The $40 Billion Threat — and the AI Arms Race Reshaping Payment Processing

Imagine a phone call from your bank’s fraud team. The voice is calm, professional, and knows the last four digits of your account. It knows your name, your address, and the transaction they’re calling about. The problem? That “fraud agent” is an AI-generated deepfake — and its real goal is to steal your credentials.

That scenario isn’t science fiction. It’s happening right now, at scale. And it’s just one front in the most consequential transformation in the history of AI in payment processing.

The same technology that’s making payments faster, smarter, and more seamless is simultaneously arming fraudsters with tools that would have seemed impossible five years ago. The stakes are enormous: AI-enabled fraud is projected to reach $40 billion annually in the United States by 2027, according to the Deloitte Center for Financial Services. At the same time, Visa is rolling out two landmark programs — CEDP and DCAP — that are rewriting the rules on interchange rates and data compliance.

For merchants, the message is simple: the payment landscape is changing whether you’re ready or not. For the agents and ISOs helping merchants navigate it, understanding these changes isn’t optional — it’s your value proposition.

Here’s everything you need to know.

AI Is Transforming Payments — and That’s Mostly Good News

Before we get to the threats, let’s acknowledge what AI has already done for the payments industry. The transformation is real, and the benefits are significant.

Real-Time Fraud Detection That Actually Works

For decades, fraud detection meant rule-based systems — blocklists, velocity checks, hard spending limits. These systems were predictable, and fraudsters quickly learned to work around them.

AI changed the equation. Machine learning models can now analyze hundreds of variables per transaction in milliseconds: device fingerprint, geolocation, typing speed, purchase history, network behavior, and dozens of other signals invisible to legacy rule engines. The result is fraud detection that adapts in real time instead of waiting for someone to update the rulebook.

The financial impact is measurable. According to research published by Tearsheet, 42% of issuers report saving more than $5 million over the past two years by deploying AI in fraud prevention. McKinsey research shows that AI-powered fraud management can increase fraud detection by approximately 60% while simultaneously reducing false positives by roughly 50%.

That matters for merchants, too. False positives — legitimate transactions blocked by overly aggressive fraud rules — cost businesses real revenue. AI reduces that collateral damage while catching more actual fraud.

Automated Transactions and Smarter Processing

AI is also doing the unglamorous work of optimizing payment routing, automatically updating expired card credentials, flagging unusual chargebacks before they escalate, and surfacing insights about payment performance that used to require a data analyst and a week of work.

For merchants processing high volumes, these efficiencies compound quickly. Fewer declines, faster settlements, lower processing costs — the operational improvements from AI-assisted payment infrastructure are quietly transforming what merchants can expect from their payment stack.

The Dark Side: AI-Powered Fraud Is Escalating Fast

Here’s the uncomfortable truth: every AI tool built to protect payments also exists, in some form, in the hands of fraudsters. And they’re not holding back.

Deepfakes and Voice Cloning

The phone call scenario in our opening isn’t hypothetical. Synthetic voice and video deepfakes have become cheap, accessible, and convincing. Fraudsters are using them to impersonate bank representatives, business executives, and even the cardholders themselves during verification calls.

Sumsub’s Identity Fraud Report documented a 1,100% year-over-year surge in deepfake fraud — not a typo, and not a rounding error. The same report found that synthetic identity document fraud spiked 311% in North America. These are not edge cases. They are the new baseline.

Synthetic Identity Fraud

Synthetic identity fraud is particularly insidious because it doesn’t look like fraud — at least not right away. Fraudsters combine a real Social Security number (often stolen from a child, elderly person, or someone deceased) with fabricated names, birthdates, and addresses to create entirely fictitious identities.

These fake personas are then carefully “seasoned” — the fraudster applies for credit, gets rejected, applies again, builds a thin credit history, and over 12 to 24 months develops what looks like a legitimate consumer with a 750+ credit score. Then they max out every line of credit they can access and vanish.

The losses from these “bust-out” attacks are staggering. The Federal Reserve identifies synthetic identity fraud as the fastest-growing financial crime in America. When losses finally materialize, they’re often misclassified as credit losses rather than fraud — hiding the true scale of the problem from risk teams.

Traditional phishing emails were easy to spot: bad grammar, suspicious sender addresses, generic greetings. Not anymore. Large language models can now generate hyper-personalized phishing messages that reference actual transaction history, use natural language indistinguishable from legitimate communications, and adapt their approach based on response patterns.

