How AI Detects Fraud in Digital Payments in 2026

What You'll Learn

• How AI combines transaction, device, behavioural, merchant, and network context.
• Why real-time payment systems need fast risk decisions without treating speed as proof of accuracy.
• How Visa, Mastercard, and BIS describe scoring, feedback, network analytics, and model limits.
• Why data quality, explainability, privacy, and human review remain part of fraud control.

Short Answer: How AI Detects Payment Fraud

AI fraud detection uses machine-learning models to examine signals around a payment and estimate whether the activity looks legitimate or suspicious. Visa describes inputs such as customer identity, transaction velocity, geolocation, and device intelligence. Mastercard describes transaction patterns, behavioural trends, merchant activity, network intelligence, and digital-identity insights. The model can then support a risk decision or send the case to a review workflow.

This is different from a single rule such as “decline every purchase above a fixed amount.” Static rules still have a role, but Visa and Mastercard both explain that models can add context and adapt as fraud patterns change. A customer buying from a new location is not automatically fraudulent. The useful question is whether that location appears alongside other signals such as unusual velocity, an unfamiliar device, a new merchant pattern, or confirmed account compromise.

AI does not prove that a transaction is safe. It can miss a new attack, rely on poor data, or incorrectly challenge a genuine customer. The most defensible description is that AI helps payment providers make more informed, timely decisions while existing controls, investigations, authentication, and governance remain necessary.

For background on faster payment infrastructure, readers can review the real-time payments guide. That article provides context, not additional evidence for the specific AI mechanisms discussed here.

Why Digital-Payment Fraud Is Hard to Detect

Digital payments move quickly and involve several participants. A payment may pass through a merchant, acquirer, issuer, network, wallet, authentication service, and other providers. A fraudster may also distribute activity across accounts or institutions. BIS Project Hertha describes criminals operating in complex networks of accounts across multiple financial institutions, which can make isolated reviews less informative.

Real-time processing narrows the window in which a provider can identify and deflect suspicious activity. Mastercard’s 2026 explainer says transactions can be processed within seconds and that fraudsters may move money through multiple accounts before detection. The point is not that every suspicious payment must be stopped instantly. It is that the control system needs timely signals and a clear action path.

Traditional systems often use fixed rules and manual review queues. A rule can be easy to explain, but it may become stale when customer behaviour, merchant patterns, or criminal tactics change. An analyst can investigate nuance, but a large payment flow cannot send every transaction to a person. AI is used to narrow that gap by ranking risk and identifying combinations of signals that deserve attention.

The open-banking regulations explainer is a useful adjacent read because payment-data sharing must be considered alongside permissions and regulatory obligations. It is not a source for the performance of any fraud model.

From Static Rules to Contextual Risk Scoring

AI changes fraud screening mainly by adding context. Instead of asking only whether a payment crosses a preset threshold, a model can compare it with a customer’s prior behaviour, the merchant’s history, the device, the location, and the recent sequence of actions. Visa describes a risk score on its Decision Manager system that typically ranges from 0 for low risk to 99 for high risk. That range is a Visa product description, not a universal standard.

Mastercard describes a similar principle in its Decision Intelligence materials. It says near-real-time risk scores and contextual insights can support authorization decisions. Its Merchant User Connected Intelligence algorithm is described as connecting patterns across users, merchants, and transactions so a provider receives context rather than a score alone.

A score is not a verdict by itself. A merchant or issuer decides what to do with it based on its risk tolerance, product, jurisdiction, customer relationship, and available authentication. One provider might approve a low-risk payment, another might request an additional check, and a third might send it to manual review. That difference is a policy choice, not evidence that one model is universally correct.

Visa also describes combining machine learning with custom rules engines. This hybrid approach matters because a model can identify patterns while a business rule can express a known restriction, a market requirement, or a temporary response to a new attack. Rules can add control, but they need review so that they do not create unnecessary false declines.

For a wider discussion of enterprise AI controls, readers can see the AI agents and enterprise governance guide. It is background context and does not establish a payment provider’s model results.

Transaction and Customer Signals

AI fraud systems can combine several signals instead of treating one unusual event as conclusive. Visa names customer identity, transaction velocity, geolocation, and device intelligence. Mastercard also discusses merchant data, network intelligence, and consumer digital-identity insights. The signals are useful because fraud often appears as a relationship between events rather than as one isolated number.

Transaction history can show whether a payment fits a customer’s usual pattern. Merchant context can show whether a seller has an unusual history of disputes or suspicious activity. Device intelligence can indicate that the device is unfamiliar, emulated, or behaving like automation. Geolocation can show a mismatch with recent activity. None of these signals is perfect, and some can be shared by legitimate family members, travellers, businesses, or privacy tools.

