Mastercard Adapts Fraud Systems as Bots Become Buyers
Mastercard's fraud detection system, which processes 175 billion transactions annually with decisions made in under 100 milliseconds, is undergoing a significant shift. Greg Ulrich, Mastercard's chief AI and data officer, explained on July 14 at VB Transform 2026 that the company's risk rules, initially designed to prevent bots from transacting, now need to be reconfigured to enable them. This adaptation is necessary because bots are increasingly becoming the entities initiating purchases, transforming the nature of transactions the system must evaluate. Ulrich highlighted that trust is foundational to Mastercard's operations, enabling merchants to accept payments and consumers to transact securely, with established dispute resolution processes.
Ulrich detailed how generative AI is enhancing fraud detection, allowing Mastercard to identify 300-400% more high-risk transactions without increasing friction for consumers. The company's Safety Net system has already blocked over 70 billion fraudulent transactions, and Mastercard is developing its own transformer model for enhanced security and personalization. AI is also crucial for Mastercard's services business, which constitutes about 40% of its operations and is growing rapidly, with a third of these services already AI-driven. The scalability of AI, Ulrich emphasized, depends on the trust placed in AI agents by consumers, businesses, and financial institutions.
Mastercard is implementing a five-layer framework to manage agentic commerce, where authority is delegated for transactions. This framework includes identity verification (KYA – Know Your Agent), verifiable intent to ensure original instructions are met, controls for transaction parameters, execution via Mastercard Agent Pay (launched with partners like Microsoft and OpenAI), and intelligence for risk assessment and insights. This structure is being extended beyond consumer purchases to business-to-business procurement, envisioning autonomous inventory management and supplier replenishment systems. The company is also collaborating with advanced AI models like Anthropic's Mythos and OpenAI's GPT-5.5-Cyber, viewing them as powerful tools for identifying new vulnerabilities, while reinforcing its security protocols and sharing its architectural approach with others.
Mastercard's strategic pivot to accommodate bot-driven transactions reflects a broader industry challenge: the rapid evolution of AI capabilities outpacing traditional security paradigms. The company's historical focus on preventing bot fraud now requires a fundamental re-architecting of its risk frameworks to enable, rather than block, automated commerce. This necessitates robust identity and intent verification mechanisms, moving beyond simple transaction monitoring to understanding the delegated authority and constraints inherent in agentic commerce. The development of a multi-layered trust infrastructure, encompassing identity, intent, controls, execution, and intelligence, appears critical for navigating this new landscape. The success of this transition will likely hinge on establishing industry-wide standards for agent interoperability and trust, particularly as agentic commerce expands into complex B2B procurement. The challenge lies in balancing the enablement of efficient, automated transactions with the imperative of maintaining security and preventing emergent systemic risks in a rapidly evolving AI ecosystem.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.