These attacks are scaling at a rate that human review simply cannot match. The World Economic Forum’s Global Cybersecurity Outlook 2026 reports that 73% of organizations were directly affected by cyber-enabled fraud in 2025. Meanwhile, Vectra AI documented a 1,210% surge in AI-enabled fraud in 2025 alone.

The Technology Arms Race: AI Versus AI

What we’re witnessing in payments is an arms race with no finish line. The same AI capabilities that power fraud detection are being weaponized to defeat it — and vice versa.

How Attackers Are Evolving

Fraudsters are no longer solo operators running simple card-testing scripts. Today’s threat actors deploy autonomous AI agents capable of executing multi-step attack chains: generating fake ID documents, submitting deepfake video verifications, passing liveness detection checks, and executing transactions — all with minimal human involvement.

Sumsub’s research found that sophisticated multi-step fraud attacks rose from 10% of all identity fraud in 2024 to 28% in 2025 — nearly tripling in a single year. The share of forged documents that are AI-generated is rising rapidly as tools like generative AI make fabrication accessible to low-skill actors.

How Defenders Are Responding

On the defense side, leading payment processors and networks are deploying behavioral biometrics, graph-based network analysis, and continuous authentication models that evaluate risk not just at the moment of transaction but throughout the entire session.

Visa and Mastercard are investing heavily in network-level intelligence that gives issuers richer data at the point of authorization. When an issuer can see device fingerprints, IP history, behavioral patterns, and authenticated identity signals alongside the transaction, their fraud models make dramatically better decisions — approving legitimate transactions that might otherwise be declined while blocking fraudulent ones that would have slipped through.

Mastercard’s published research highlights that industry leaders increasingly view synthetic identity fraud (cited by 61% of respondents), impersonation scams (60%), and cross-border fraud (54%) as the fastest-growing threats — all areas where AI-powered defenses are making measurable inroads.

The firms winning this arms race share a common trait: they treat security as a continuously evolving system, not a configuration they set once and forget.

Agentic Commerce: The Next Frontier in Payment Processing

Beyond fraud, AI is about to change something even more fundamental: who — or what — is actually making purchases.

When AI Does the Shopping

“Agentic commerce” refers to AI systems that act on behalf of consumers — browsing, comparing, selecting, and completing purchases with minimal human involvement. This isn’t a distant concept. According to Salesforce’s 2025 holiday shopping data, AI agents influenced $262 billion in U.S. holiday sales in 2025, driving 20% of all retail transactions.

During the holiday rush, consumers used AI agents for customer service 126% more than in previous months. AI-powered searches from tools like ChatGPT and Perplexity converted nine times more often than social media traffic. The “agent” is no longer a metaphor — it’s a commercial actor executing transactions in the real economy.

What Agentic Commerce Means for Payments

This shift creates new challenges for every layer of the payment stack. How do you verify the identity of an AI agent making a purchase on behalf of a consumer? How do you apply standard fraud models to transactions where no human is present at the keyboard? How do you handle chargebacks when the “buyer” was an autonomous system?

These aren’t theoretical problems. They’re already landing on the desks of payment processors, issuers, and merchants. The networks are beginning to develop frameworks for “agent-to-agent” verification, but the standards are still early-stage.

For merchants today, the practical implication is clear: your payment infrastructure needs to handle non-traditional transaction patterns without triggering false declines. If your fraud rules assume a human at a keyboard, you may be blocking legitimate AI-assisted purchases — a revenue problem that will only grow as agentic commerce scales.

What This Means for Merchants: Why Outdated Systems Leave You Exposed

If you’re running a business and your payment setup hasn’t changed in three years, you’re operating with tools designed for a threat environment that no longer exists. That’s not a hypothetical risk — it’s a structural vulnerability.

The Three Ways Legacy Systems Fail

1. They can’t adapt to new fraud patterns. Rule-based fraud systems require manual updates. By the time your processor updates its rules to reflect a new attack vector, that vector may have already been used against you.

2. They don’t communicate well with networks. Modern fraud prevention depends on passing rich data signals to issuers and networks. Legacy systems often can’t transmit device IDs, behavioral signals, or enhanced transaction data. The result: more false declines, worse fraud detection, and missed opportunities for interchange savings.