Velocity measures the pace or frequency of events within a period. A sequence of repeated low-value attempts can suggest credential testing. Several account changes followed by a payment can warrant stronger authentication. A sudden burst of activity across locations can require review. The model’s task is to weigh the combination and provide a reason that an operator can understand.

Behavioural biometrics may add another layer by observing interaction patterns such as typing rhythm or cursor movement. The presence of such a signal does not mean a system can identify a person with certainty. It means the signal may contribute to a broader risk assessment, subject to notice, consent, access, retention, and security requirements that differ by deployment.

Readers comparing payment security with broader digital identity topics can review the data privacy explainer. That link is a related educational reference, not a source for the payment-network claims in this article.

Feedback, Labels, and Continuous Learning

Fraud models need feedback. Visa says relevant data such as confirmed chargebacks can help a model refine its predictions. Mastercard says high-quality data and new credible sources matter as payment tactics evolve. Feedback helps a provider distinguish a confirmed fraud event from a legitimate payment that was merely unusual.

Labels are not automatically correct. A chargeback can involve fraud, a merchant dispute, a processing error, or another cause. If a provider trains on weak labels, the model can learn the wrong relationship. Data can also reflect historical decisions that treated some customers or regions differently. Monitoring should therefore examine both detection outcomes and the quality of the labels behind them.

Continuous learning also needs boundaries. A model should not change silently without testing, version control, documentation, rollback, and a way to explain material decisions. A new fraud pattern may require an urgent response, but urgency does not remove the need for approval and post-change review.

Project Hertha highlights labelled training data, a reliable model feedback loop, and explainable AI as important to effectiveness. These are not decorative governance terms. They are practical requirements for understanding why a model flagged an event and whether the result improves fraud control without creating unacceptable customer harm.

Network Intelligence and the BIS Project Hertha Experiment

Payment fraud is often difficult to see from one account alone. BIS Project Hertha tested whether transaction analytics could identify financial-crime patterns in real-time retail payment systems using a minimum set of data points. The project involved the BIS Innovation Hub’s London Centre and the Bank of England.

BIS reported that the experiment helped banks and payment service providers find 12% more illicit accounts than they otherwise would have found. When looking for previously unseen behaviours, the project reported a 26% improvement. These are results from the Project Hertha experiment and should not be presented as a guaranteed improvement for every bank, network, or model.

The project used a synthetic transaction dataset containing 1.8 million bank accounts and 308 million transactions. BIS says no real customer data was used in the exercise. That design allowed researchers to test network analytics while avoiding the use of real customer records, but it also means the result is not a live production benchmark.

BIS says the results show promise but also limits. It notes that practical, legal, and regulatory issues were beyond the project’s scope. That caution is essential. Network analytics can supplement existing controls, but it does not answer every question about lawful data use, explainability, access, or customer recourse.

The AI cybersecurity risks article provides broader context on defensive systems. It should not be used to inflate Project Hertha’s experimental result into a general fraud-prevention claim.

Mastercard’s Compromised-Card Use Case

Mastercard’s May 22, 2024 press release describes a narrower generative-AI use case. Mastercard says its technology can identify potentially compromised cards by connecting partial card details found on illegal websites with transaction information across its network. It says banks can then be alerted so a card can be blocked and reissued sooner.

Mastercard says the technology scans transaction data across billions of cards and millions of merchants and identifies complex fraud patterns. This is a company description of its network technology. It should not be restated as proof that every AI fraud system can scan the same data or deliver the same result.

The release also uses the phrase “double the speed” for detecting potentially compromised cards. That is a Mastercard claim in a press release, not an independent benchmark. The important concept for this explainer is the workflow: identify a possible compromise, alert the bank, block or reissue the card where appropriate, and monitor attempted transactions.

Generative AI has a dual role in the fraud environment. Visa describes criminals using synthetic identities, deepfake media, and forged documents, while Mastercard describes generative AI helping defenders identify compromised-card patterns. The technology is not inherently protective or harmful. Its effect depends on the data, controls, deployment, and people using it.

For a separate discussion of AI agents that can act in commercial workflows, see the agentic commerce guide. Payment authorization for an AI-initiated purchase still needs the same risk and accountability controls.

What a Risk Decision Can Do

Fraud systems usually support a set of operational outcomes rather than a single “fraud” label. A low-risk event may be approved. A medium-risk event may be challenged with additional authentication. A high-risk event may be declined, held, or routed to an investigator. The precise thresholds and actions depend on the provider and its rules.

