Visa Says Criminals Target People as Core Payment Security Tightens

Visa said it identified nearly $1 billion in scam-related activity during the July-December 2025 period covered by its Spring 2026 Biannual Threats Report. The report says criminals are increasingly using AI-generated content, voice impersonation and deepfakes to target people rather than technical system weaknesses, pushing institutions toward stronger identity verification and scam-detection controls. Visa is responding with AI-driven monitoring, a scam disruption team and partnerships with banks, merchants and law enforcement.

Analysis

This is a structural margin tailwind for network-scale fraud platforms, not a one-off operational issue. As technical payment rails harden, the attack surface migrates upstream into identity, communications, and behavioral analytics, which should shift incremental security spend toward software layers that can score intent, verify liveness, and manage scam takedowns in real time. The second-order winner is any vendor that sits between issuer/acquirer data and customer messaging, because the moat becomes cross-ecosystem intelligence rather than pure cryptography.

For Visa, the near-term revenue impact is limited, but the strategic effect is positive: scam disruption increases the value of the network and raises switching costs for issuers and merchants that want access to better fraud telemetry. Over 6-18 months, the bigger beneficiary may be payment-adjacent cybersecurity and identity players, while smaller processors and fintechs with weaker consumer authentication stacks face higher loss rates, more chargebacks, and potentially higher compliance costs. This also creates a procurement gap: enterprises will buy more tooling, but only if it reduces false positives enough to avoid adding friction at checkout or onboarding.

The market may be underestimating how quickly AI lowers the cost curve for social engineering. That means the fraud budget can remain elevated even if headline payment fraud metrics look stable, because defenses must now monitor communications channels, device behavior, and customer consent patterns, not just transaction anomalies. The catalyst to watch is a visible spike in scam losses at banks or BNPL/neo-bank platforms, which would force faster vendor adoption and could re-rate the leaders in identity verification and anti-fraud orchestration.

The contrarian view is that this is not a broad bullish signal for all cybersecurity names; most incumbent endpoint/network security vendors are not well positioned for scam defense. The winners should be those with proprietary consumer identity graphs, network-level data access, and the ability to act across rails quickly; otherwise the spend shifts from capex-like security tools to human review and customer ops, which is lower quality and slower to scale.

Key Decisions for Investors

• Long V on a 6-12 month horizon: modest upside, low fundamental risk; use as a relative winner if scam-defense adoption expands, but size for limited near-term earnings sensitivity.
• Pair trade: long a payments/fraud orchestration beneficiary, short a legacy endpoint-security name that lacks consumer identity exposure over 3-6 months; thesis is budget reallocation toward identity/intent tooling rather than perimeter security.
• If available in the portfolio universe, buy calls or common in identity-verification / fraud-analytics platforms on any post-earnings pullback; target 2-3x upside over 6-9 months if enterprise scam-defense spend inflects.
• Short weaker fintech processors with high consumer-facing fraud exposure into any rally; risk/reward improves if management guides to higher fraud-loss reserves or tougher onboarding friction within 1-2 quarters.
• Set a catalyst watchlist for major issuer disclosures on scam losses and chargeback trends over the next 1-2 reporting cycles; a step-up would confirm the spend cycle and justify adding to the beneficiary basket.