AI makes fraud cheaper and easier

Generative AI removes the expertise barrier for attackers, letting anyone create convincing phishing messages, synthetic identities and deepfakes without specialized skills.

“With scale comes more malicious actors. And that's even heightened with AI because at this point, anyone who wants to become a malicious actor has access to it with AI.”

Digital wallets lack card-era protections

Credit cards built their fraud controls over decades of attacks and regulation. Digital wallets and crypto products don't carry the same requirements or safeguards, leaving consumers with mismatched expectations.

Onboarding becomes the weak link

Synthetic IDs and deepfakes make it hard to verify customers during account creation. This is where providers decide who enters their ecosystem, making it a critical security chokepoint.

“Onboarding, in my opinion, is one of the biggest areas of concern just because of the nature that AI is driving a shift in risk there.”

PCI DSS 4.0 tightens payment page rules

New standards require merchants to secure payment page integrations and monitor third-party vendors operating in checkout. The challenge is controlling security practices of outside providers through contracts alone.

Security versus convenience trade-off

Adding authentication steps reduces fraud but increases friction at checkout. Providers must experiment to find where controls justify interrupting the user experience.

Plan security before incidents force it

Companies should define their risk appetite and build security architecture proactively using frameworks like ISO 42001 for AI management, rather than reacting after a breach.

“You don't want to be reactive when building that structure. You want have some time to be able to plan and make sure you're building a sound program.”