Visa’s new Visa Account Attack Intelligence (VAAI) Score helps identify the likelihood of enumeration attacks in card-not-present transactions

Threat actors are leveraging sophisticated technologies, like automated scripts and botnets, to amplify their card testing attacks, allowing them to exploit vulnerabilities at an unprecedented scale and speed. These attacks, known as enumeration attacks, inflict operational expenses and $1.1B annually in fraud losses,¹ accounting for a significant portion of global fraud. To combat this threat, today, Visa (NYSE:V), a leader in digital payments, announced updates to its Visa Account Attack Intelligence (VAAI) offering with the addition of the VAAI Score, a new tool that uses generative AI components to identify and score enumeration attacks. The VAAI Score, which will be available to U.S. issuers first, will help reduce fraud and operational losses by assigning each transaction with a risk score in real time to detect and prevent enumeration attacks in card-not-present (CNP) transactions.

“Enumeration can have lasting impacts on our clients and there’s an immediate need for tools that can better detect and prevent these attacks in real-time,” said Paul Fabara, Chief Risk and Client Services Officer at Visa. “With the VAAI Score, our clients now have access to real-time risk scoring that can help detect the likelihood of an enumeration attack so issuers can make more informed decisions on when to block a transaction.

Thirty three percent of enumerated accounts experienced fraud within five days of a fraudster obtaining access to their payment information². By using generative AI, components to learn normal and abnormal transaction patterns, Visa’s VAAI Score identifies the likelihood of complex enumeration attacks in real-time to help reduce fraud without compromising the integrity of Visa’s performance and accuracy. The tool has been able to reduce the false positive rate by 85% compared to other risk models, as the VAAI Score focuses on specific signals for enumeration allowing for a stronger performance³. VAAI Score can help issuers with:

• Reduced fraud and operational losses: Helps identify complex enumeration attacks in real time which can help reduce follow-on fraud from validated accounts and operational losses due to enumeration such as customer center calls and card reissuance and help safeguard clients.
• Improved cardholder experience: Helps identify when legitimate cardholder transactions are not impacted, while giving issuers a tool to proactively decline transactions at risk for enumeration attacks.
• Real-time transaction scoring: Provides a real-time risk score in 20 milliseconds⁴ which can help clients in identifying enumeration and using it in their authorization decisioning when used with a rules engine.

“With access to advanced technology, fraudsters are monetizing stolen credentials faster than ever before,” said Michael Jabbara, SVP Global Head of Fraud Services, at Visa. “Enumerated transactions impact the entire ecosystem, and with the VAAI Score, we’re giving our clients a sophisticated tool that can help prevent cardholder accounts from being compromised and stop fraudulent transactions before they happen.”

The VAAI Score model has been trained on more than 15 billion VisaNet transactions and has six times the number of features compared to previous VAAI models to help better assess suspicious enumeration transactions. Visa’s approach uses noisy data to train the highly accurate real time AI model. By evaluating each CNP transaction against enumeration patterns, the new risk scoring model derives a two-digit risk score that helps predict the likelihood of enumeration to help better determine when to approve, and when to decline, transaction.

At Visa, security and reliability are top priorities year-round. Over the past five years, the company has invested more than $10 billion in technology, including to reduce fraud and increase network security. More than a thousand dedicated specialists protect Visa’s network from malware, zero-day attacks and insider threats 24x7x365. In FY23 alone, Visa helped to proactively block $40 billion in fraud⁵, preventing many from ever knowing they were at risk of a potential fraudulent transaction. We encourage consumers to stay alert and think about where they are shopping and who they are sharing their information with stay safe.

About Visa Inc.

Visa (NYSE: V) is a world leader in digital payments, facilitating transactions between consumers, merchants, financial institutions and government entities across more than 200 countries and territories. Our mission is to connect the world through the most innovative, convenient, reliable and secure payments network, enabling individuals, businesses and economies to thrive. We believe that economies that include everyone everywhere, uplift everyone everywhere and see access as foundational to the future of money movement. Learn more at Visa.com.

¹ Enumeration Fraud Loss from VAAI FY23

² Enumeration Fraud Loss pulled from VAAI FY23

³ 2024 U.S. Visa Account Attack Intelligence Score Model Documentation

⁴ In adopting AI models VAAI can evaluate up to 182 risk attributes in a millisecond to derive a two-digit risk score predicting the likelihood of enumeration attack.

⁵ Visa data (October 1, 2022 – September 30, 2023)

View source version on businesswire.com: https://www.businesswire.com/news/home/20240507262164/en/

Enumeration can have lasting impacts on our clients and there’s an immediate need for tools that can better detect and prevent these attacks in real-time.