Visa introduces Visa Account Attack Intelligence (VAAI)

• Visa introduces VAAI Score, leveraging generative AI to combat enumeration attacks and reduce fraud losses.
• VAAI Score provides real-time risk scoring for CNP transactions, enhancing fraud detection while improving cardholder experience.

Threat actors are leveraging sophisticated technologies, like automated scripts and botnets, to amplify their card testing attacks, allowing them to exploit vulnerabilities at an unprecedented scale and speed. These attacks, known as enumeration attacks, inflict operational expenses and $1.1B annually in fraud losses,1 accounting for a significant portion of global fraud. To combat this threat, Visa, a leader in digital payments, announced updates to its Visa Account Attack Intelligence (VAAI) offering with the addition of the VAAI Score, a new tool that uses generative AI components to identify and score enumeration attacks. The VAAI Score, which will be available to U.S. issuers first, will help reduce fraud and operational losses by assigning each transaction with a risk score in real time to detect and prevent enumeration attacks in card-not-present (CNP) transactions.

“Enumeration can have lasting impacts on our clients and there’s an immediate need for tools that can better detect and prevent these attacks in real-time,” said Paul Fabara, Chief Risk and Client Services Officer at Visa. “With the VAAI Score, our clients now have access to real-time risk scoring that can help detect the likelihood of an enumeration attack so issuers can make more informed decisions on when to block a transaction.

Thirty three percent of enumerated accounts experienced fraud within five days of a fraudster obtaining access to their payment information2. By using generative AI, components to learn normal and abnormal transaction patterns, Visa’s VAAI Score identifies the likelihood of complex enumeration attacks in real-time to help reduce fraud without compromising the integrity of Visa’s performance and accuracy. The tool has been able to reduce the false positive rate by 85% compared to other risk models, as the VAAI Score focuses on specific signals for enumeration allowing for a stronger performance3. VAAI Score can help issuers with:

• Reduced fraud and operational losses: Helps identify complex enumeration attacks in real time which can help reduce follow-on fraud from validated accounts and operational losses due to enumeration such as customer center calls and card reissuance and help safeguard clients.
• Improved cardholder experience: Helps identify when legitimate cardholder transactions are not impacted, while giving issuers a tool to proactively decline transactions at risk for enumeration attacks.
• Real-time transaction scoring: Provides a real-time risk score in 20 milliseconds4 which can help clients in identifying enumeration and using it in their authorization decisioning when used with a rules engine.

“With access to advanced technology, fraudsters are monetizing stolen credentials faster than ever before,” said Michael Jabbara, SVP Global Head of Fraud Services, at Visa. “Enumerated transactions impact the entire ecosystem, and with the VAAI Score, we’re giving our clients a sophisticated tool that can help prevent cardholder accounts from being compromised and stop fraudulent transactions before they happen.”

The VAAI Score model has been trained on more than 15 billion VisaNet transactions and has six times the number of features compared to previous VAAI models to help better assess suspicious enumeration transactions. Visa’s approach uses noisy data to train the highly accurate real time AI model. By evaluating each CNP transaction against enumeration patterns, the new risk scoring model derives a two-digit risk score that helps predict the likelihood of enumeration to help better determine when to approve, and when to decline, transaction.

At Visa, security and reliability are top priorities year-round. Over the past five years, the company has invested more than $10 billion in technology, including to reduce fraud and increase network security. More than a thousand dedicated specialists protect Visa’s network from malware, zero-day attacks and insider threats 24x7x365. In FY23 alone, Visa helped to proactively block $40 billion in fraud5, preventing many from ever knowing they were at risk of a potential fraudulent transaction. We encourage consumers to stay alert and think about where they are shopping and who they are sharing their information with stay safe.

Source: Visa