AI Fraud Scoring in Card and Instant Payments: What Official Data Show

The use case

Payment fraud defences are layered, and machine learning is one layer. Fixed rules block known patterns. Strong customer authentication (SCA) has been required for most electronic payments in the European Economic Area (EEA) since 2020 under the revised Payment Services Directive (PSD2). It demands two independent checks⁴. Chip-card standards limit counterfeiting³. Machine-learning scoring covers transactions that authentication does not. In 2024 only 40% of electronically initiated EEA card payments, by number, were SCA-authenticated, influenced by contactless payments, where SCA may not apply³. A model returns a risk score from behavioural, device and network signals, and the issuing or sending bank decides whether to approve, decline or challenge⁹. Newer services share intelligence across banks, for example a score on the receiving account in instant bank transfers¹¹¹². Anti-money-laundering transaction monitoring is a separate discipline and out of scope here.

Where it is running

The best-documented deployments are at network level. Visa reported in June 2019 that its Advanced Authorization service scored all 127 billion transactions on its network in 2018. Each took about one millisecond and used more than 500 risk attributes. The service was used by more than 8,000 institutions in 129 countries (company-reported)⁹. A Visa executive said in July 2024 that Visa blocked $40 billion of fraudulent transactions, 80 million in number, in 2023 (company-reported)¹⁰.

For instant bank payments, Mastercard's Consumer Fraud Risk service has supported 11 UK banks since early 2023. It scores payments before they are sent, and a 2024 extension alerts receiving banks (vendor-reported, via trade press)¹¹. A Forrester study commissioned by Mastercard interviewed six staff at four UK banks. Those banks handled between 134.5 million and 612 million outbound consumer transactions a year¹².

Across borders, Swift ran experiments with 13 institutions, including ANZ, BNY and Intesa Sanpaolo, using federated learning. In this method a model trains at each bank without customer data being shared. The September 2025 trial used synthetic data, and a second phase with real transactions was planned (company-reported)¹³.

No source opened gives an individual bank's start date and covered volume for its own card-scoring system. That is a gap.

What the evidence shows

Official statistics show low fraud rates as a share of value in Europe. EEA fraud across all instruments held at about 0.002% of transaction value in 2022–2024. Card fraud was 0.033% of card value in 2024, or €1.3 billion, up 4% on 2023 (official statistic)³. UK unauthorised fraud, mainly cards and remote banking, was £722 million in 2024 (+2%) and £703.4 million in 2025 (−5%). Cases rose 11% to 3.81 million in 2025 (industry-reported)¹². UK Finance estimates that £1.45 billion of unauthorised fraud was prevented in 2024, 67p in every £1 attempted, and £1.68 billion in 2025 (industry-reported estimates)²¹.

These figures do not isolate the models. The EBA and ECB credit SCA. Authenticated card payments showed lower fraud rates than unauthenticated ones. Card fraud was 17 times higher when the counterpart was outside the EEA, where SCA may not be required³. Remote card fraud ran at 0.091% of value against 0.007% for non-remote payments³.

Model-specific results are scarce and vendor-linked. Mastercard reported a 60% improvement in detecting high-risk receiving ("mule") accounts in preliminary tests (vendor-reported)¹¹. Swift reported that a federated model was twice as effective at identifying known frauds as a single-bank model, on synthetic data (company-reported)¹³. Forrester's model of a UK bank with 540 million outbound transactions a year assumes the service adds 5% to fraud detection. It gives $4.2 million of three-year benefits against $1.9 million of costs (vendor-commissioned, modelled, not measured)¹².

What it takes: cost, integration, governance

Cost. A Visa executive said the company invested over $10 billion in technology over five years, including $500 million on AI and data infrastructure (company-reported)¹⁰. Forrester's composite bank pays $675,000 a year in licence fees before risk adjustment. It spends 8 to 12 weeks on integration through an application interface and about eight staff hours a month on upkeep (vendor-commissioned)¹².

Case handling. The same model assumes 0.06% of payments are interrupted for investigation. It assumes 75% of those interruptions are false alarms and that each costs $17 in analyst time¹². These are assumptions, but they show where staffing goes.