3. They leave compliance gaps. Programs like Visa’s CEDP aren’t just about rates — they require specific data fields to be captured, validated, and transmitted correctly. Systems that weren’t built to handle this data will either fail validation or require costly workarounds.

The Real Cost of Standing Still

The financial cost of inaction is concrete. Non-verified merchants under Visa’s CEDP program can pay up to 40% more in interchange fees on commercial card transactions. Merchants not taking advantage of programs like DCAP are leaving measurable savings on the table. And merchants without real-time fraud monitoring are disproportionately targeted — because fraudsters know which businesses have weak defenses.

Staying Compliant: Visa’s CEDP and DCAP Programs Explained

Visa has launched two significant programs that every merchant processing Visa transactions needs to understand. Both are about passing better data to improve the payment ecosystem — and both come with financial consequences for merchants who don’t participate correctly.

Visa CEDP: The New Standard for B2B Transactions

The Commercial Enhanced Data Program (CEDP) is Visa’s replacement for the old Level 2 and Level 3 enhanced data programs. If you process B2B, corporate, purchasing, or business credit cards, this affects your interchange rates directly.

What Changed — and Why It Matters

Under the old Level 2/Level 3 system, merchants could qualify for lower interchange rates by submitting certain additional data fields. The bar was relatively low: submit the fields, get the savings, regardless of whether the data was accurate.

CEDP changes that fundamentally. Now, Visa uses AI-powered validation to check the accuracy and completeness of your transaction data before awarding preferred rates. Generic descriptions, auto-filled placeholders, and incomplete fields will be flagged. Your status as “Verified” or “Non-Verified” is determined by how well your actual data holds up to Visa’s quality checks.

To maintain Verified status, approximately 90% of your transactions must pass Visa’s data quality checks over a rolling 30-day period.

What Data CEDP Requires

To qualify for CEDP’s Product 3 rates, your transactions must include accurate values for:

Item descriptions (specific products — not “merchandise” or “services”)
Product or commodity codes
Quantities and unit costs
Invoice or purchase order numbers
Accurate tax amounts
Freight and shipping charges
Merchant ZIP code and customer code

The emphasis on accuracy is the key shift. Visa’s validation engine will reject generic, auto-populated, or inconsistent data.

The CEDP Timeline

Date	Milestone
April 12, 2025	CEDP launched; 5 bps participation fee on all Level 2/3 commercial transactions
October 18, 2025	Product 3 rates effective; Level 3 legacy program sunsets
November 11, 2025	Visa pauses granting new CEDP Verified status; unverified merchants shift to lagged per-transaction validation
January 24, 2026	Rate increases for unverified merchants take effect
April 18, 2026	Level 2 program sunsets for all commercial card types (except Fleet fuel-only)

After April 18, 2026, there are only two interchange outcomes for commercial card transactions:

Product 3 rates (1.75%–2.20% + $0.10) if you’re passing high-quality, validated line-item data
Level 1 rates (2.50%–2.95% + $0.10) if you’re not

For a business processing $1 million annually in B2B commercial card transactions, the difference between Verified and Non-Verified status can mean tens of thousands of dollars per year in additional processing costs. Non-verified merchants effectively pay up to 40–50% more per transaction.

The clock is running. If you haven’t confirmed your CEDP Verified status, now is the time.

Contact Jupiter Payments to verify your CEDP compliance status!

Visa DCAP: A New Savings Opportunity for Card-Not-Present Merchants

While CEDP focuses on B2B commercial cards, the Digital Commerce Authentication Program (DCAP) is a separate, complementary program targeting consumer credit card-not-present (CNP) transactions — the bread and butter of e-commerce.

What DCAP Is

Launched on April 18, 2026 in the United States, DCAP is an optional program that rewards merchants for passing enriched authentication data on consumer credit Visa transactions. Instead of triggering a full 3D Secure challenge (which adds friction and increases cart abandonment), DCAP uses a “Data Only” authentication flow — fully frictionless for the cardholder — that sends enriched signals to Visa for risk assessment.

What Data DCAP Passes

To qualify for DCAP interchange savings, four data fields must be present on the transaction:

Device ID — a fingerprint of the cardholder’s device
IP address — the network address at time of purchase
Email address — the cardholder’s verified email
Billing address — full billing address on file

This data package gives issuers dramatically better context for authorization decisions — reducing the likelihood of false declines and helping distinguish legitimate transactions from fraudulent ones.

