Scammers are shifting from stealing payments to impersonating the payer

According to Mediacorp, payment fraud is changing shape. The old version involved intercepting a transaction before it reached its destination. The newer version skips that step entirely. It persuades the account holder to authorise the payment themselves.

That shift matters because it moves the fraud from the transaction to the person. A Visa-commissioned study found that close to seven in 10 Singapore residents trusted digital payments, while 42 per cent had encountered a scam and 8 per cent had lost money to one. Those figures sit together for a reason. Trust in the payment system is high. Trust is exactly what the newer fraud tactics are built to use.

How the approach lands

Fraudsters now combine artificial intelligence, automation and social engineering to study a target and time their approach. Adeline Kim, Visa's group country manager for regional Southeast Asia and senior vice president for global clients in Asia Pacific, describes the change directly: fraudulent activity is moving from transaction to identity. Scammers can tailor exactly how and when they strike, which makes the approach convincing rather than random.

This is the step the scam depends on. Once a payment is authorised by the account holder, it looks legitimate to the systems checking it. A transaction blocked for looking suspicious is one thing. A transaction approved by the person who owns the account is much harder to unwind, because nothing about the mechanics of the payment looks wrong. The fraud has moved upstream, into the moment of persuasion, before any money changes hands.

Kim frames the business risk in terms of speed and scale rather than volume alone. The concern for banks, merchants and fintech firms is not simply how much fraud exists, but how fast and how widely a single technique can be deployed once it works. She argues the response has to match that pace, calling for detection that is fast, intelligent and coordinated.

Where the old checks fall short

Fixed rules that flag or block risky transactions were built for a world where fraud looked different from normal activity. They still matter, but they were not designed to catch a transaction that looks exactly like something the account holder would do, because the account holder did do it. Visa's answer, described in the piece, is a portfolio called Visa Protect that draws on more than three decades of AI use in fraud detection, analysis of over 250 billion transactions a year, and around 500 data points per transaction, including technology from Featurespace, acquired by Visa in 2024. These models learn what is typical for a given customer and flag activity that falls outside that pattern, rather than relying only on fixed rules.

None of that changes what a person facing a live approach needs to notice. The tell is not in the transaction. It is in the moment before it, when someone else is shaping the decision to pay.