How Banks Can Fend Off Increasingly Sophisticated AI-powered Payment Attacks

The Rise of Artificial Intelligence in Fraud

Perhaps the most concerning trend identified in Visa’s report is criminals’ growing sophistication in deploying AI technology. A February 2024 incident highlighted this evolution when scammers used AI-generated deepfake video and voice technology to convince a Hong Kong finance employee to wire $25.6 million to fraudulent accounts. The criminals created a convincing digital impersonation of the company’s chief financial officer, demonstrating how AI can be weaponized to make traditionally suspicious requests appear legitimate.

"It takes only three seconds of audio to clone a voice using AI technology," notes the report, explaining that fraudsters can easily obtain voice samples from social media posts or voicemail messages. This capability — combined with AI’s ability to mimic human movements and writing styles — is making it increasingly difficult for potential victims to distinguish genuine requests from sophisticated scams.

What’s potentially even more concerning is that criminal organizations are showing greater patience and strategic thinking in their attack methodologies. Visa observed a significant shift away from immediate card testing toward delayed cashouts happening 8 to 90 days after account compromise. This tactical change appears designed to evade fraud detection systems that focus on suspicious activity immediately following account compromise.

Purchase Return Authorization (PRA) fraud has emerged as a particular concern, with investigations jumping 81% compared to the previous six months. In these schemes, criminals compromise legitimate merchant gateways to initiate fraudulent return authorizations, immediately cashing out funds through ATM withdrawals or peer-to-peer payment systems before the fraud can be detected.

Enumeration attacks — where criminals use automated systems to guess payment card details — continue to pose a significant threat, especially in the U.S. The report revealed a 16% year-over-year increase in these attacks targeting U.S. financial institutions, though there was a 3% decrease in attacks targeting U.S. merchant acquirers.

Keep An Eye Out:

There was a 16% YoY increase in enumeration attacks in 2024, where criminals guess credit and debit card details using automation systems.

A Return to Physical Theft

In an unexpected twist, Visa’s report identifies a resurgence in physical card theft and fraud. Despite the industry’s focus on cybersecurity, criminals are increasingly returning to traditional theft methods — including vehicle break-ins, mail theft and pickpocketing. This trend appears to be driven by stronger digital security measures, pushing some fraudsters back to more straightforward, if risky, approaches.

The report also highlights a new scheme dubbed "digital pickpocketing," where criminals use mobile point-of-sale devices registered to fraudulent merchant accounts to conduct unauthorized contactless transactions by getting close to victims’ wallets or purses.

Dig deeper:

• In the Battle Against Bank Fraud, The Very First Login is Critical
• Can Digital Check Deposit Survive in the Face of Rising Fraud?
• How Spending Priorities and Financial Health Guide Consumer Credit Card Choices

Government Impersonation Scams Are Evolving

The report identifies an interesting shift in government impersonation scams, with criminals now preferring cash payments sent through mail or courier services rather than digital payments. According to the Federal Trade Commission, the average victim lost $14,000 in these schemes during the first quarter of 2024, with total losses reaching $20 million.

This pivot to cash payments appears designed to circumvent traditional fraud detection systems and makes it harder for authorities to trace and recover stolen funds. The trend has led to a notable increase in large cash withdrawals at ATMs and bank branches.

While ransomware and data breaches showed a 12.3% decline compared to late 2023, attacks are becoming more strategic and impactful. The report notes a 24% increase in targeting of third-party service providers, reflecting criminals’ preference for attacking organizations that can provide access to multiple downstream targets.

Digital skimming attacks remained steady but increasingly targeted North American merchants, accounting for a little over half of all detected compromises. These attacks have evolved to include more sophisticated techniques for harvesting payment data, including the use of malicious JavaScript to redirect customers to fake checkout pages.