. The tools are commercially available, costing less than $20 a month, and they do not require technical sophistication to operate.
Coordinated bot campaigns run thousands of payment attempts across multiple merchants in minutes, rotating IP addresses, device fingerprints, and card details with each attempt. They learn which gateways block them and adapt on the next pass. A rule that caught the attack on Monday is already mapped and avoided by Wednesday.
Visa put $13 billion behind this problem
Visa has invested over $13 billion in technology and infrastructure over the past 5 years, with a significant share directed at ecosystem security. Its AI based fraud detection models now score 100% of VisaNet transactions in real time, roughly 76,000 per second at peak. In 2025 alone, Visa's systems helped prevent an estimated $40 billion in fraudulent transactions across the network.
The Visa Scam Disruption program has caught over $1 billion in scams by identifying and shutting down fraudulent merchant accounts before they can extract funds. Visa Account Attack Intelligence, which detects enumeration attacks, stopped 4.7 billion attempts in a single year, amounting to a 60% reduction in attack effectiveness for participating issuers.
What a merchant can do right now
You do not need a new platform to improve your position. Start with what you already have.
First, audit your authorization rules. If your velocity filters have not been updated in the last 12 months, they are almost certainly tuned for yesterday's attack patterns. Zero dollar authorizations should be flagged or blocked at the gateway level. Micro authorizations below your normal transaction floor deserve the same scrutiny.
Second, enable 3D Secure on every transaction where your acquirer supports it. The liability shift matters, but the behavioral data that 3DS collects during authentication is equally valuable. It gives your fraud stack a signal that static rules cannot replicate.
Third, review your dispute ratios monthly, not quarterly. Visa's updated VAMP thresholds dropped from 220 to 150 basis points for excessive fraud in the US, Canada, and the EU. If you are processing internationally, your acquiring bank may be monitoring ratios you have not checked recently.
Fourth, watch for enumeration attacks on your checkout. A sudden spike in declined authorizations, especially from card ranges you do not normally see, is the signature. If your gateway offers Account Attack Intelligence or a similar enumeration detection tool, turn it on.
Fraud is no longer a cost of doing business that scales predictably. It is an adversarial, adaptive problem, and the merchants who treat it that way will spend less on it over time than those still relying on rules written for a slower era.