Visa describes real-time risk scoring and says a merchant or payment provider can use the score to approve, challenge, or decline a transaction. Mastercard describes Decision Intelligence Pro as providing near-real-time risk scores and insights during authorization. These product examples show how a score can connect to an action. They do not establish that every provider uses the same score range, timing, or decision policy.

Manual review is not a failure of AI. It is a control for cases where the model’s evidence is ambiguous or where the potential impact is high. Mastercard’s 2026 page discusses reducing unnecessary manual reviews, while also explaining that contextual risk decisions aim to reduce false positives. A smaller queue can be useful only if the remaining cases are appropriate for automation and the escalation process is reliable.

The AI agent hijacking explainer is relevant to the principle that automated actions need boundaries. It is not a source for payment-fraud rates or network performance.

False Positives, False Negatives, and Customer Trust

A false positive occurs when a legitimate payment is treated as suspicious. It can lead to a decline, extra authentication, a support contact, or a manual review. A false negative occurs when fraudulent activity is accepted or not identified. Improving one side without measuring the other can produce a misleading picture of performance.

Visa and Mastercard both frame contextual models as a way to reduce unnecessary declines and manual reviews. Mastercard’s 2026 page reports that 83% of respondents said AI had significantly reduced false positives and customer churn rates in the prior year, while 80% said AI helped eliminate unnecessary manual reviews. These are survey findings reported by Mastercard, not a guarantee for a particular merchant or customer.

Customer trust depends on more than an approval rate. A person needs a clear way to understand a challenge, recover access, report unauthorized activity, and correct a wrong decision. Providers also need to monitor whether a model creates uneven friction for particular customers, products, geographies, or payment methods.

Accuracy claims should therefore carry a scope. A model may perform well on one payment channel and less well on another. A model trained on historical activity may struggle with a new fraud method. A network model may benefit from more context than a small provider can lawfully access. The result must be assessed against the actual deployment.

Data Quality, Privacy, and Governance

AI fraud detection depends on data that is relevant, timely, reliable, and used for an authorized purpose. More data is not automatically better. A data source can increase coverage while also increasing privacy, security, retention, access, and bias risks. Visa says its capabilities operate in accordance with applicable laws, regulations, and contractual obligations. BIS emphasizes using the minimum set of data points in Project Hertha.

Governance should cover the entire lifecycle. Teams need to document what signals are used, why they are needed, who can access them, how long they are retained, how model changes are tested, and how decisions can be reviewed. A provider should also know which actions are reversible and which require a human approval step.

Explainability does not always mean revealing a secret model formula. It can mean recording the main factors that influenced a decision, the version of the model, the policy applied, and the next available remedy. Those records help investigators diagnose errors and help the organization respond when a customer disputes a decision.

Readers can consult the fintech compliance guide for adjacent risk-management context. It is not legal advice and does not replace the rules that apply to a specific payment provider.

What the Evidence Does Not Prove

The verified sources support a clear mechanism story, but they do not support several broad claims from the earlier article. They do not show that AI prevents all fraud, makes every decision in under a fixed number of milliseconds, or guarantees approval of genuine payments. They do not show that a named product’s survey result applies to every bank, merchant, wallet, card network, or geography.

They also do not show that behavioural biometrics alone can verify identity, that a network view eliminates privacy risk, or that generative AI can predict every compromised card. Project Hertha’s results are experimental and synthetic. Mastercard and Visa product results are company statements or survey findings that require attribution.

Good coverage can still be concrete. Say what signal families are used, what the action path looks like, which source describes the mechanism, and what the evidence does not establish. That is more useful than presenting an invented precision figure or a universal security promise.

The broader AI agents overview can help readers understand automation terminology. It does not add evidence about payment-fraud detection.

Conclusion: AI Helps, Controls Decide

AI detects fraud in digital payments by combining context. Transaction history, velocity, device and location information, merchant signals, identity evidence, network relationships, and feedback can help a provider decide whether to approve, challenge, decline, hold, or review a payment.

Mastercard describes near-real-time authorization insights, contextual risk analysis, and a compromised-card use case. Visa describes risk scoring, behavioural and device signals, feedback, custom rules, and network intelligence. BIS Project Hertha shows that transaction analytics can supplement bank and payment-service-provider controls in a synthetic experiment, while warning that practical, legal, and regulatory questions remain.

The durable lesson is not that AI makes payment fraud disappear. It is that useful fraud detection requires good data, current feedback, explainable decisions, privacy safeguards, operational monitoring, and a path for human review. A payment approved by an AI system is still a decision under uncertainty, not a guarantee that no loss can occur.