Data. Network scores depend on banks permitting their transaction data to be pooled¹². Swift's design keeps customer data inside each bank¹³.

Governance. US interagency guidance SR 26-2 (17 April 2026) replaced SR 11-7 on model risk management. It is most relevant to banks above $30 billion in assets¹⁴. In the UK, the Data (Use and Access) Act 2025 widens the lawful bases for significant automated decisions, subject to safeguards. Its changes are phased in between June 2025 and June 2026¹⁵. Since 7 October 2024, UK sending and receiving banks have shared liability for authorised push payment (APP) scams equally⁸. EEA firms must report fraud data to authorities under PSD2⁴.

Where it falls short

Challenge: what would make this use case look less successful than it is usually presented?

Baselines. "Fraud prevented" figures estimate attempted fraud stopped and have no published counterfactual. They cannot be tested against loss data. The loss data are not falling. EEA card fraud rose 4% in 2024³. US debit fraud losses were 17.6 basis points of value in 2023 against 7.8 in 2011⁵. Federal Reserve research finds card-not-present rates still rising after the chip-card migration⁶. US and EEA figures are not like-for-like, because the US data cover debit cards at large issuers only⁵⁶.

Authentication. The largest measured effects are tied to SCA, chip cards and liability rules, not scoring³⁷. Authentication itself is being defeated. UK criminals use social engineering to obtain one-time passcodes, then authenticate fraudulent payments or register stolen cards in digital wallets¹.

False declines. No official false-decline statistic was found. Visa's release cites a 2018 Javelin survey in which 51% of cardholders hit by a false decline used another card at the same merchant (third-party survey quoted by a company)⁹. Forrester's composite assumes three in four interrupted payments are false alarms¹². US merchants bore 49.9% and cardholders 21.8% of debit fraud losses in 2023⁵. The cost of wrongly blocked sales is unmeasured in the sources opened.

Displacement. In the EEA, manipulation of the payer accounted for over half of fraudulent credit-transfer value, and users bore about 85% of those losses³⁴. UK APP losses fell 2% to £450.7 million in 2024, then rose 19% to £576.4 million in 2025²¹. The independent evaluation of the UK reimbursement rules found a 21% fall (£73 million a year) in Faster Payments APP losses⁷. Between 2023 and 2025, however, international APP losses rose £39 million, and losses to crypto exchanges rose from about £59 million to £153 million. Grant Thornton's reading of the evaluation implies a net benefit of −£4 million to £8 million, not £17–29 million⁸. The two UK series count by different dates⁸.

Bias. No source opened documents bias findings in payment fraud scoring. That is a gap, not a finding of no bias.

Stage: In wide use — why

The hypothesis stands. Scoring of every transaction is documented at the largest card network (company-reported, 2018 volumes)⁹. Scoring of instant bank transfers with shared network data is earlier. Eleven UK banks have used it since 2023 (vendor-reported)¹¹, and cross-border sharing remains experimental¹³. Wide use is documented. The measured benefit attributable to models alone is not. The stage applies to card scoring.

What to watch next

• The PSR consults on APP policy parameters and data requirements from December 2026. It expects to publish a decision and revised legal directions in May 2027⁸.
• Swift's second phase, using real transactions, has no date given¹³.
• The next EBA/ECB annual payment fraud report is the first observable test of whether mandatory Verification of Payee and instant-payment sending, both due from 9 October 2025, change credit-transfer fraud rates³.
• UK Finance's next annual report will show whether the 2025 rise in APP losses continued¹.

Questions to ask before adopting

• How much of our fraud reduction comes from authentication and liability rules rather than the scoring model, and how do we know?
• What are our false-decline rate and its cost in lost sales and attrition, measured against a holdout group?
• Does the model see authorised-payment scams and receiving accounts, or only unauthorised fraud?
• What data must we share, what latency can we accept, and who validates and monitors the model under current guidance?
• Against which baseline would a vendor's "fraud prevented" figure be audited using our own loss data?