Visa Report Finds Scams and AI Reshaping Payment Security
Summary
Visa’s Spring 2026 report says scams and AI-driven deception are reshaping payment security. It reports lower token-fraud losses, nearly $1 billion in identified scam activity, and rising ransomware alongside declining ransom payments.
Key points
- Visa reports token fraud declined 9.6% year over year and enumeration losses fell 16% in July–December 2025.
- Visa identified nearly $1 billion in scam-related activity from July through December 2025, which it describes as a leading consumer threat.
- The report says AI is helping criminals scale scams and automate workflows, while defenders use AI to detect anomalies and respond earlier.
- Visa reports ransomware activity rose 26% year over year in July–December 2025; 23% of victims paid, the lowest rate on record.
- Average ransomware payments fell 66% from April–June to July–September 2025, according to the report.
- Visa recommends ecosystem-wide coordination, stronger scam and identity defenses, automated response, and resilient backups and recovery.
Article Details
- Publisher
- Visa
- Report Period
- Second half of 2025; published 2026
- Scope
- Payment security trends, including fraud, scams, ransomware, and AI, based on Visa network observations and ransomware trend monitoring.
- Sample Size
- Not disclosed
- Key Statistics
- Visa reported blocking 13% more unique enumeration attacks at the network level over the six months preceding the report.
- Device-token fraud declined 9.6% year over year during July–December 2025.
- Nearly $1 billion in scam-related fraud activity was identified between July and December 2025.
- Global ransomware activity rose 26% in July–December 2025 compared with the same period in 2024; 23% of victims paid, the lowest rate on record.
- Average ransomware payments fell 66% from July–September 2025 compared with April–June 2025.
- Recommendations
- Track where fraud attempts and losses migrate across channels, use cases, and jurisdictions, not only overall losses.
- Prioritize controls at ecosystem seams, including merchant onboarding, platform integrity, identity verification, and cross-partner collaboration.
- Treat recovery time objectives and backup integrity as board-level metrics.
- Automate detection, triage, and response, and establish cross-partner response capabilities.