Visa’s Spring 2026 Biannual Threats Report shows scams have become the fastest‑growing source of consumer harm, with nearly $1 billion in scam‑related activity identified from July‑December 2025. While device‑token fraud fell 9.6% year‑over‑year, criminals are shifting toward AI‑driven social engineering that exploits human trust rather than technical vulnerabilities.
The Update
Visa’s latest biannual report, based on intelligence from its global payments network, highlights four key trends:
- Security is working, but fraud is migrating – Device‑token fraud declined 9.6% in the second half of 2025 versus the same period in 2024, indicating stronger authentication and network‑level protections.
- Scams are accelerating – Scam activity now accounts for the largest share of consumer payment fraud, with almost $1 billion recorded in the July‑December 2025 window.
- AI is transforming fraud on both sides – Fraudsters use AI to generate convincing scams at scale, while Visa and its partners increasingly rely on AI to detect and block attacks earlier in the transaction lifecycle.
- Ransomware economics are shifting – Global ransomware incidents rose 26% year‑over‑year, but the ransom‑payment rate fell to 23%, the lowest on record, suggesting improved resilience and a reluctance to pay.
Paul Fabara, Visa’s Chief Risk and Client Services Officer, said the network is becoming safer, yet threats are evolving faster than ever. Michael Jabbara, SVP of Payment Ecosystem Risk and Control, added that AI has lowered the barrier to entry for fraud, making intelligence‑driven defenses and ecosystem coordination critical.
Business Context
The report underscores a broader industry transition: as tokenization, 3‑D Secure, and other network‑level safeguards reduce technical breach vectors, fraudsters are redirecting resources toward human‑focused attacks. Scams typically involve impersonating trusted brands, creating urgency, and prompting victims to authorize legitimate‑looking payments—methods that bypass technical controls entirely.
For banks and merchants, this shift means traditional fraud‑prevention tools (e.g., device fingerprinting) are less effective against socially engineered attacks. The rise of AI‑generated deepfakes, synthetic voice calls, and automated phishing scripts amplifies the scale and plausibility of scams, increasing operational pressure on compliance and customer‑service teams.
Market Signal
Visa’s identification of a $1 billion scam volume signals that AI‑enabled social engineering is moving from a niche threat to a mainstream risk factor for the payments ecosystem. The simultaneous decline in device‑token fraud suggests that existing security investments are yielding results, but the net fraud exposure remains upward due to the scam surge.
The ransomware data point—higher incident counts but lower payment rates—indicates that while attackers are more active, victims are better equipped to mitigate or refuse payment, possibly reflecting improved incident‑response frameworks and legal pressures.
What It Means for Buyers, Banks, or Investors
- Banks and issuers must augment technical controls with behavioral analytics, real‑time customer verification, and AI‑driven monitoring to detect anomalous social‑engineering patterns.
- Merchants should reinforce brand‑authentication channels (e.g., verified sender IDs, secure messaging) and train staff to recognize AI‑generated fraud cues.
- Investors in payment processors and fintech platforms should assess how firms are integrating AI‑based fraud detection and whether they have coordinated response plans with Visa and other network participants.
- Regulators and policymakers may consider guidance on AI‑generated fraud disclosures and standards for cross‑industry information sharing.
Key Takeaways
- Visa identified nearly $1 billion in scam‑related activity from July‑December 2025, making scams the largest consumer fraud category.
- Device‑token fraud fell 9.6% year‑over‑year, indicating that network‑level security improvements are effective.
- AI is a dual‑use technology, enabling fraudsters to scale scams while also powering Visa’s defensive analytics.
FinanceInsyte's Take
The Visa report highlights a pivotal inflection point: technical defenses are maturing, but human vulnerability remains the weakest link. Decision‑makers should prioritize investments in AI‑enhanced behavioral monitoring and cross‑entity threat intelligence sharing to stay ahead of socially engineered attacks. While Visa’s network upgrades are reducing token‑based fraud, the rapid adoption of AI by criminals suggests that resilience will increasingly depend on how quickly banks, merchants, and regulators can align on real‑time verification standards and collaborative response frameworks. Ongoing visibility into scam trends and the effectiveness of AI‑driven defenses will be essential for managing risk in a landscape where the threat vector is shifting from code to conversation.
Source: Businesswire
