AI Payment Fraud: How Merchants Can Detect Abuse Before It Becomes a Chargeback

AI payment fraud is any scheme in which an attacker uses machine learning, generative text, image or voice, or bot automation to make a fraudulent payment, account, or dispute claim look legitimate long enough to succeed. For merchants, the technology matters less than where it lands, a checkout, a support call, a login, or a refund request, and what it produces downstream: a payment fraud loss, a false decline, or a chargeback you have to fight blind.

This page covers the attack side: how criminals use AI against merchants, how to tell a third-party attack from a first-party dispute dressed up to look like one, and what to capture before and after the sale. For the defensive stack, see how AI fraud detection works for ecommerce. For autonomous shopping agents as the attacker, see AI agent fraud, and for the wider payments picture, how AI is changing online payments.

How AI Is Changing Fraud as We Know It

Generative AI collapsed the cost of a convincing scam. A phishing message that once had grammar mistakes and a mismatched logo can now be produced in a native-sounding voice, personalized with data pulled from a breach, and sent at a volume no human fraud ring could match. The same automation drives voice cloning scripts and bots that farm one-time passcodes out of victims by impersonating a bank or merchant.

Read the numbers with their limits. The FTC's 2025 Consumer Sentinel data counts 3 million fraud reports, with losses up from $12.5 billion in 2024, and imposter scams alone drew more than 1 million reports and $3.5 billion. The FTC testimony does not isolate AI. The FBI's 2025 Internet Crime Report does, using victim self-reporting. Its AI-referenced complaints and losses are the second and third boxes above, and more than $632 million of that total sat in investment scams, with over $30 million in business email compromise. Victims only flag AI when they notice it, so treat the figure as a floor. Deloitte's 2024 forecast for banking is a projection, not a measurement.

Juniper Research's forecasts, a $48 billion eCommerce fraud estimate for 2023 and a later projection of $362 billion cumulative losses from 2023 to 2028, size online payment fraud as a whole, not AI-generated attacks specifically. On the attacker side, Visa's Fall 2025 threats report counted a 477% rise in underground-forum mentions of "AI Agent" as criminals discuss automating social engineering, data extraction, and transaction execution, and warns that synthetic content is now indistinguishable from legitimate business materials.

A typical account-takeover script now runs almost entirely on automation: a bot spoofs a business's caller ID, an AI-generated voice or script talks the victim into handing over a one-time passcode, and the fraudster logs in to drain the account or place unauthorized transactions. AI-driven chatbots make the impersonation step hard to tell from a real support agent, so "the conversation sounded human" is no longer a usable fraud signal. Speed compounds it. ACI Worldwide's 2024 Prime Time for Real-Time report counted 266.2 billion real-time payments worldwide in 2023, up 42.2% year over year, and unlike card payments, a completed real-time transfer has no card-network chargeback right behind it.

How Criminals Use AI Against Merchants

Bots and automated card testing

Scripts test thousands of stolen card numbers against checkout and card-on-file flows before any high-value purchase. Visa's threats report describes "low-velocity probing" spread across many merchants so that no single merchant sees an alarming spike. Card testing and BIN attacks are the two patterns to watch, and credential-stuffing bots ride the same botnet attacks infrastructure, so login velocity and session behavior matter more than message content.

Synthetic identities and deepfake onboarding

FinCEN's November 2024 alert reported rising suspicious activity since 2023 involving deepfake media, with criminals pairing AI-generated images with stolen or fabricated personal data to build synthetic identities and then using those accounts to launder fraud proceeds. Synthetic fraud reaches merchants through marketplace seller onboarding, buy-now-pay-later and credit extension, and mass account creation for promo abuse. The same patterns drive the fake accounts AI detects on ecommerce platforms.

Doctored evidence in refund and dispute claims

Generative image tools now produce believable photos of damaged goods. OECD.AI's incident monitor logged buyers in China using AI-made images and video to claim refund-only returns in mid-2025, one merchant reporting nine AI-fabricated refund claims in three months, and French reports in March 2026 of AI-generated damage photos on secondhand marketplaces. These are news-based incident reports, not measured prevalence, but the mechanism is the same everywhere: a first-party claim backed by synthetic proof. Treat it as a new route into refund fraud and into the first-party disputes covered below.

Autonomous shopping agents

Agents that browse, compare, and pay on a buyer's behalf add a second question to every dispute: whether the buyer authorized what the agent bought. The controls for malicious agents sit in the guide linked above, and the question of who pays when an agent purchase is disputed is covered in AI agent chargeback liability.