The DCAP Savings Structure

Scenario	Net Interchange Savings
DCAP data only	−0.05% (5 bps) net savings
DCAP + Visa Network Tokens	−0.10% (10 bps) net savings

The savings are meaningful — and they compound. A merchant processing $2 million annually in consumer credit CNP transactions would save $10,000 per year from DCAP alone, or $20,000 per year by also using Visa Network Tokens.

Why Network Tokens Amplify the Benefit

Visa Network Tokens replace raw card numbers (PANs) with payment credentials that are specific to a card-merchant pair. They stay valid when the underlying card is reissued or updated — eliminating a major source of unnecessary declines. Visa’s own data shows that the growth in tokenized transactions translated into a 6% improvement in authorization rates and up to a 30% reduction in fraud.

Combined with DCAP, Network Tokens give merchants a layered advantage: better security, higher approval rates, and lower interchange costs.

Who DCAP Applies To

DCAP applies to customer-initiated consumer credit Visa transactions only. Merchant-initiated transactions (MITs), recurring stored-credential payments, MOTO transactions, and installment plans are out of scope.

For consumer-facing merchants with a meaningful volume of online card-not-present sales, DCAP is a straightforward win — assuming your payment infrastructure can pass the required data fields.

Learn how Jupiter Payments helps you qualify for DCAP savings!

How Jupiter Payments Keeps You Ahead of All of This

Understanding what’s happening in payments is one thing. Having the right partner to act on it is another.

At Jupiter Payments, we’ve been tracking these changes since they were announced — not scrambling to catch up after the fact. Here’s what that means for you in practice.

CEDP Compliance, Handled

CEDP compliance requires accurate, validated line-item data to flow correctly from your point-of-sale or business system through to Visa’s validation engine. Most merchants don’t realize there’s a gap until they see their rates go up.

We ensure that our merchants maintain CEDP Verified status — meaning the right data fields are captured, accurately populated, and transmitted in the format Visa requires. If your current system has gaps, we identify them before they cost you money. The result: better interchange rates, automatically, without you having to monitor Visa’s validation requirements on your own.

A Wide Range of Solutions for Any Business

No two businesses process payments exactly the same way. Jupiter Payments offers POS systems, integrated payment solutions, payroll, business lending, gift and loyalty programs, and more — all under one roof. Whether you’re a restaurant running Aloha or Micros, a retail operation with complex inventory, or a service business with recurring billing, we have a solution designed for your environment.

Our open API means we can integrate with virtually any existing system — including legacy platforms that other providers won’t touch. You don’t have to rip and replace your entire stack to access modern payment infrastructure. We meet you where you are.

Security-First, Always Adapting

Payment security isn’t a feature we added — it’s the foundation everything else is built on. Our monitoring doesn’t stop at the transaction level. We track fraud pattern shifts, network policy changes, and emerging attack vectors so we can adapt your protection before problems reach you.

As agentic commerce grows and AI-powered fraud evolves, the threat landscape will keep changing. What won’t change is our commitment to staying ahead of it.

The Freedom Program

We also offer our Freedom Program, which gives merchants the opportunity to recapture up to 100% of their processing fees — shifting costs in a way that preserves cash flow without sacrificing the quality of your payment infrastructure.

The Bottom Line

AI in payment processing is not a future trend you can evaluate later. It’s reshaping fraud exposure, authorization rates, compliance requirements, and the very nature of how transactions are initiated — right now.

The merchants and businesses that come out ahead will be the ones with payment infrastructure that can:

Pass rich, validated data to card networks
Qualify for programs like CEDP and DCAP that reduce interchange costs
Detect and respond to AI-powered fraud in real time
Adapt as agentic commerce and new attack vectors emerge

The ones who wait will pay more in interchange, absorb more fraud losses, and scramble to comply with programs that are already live.

You don’t have to navigate this alone. Jupiter Payments exists to be the partner that’s already done the homework — so you can focus on running your business while we keep your payments optimized, protected, and compliant.

Ready to see where you stand? Contact Jupiter Payments for a no-obligation review of your current payment setup. We’ll assess your CEDP compliance status, identify DCAP savings opportunities, and show you exactly what a security-first payment partner looks like in practice.