---
title: Industrialized Fraud: How AI Is Reshaping the Fraud Attack Landscape 
source_page: https://www.sardine.ai/media/fraudology/episodes/fraud-attack-landscape
canonical: https://www.sardine.ai/media/fraudology/episodes/fraud-attack-landscape
format: text/markdown
date: 2026-10-22T04:01:00.000Z
description: AI has industrialized modern e-commerce fraud. Breaking down the changing fraud attack landscape, from card testing to refund abuse and ATO…
---

**Quick links:** [Human page](https://www.sardine.ai/media/fraudology/episodes/fraud-attack-landscape) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# Industrialized Fraud: How AI Is Reshaping the Fraud Attack Landscape 

**Published:** 2026-10-22T04:01:00.000Z

AI has industrialized modern e-commerce fraud. Breaking down the changing fraud attack landscape, from card testing to refund abuse and ATO…

Welcome back to Fraudology.
I’m sharing the presentation I gave to open the Merchant Fraud Alliance conference in Chicago. It was a “where are we right now” look at the fraud attack landscape, and it grew out of a question I heard from merchants all through the conference. What is actually different about fraud today, and how much of it comes down to AI?
If you work in e-commerce fraud, you have probably felt the shift in your own numbers. Generative AI has changed who can attack, how quickly they can do it, and how well the attacks blend in with good customers. I walk through how AI fraud looks from the ten thousand foot view I get from talking with so many merchants, and I pair it with fraud prevention ideas you can take back to your own team and your own leadership.
What you’ll hear in this episode:
Why fraud has been industrialized, and how AI lowers the cost, skill, and time needed to attack e-commerce at scale
The headline numbers, including fraud pressure up 33% year over year, account takeover up 78%, card testing up 175%, and BOPIS fraud up 65%
How the EMV chip shift in 2015 and the rise of account takeover compare with what AI is doing to the fraud attack landscape today
Why AI-powered account takeover keeps climbing, and how generative AI makes phishing cheap to personalize
How AI card testing attacks differ from old scripts, including how agents sort cards and adapt to your controls
How one campaign can move from identity to checkout to customer support to disputes, and why event-based controls miss it
Why evidence is now cheap to fake, from fake receipts and identity documents to fake damage photos and deepfakes
What a dark web card marketplace demo shows about how easy it is to buy the pieces of an attack
How to fight AI with AI fraud detection using session-level data, telemetry, device ID, and behavioral biometrics
You should listen to this episode if you:
Need to explain fraud increases to leadership and want current numbers to bring with you
Have seen a sudden rise in account takeover or card testing, or heard from your processor about the Visa enumeration program
Deal with refund fraud or chargebacks involving photos, receipts, or item not received claims
Are evaluating fraud prevention tools and wondering why snapshot-based controls keep missing attacks
Want to hear how merchants are using generative AI to spot AI-written scams
Couldn’t attend the Merchant Fraud Alliance and want to hear how the conference opened
### Episode notes
Two earlier shifts in fraud, and why AI is the third
The first was the move to EMV chip cards. Before the chip, US cards used a magnetic stripe that was easy to counterfeit, and fraud was split about evenly between in person and online. Other markets, like the UK, had already shown what happens when chips arrive. In person fraud falls and online fraud climbs. I started warning merchants about this in 2013, and when the liability shift took effect in October 2015, online fraud rose just as those markets had predicted.
The second shift came soon after. As merchants got card fraud under control, criminals turned to customer accounts. Account takeover meant the fight now included the login page and not only the payment page.
AI is the third shift. I could see the first one coming because other markets had already lived it.
Industrialized fraud, by the numbers
The headline numbers are hard to ignore. Fraud pressure is up an estimated 33% year over year, account takeover is up 78%, card testing is up 175%, and buy online pickup in store (BOPIS) fraud is up 65%. Interpol estimates that AI-powered schemes return about 4.5 times what traditional attacks do, and an estimated three in ten retail fraud attempts are now AI-generated. I expect that share to be higher next year. Our goal has never been to end fraud completely. It’s to make your site harder, slower, and more expensive to attack than the next one, which is the old idea that you only have to outrun the slowest person running from the bear. AI trims every one of those advantages by making attacks faster, cheaper, and easier to run.
AI powered account takeover and card testing attacks
A script repeats the same action over and over, and you can catch it. An AI agent adapts. It notices what your site will and won’t allow and adjusts. That is a big reason account takeover keeps rising. Generative AI makes phishing easy to personalize, and many messages look ordinary because they claim to come from a shipping company, a large retailer, or a payment brand most people already have an account with. Card testing follows the same logic. Someone can feed thousands of rows of card data into an AI tool, sort the cards by BIN, authorization response, and address, and test them with low dollar transactions. Attackers can test on other sites first. That means you may not see a pile of declines when those cards reach yours. It breaks a pattern many of us relied on for years.
One campaign across the whole customer lifecycle