Trace the Attack: From Account or Checkout to Chargeback

Every AI-enabled attack a merchant fights ends one of three ways: it is blocked before authorization, it succeeds and generates a dispute, or it succeeds and never gets disputed because the victim never notices. The middle case is where merchants lose twice, once to the fraud and once to the chargeback fee and reason-code exposure that follows. Mapping the path matters more than naming the technology:

• Reconnaissance: bots scrape breached credentials, social profiles, and public order confirmations to build a convincing pretext.
• Contact: generative voice or text impersonates a bank, delivery carrier, or the merchant itself to extract a one-time passcode or card detail.
• Execution: the fraudster places an order or takes over an existing account, often testing small transactions first to confirm the credential works.
• Fulfillment: goods ship or a service is delivered before the cardholder notices the charge.
• Dispute: the actual cardholder, not the fraudster, files an unauthorized-transaction claim, since they never authorized it.

Separate Third-Party Fraud From First-Party Misuse

Not every dispute that looks like AI-driven fraud actually is. First-party misuse, where the genuine cardholder made the purchase and disputes it anyway, is easier to dress up now because generative tools help bad-faith customers write a more plausible denial and fabricate supporting proof. The Merchant Risk Council flagged this shift in its 2023 Global Payments and Fraud Report, and its 2026 Global eCommerce Payments and Fraud Report found 64% of merchants reporting increasing rates of first-party misuse, with one quarter reporting increases of 25% or more, even as the average number of distinct fraud attack types reported in the 2026 survey fell to 3.8 from 4.2 in the 2025 survey.

That split decides your response. Third-party account takeover calls for tighter authentication and step-up controls before authorization. First-party misuse, often labeled friendly fraud, calls for better evidence collection after the sale, because the transaction was never unauthorized, it is being misrepresented as such. The AI strategies for first-party fraud guide covers detection on that side. Treating both as one problem produces the wrong fix in both directions.

Map Signals, Controls, and Liability Before You Approve

AI-generated attacks leave fewer of the old tells, typos, mismatched shipping addresses, obviously scripted chat, but they still leave a signature in behavior and metadata that rules-based filters miss and that your own merchant fraud protection stack should be scoring.

Traditional rules-based systems flag transactions against fixed thresholds, which is exactly what these attacks are built to slip under. A static list of red flags compares a transaction to known bad patterns, while a machine learning model compares it to the account's own behavioral baseline, which a scripted attack struggles to fake across every signal at once. The card-not-present fraud guide maps these controls to each checkout step.

Red Flags for AI-Generated Identities, Documents and Evidence

FinCEN's deepfake alert lists red flags written for financial institutions. They translate directly to merchants who verify sellers, approve high-value accounts, or review customer-supplied proof:

Specify the Evidence to Retain, Before and After Fulfillment

Whether a case ends up as a fraud loss you eat or a dispute you can fight comes down to what you captured while the order was live, not what you can reconstruct after a dispute notice arrives. At minimum, retain:

• Device fingerprint, IP, and session metadata at the moment of purchase, not just at account creation.
• Authentication method used (password only, one-time passcode, biometric, 3D Secure) and whether it was completed or bypassed.
• Delivery confirmation with signature or geolocation, matched against the billing address on file.
• Any customer communication before the dispute, including support tickets that might show the buyer describing the item they received.
• Original image or video files, with metadata, for any claim that rests on customer-supplied media.
• Identity verification results for account openings: the document check, the liveness outcome, and the time it was run.
• The specific behavioral or velocity signal that triggered (or should have triggered) a review, timestamped.

That evidence set separates a defensible response to an unauthorized-transaction claim from a guess. It is also the foundation for the harder question later: can AI improve chargeback dispute win rates? The answer depends entirely on whether the underlying evidence was captured in the first place.

Close the Loop With Dispute Results and Reason Codes

Every dispute that lands, win or lose, is a data point about which of your pre-authorization controls worked. Merchants that treat reason codes as a filing cabinet miss the pattern; merchants that route them back into their fraud rules close the loop. A spike in fraud-coded disputes tied to one shipping carrier, one BIN range, or one login flow is a signal to tighten that specific control, not a reason to add friction everywhere. Network-fed chargeback alerts give you a second chance to refund before a case becomes a formal dispute.