Fraud used to be divided among specialists. One group handled identity, another handled card testing, another cashed out, another worked customer service, and another filed chargebacks, and sometimes they sold their services to each other through fraud as a service. With AI agents, one campaign can do all of it. It can use a stolen or synthetic identity, check out, contact support to claim the item never arrived, and then open a dispute with flawless documentation, because that documentation is fake too. Account takeover often ends with drained loyalty points or stored value, or with a changed payee on a marketplace seller’s account. Event-based controls miss this, because approvals, logins, and identities each look valid in isolation. The loss shows up later, after many successful transactions, which means you may not know you’re under attack until it’s over.
Cheap evidence, cheap storefronts
Fake receipts, order details, damage photos, dispute narratives, voice calls, and identity documents can all be produced on demand now. A large food delivery company told one MFA deep dive that damage photos are among the biggest drivers of refund abuse. Someone can ask a chatbot to add mold to a photo or crack five eggs in a dozen, and retailers see the same thing with a hole added to a piece of clothing. I also believe deepfakes are close to impossible to detect now, which puts identity verification at risk from deepfake identity verification fraud. Fake storefronts are just as cheap. As Matt Vega has shown, you can build a lifelike copy of a merchant’s site in about ten minutes for under $50 and point social media ads at it with a URL that’s off by one letter, which is ad fraud working hand in hand with phishing. One campaign this year compromised more than a hundred retail sites at once with online card skimmers and took over 600,000 card records. I also played a demo Matt recorded of a dark web card marketplace, where a buyer can filter by country, state, zip code, card brand, and BIN. AI isn’t inventing new methods. It’s helping the old ones blend in with legitimate customers.
Reading the whole session, and every fraudster’s tell
The teams catching AI attacks connect identity, intent, and context from discovery through post purchase. They read patterns across sessions and not only individual events. I use a security camera analogy. A snapshot at login or checkout is like a still photo of someone breaking into your house, and you know it happened but not how they got in or what they took. Session-level data for fraud detection works like cameras inside and outside the house. Soups Ranjan said in a session I moderated that every fraudster has a tell, and telemetry helps you find it, such as a phone held in an unusual way or lying face down. The leaders I see with low chargebacks and few false positives use device ID and behavioral biometrics together, and they ingest the right fraud signals, since one missed signal can become a loss, a chargeback, or a false positive.
Explaining it to leadership, and getting scrappy
If you have to explain a spike to your leadership team, use the industry numbers. Several merchants I know have had to account for sudden jumps in account takeover and card testing since the spring, and some have heard from their processor about the Visa enumeration program. The Merchant Risk Council reports that 80% of merchants name technology infrastructure as their biggest fraud challenge, which tells me the real hurdle is getting the right tools approved. Journey data can help, because marketing loves to see what customers do on the site and that gives you an ally when you ask for budget. Leaders are also asking teams to do more with less, and some merchants are getting scrappy. One marketplace team loaded real buyer and seller chats and suspected phishing chats into a generative AI tool and asked what the AI-written messages had in common. It found a pattern of an opening greeting, a run of open-ended questions, and then a prompt to click a link. AI can often spot AI, and some vendors now offer AI agents that screen manual review cases and propose new rules. We can fight AI with AI, and sharing what works is how we keep up.
### Key takeaways
AI has lowered the cost, skill, and time needed to attack e-commerce, which is why I describe fraud as industrialized.
Fraud pressure, account takeover, card testing, and BOPIS fraud are all rising sharply, and AI is a major reason.
Interpol estimates AI-powered schemes return about 4.5 times more than traditional attacks, and about three in ten retail fraud attempts may already be AI-generated.
Scripts repeat and AI adapts, which makes AI card testing attacks and AI-powered account takeover harder to catch with old rules.
A single AI-driven campaign can span identity, checkout, support, and disputes. Controls that only watch single events will miss it.
Fake receipts, identity documents, and damage photos are cheap to produce, which makes refund abuse and chargebacks harder to judge on evidence alone.
Deepfakes are close to impossible to detect by eye. Identity checks need support from behavioral and device signals.
Session-level data, telemetry, device ID, and behavioral biometrics let you see the whole journey and not just a snapshot.
Industry numbers give you a credible way to explain increases to leadership and to ask for better tooling.
Merchants and vendors are already using AI to fight AI, and sharing what works makes every team harder to attack.
### Final takeaway
If there’s one thing I hope you take from this episode, it’s that the fraud we are fighting isn’t new. It’s familiar fraud running faster, cheaper, and at greater scale. That means the answer is not to chase every new trick. It’s to see more of the customer journey, ingest the right signals, and bring leadership along with real numbers. That gives your tooling a chance to keep pace. Your fraud rate rising may simply mean you’re on par with the industry. What you do next is what sets you apart.
Episode resources & links
Connect with Karisse Hendrick | LinkedIn
Host of the Fraudology Podcast
Award-Winning Cyberfraud Expert
Ecommerce Fraud Prevention Consultant
Startup Advisor, Keynote Speaker, and
Consultant to Fortune 500 merchants