Liability frameworks matter here too. Visa's Acquirer Monitoring Program (VAMP), which replaced the older VDMP and VFMP, uses the combined count of TC40 fraud reports and TC15 disputes divided by the count of settled TC05 card-not-present VisaNet transactions. Its standard Excessive Merchant criteria in AP, Canada, the EU and the US pair at least a 1.5% ratio (from April 1, 2026) with at least 1,500 monthly fraud-and-dispute records, when the acquirer is not Above Standard or Excessive. Apply exclusions and country and regional rules. It also runs a separate monthly enumeration test aimed at card testing (a monthly ratio of 20% or more (the same-month count of enumerated authorization transactions divided by the count of all authorization transactions, approved and declined), together with at least 300,000 enumerated authorization transactions in that same month). Reducing confirmed abuse is the goal of tighter pre-authorization signals and better chargeback fraud prevention controls. Being below one threshold does not guarantee safety from processor review or other applicable criteria. Track your exposure against the current Visa Acquirer Monitoring Program criteria using the actual account notice; merchant and acquirer portfolio criteria differ.

Check the Visa VAMP fact sheet and your acquirer’s applicable notice. For processor implementation and the separate Mastercard reporting periods, see Stripe’s monitoring-program guidance.

Build the Detection Layer Before the Dispute Layer

Detection is where the outcome is decided. eCommerce revenue lost to fraud depends on whether your controls watch the signals AI-generated attacks still leave: device and session changes, login velocity, address and email-age mismatches, and behavior that breaks from an account's own baseline. Detection that looks only at the content of a message fails, because content is now the cheapest thing to fake.

Chargeflow Prevent scans every order after checkout and before fulfillment, scoring identity signals that connect device, IP, email, and payment-method behavior against data from 20,000+ merchants on the Chargeflow network, with a reported false-positive rate under 0.1%. You decide whether to approve, verify, or cancel before the item ships, so you are not choosing between blocking fraud and blocking good customers. Disputes that still arrive go to Chargeflow Automation, which collects the evidence and submits it on your behalf, so the case is built from what was captured at the moment of sale rather than assembled after the fact.

AI Payment Fraud FAQ

What is AI payment fraud?

AI payment fraud is fraud carried out with machine learning, generative text, image or voice, or automated bots, most often to impersonate a trusted party, generate convincing phishing at scale, defeat identity checks, or take over an account. It differs from traditional fraud mainly in speed, scale, and believability, not in the underlying goal of an unauthorized or misrepresented transaction.

How is AI used to commit payment fraud?

Fraudsters use generative AI to write personalized phishing messages and scripts, clone voices to impersonate banks or merchants during one-time-passcode scams, build synthetic identities with AI-generated photos, fabricate damage photos for refund claims, and run bots that automate account takeover, credential stuffing, and card testing at a volume no manual fraud ring could sustain.

Which AI tactics are used against merchants?

The five that reach merchants most directly are automated card testing, account takeover through impersonation scripts, synthetic identity and deepfake onboarding, doctored refund or damage evidence, and malicious shopping agents. Each leaves different signals and lands in a different dispute outcome, as the table above shows.

How much payment fraud involves AI?

No source measures it cleanly. The FBI's 2025 Internet Crime Report counted 22,364 complaints that referenced AI and $893 million in losses, about 4% of the $20.9 billion reported overall, but victims only flag AI when they notice it, so the true share is higher.

Can AI also help merchants detect fraud before it happens?

Yes. Machine learning models can score a transaction against a customer's own behavioral baseline, catching anomalies like device changes, velocity spikes, or authentication bypass attempts that static rules are not built to see. Scoring after checkout and before fulfillment lets you stop an order before it ships.

Does 3D Secure stop AI-driven fraud?

Not by itself. A fully authenticated transaction usually moves liability for fraud-coded disputes to the issuer, but it does not stop an attacker who talks a victim out of a one-time passcode, and the cardholder can still dispute under a different reason code. Keep the authentication record as evidence.

Can AI-generated images and documents be detected?

Sometimes, but detection tools produce both misses and false flags, so treat a flag as one signal. FinCEN lists reverse-image matches to known AI-generated faces, inconsistent documents, webcam plugins during live checks, and device data that contradicts the document as red flags. For customer-supplied photos, ask for the original file and compare it against delivery scans and order data.

Is friendly fraud the same as AI-enabled fraud?

No. Friendly fraud is a first-party dispute where the genuine cardholder made the purchase and disputes it anyway. AI-enabled fraud is typically third-party, where someone other than the cardholder used stolen credentials or impersonation. AI can also make a first-party claim look stronger with fabricated proof, which is why the two need different evidence and different controls.

What evidence helps win a chargeback caused by AI-driven fraud?

Device and session metadata at the time of purchase, the authentication method used, delivery confirmation matched to the billing address, identity verification results, original media files, and any pre-dispute customer communication are the strongest evidence for contesting an unauthorized-transaction claim.