Mastercard reinvents fraud detection for the age of shopping bots

For decades, Mastercard trained its anti-fraud system to identify and block bots as if they were thieves. But the rise of automated commerce — where AI agents buy on behalf of consumers and businesses — has forced the payments network to make a radical shift. Greg Ulrich, chief AI and data officer at Mastercard, summed it up clearly at the VB Transform 2026 conference: "We've built risk rules designed to stop a bot from transacting. Now we need to enable the bot to transact, which requires a change in our risk framework."

What happened?

Mastercard processed 175 billion transactions last year, each evaluated in less than 100 milliseconds with a fraud score from 0 to 999. Until now, its system was optimized to reject any automated behavior. But the emergence of AI agents — such as shopping assistants, corporate replenishment bots, or autonomous commerce platforms — has created a new category of legitimate transactions that look fraudulent under the old rules.

Ulrich explained that the change is not merely technical but one of trust. "What will enable AI to scale is not the capabilities of the agents, but how much we trust that those agents act on our behalf," he said. Mastercard is adapting its Safety Net — which has already blocked over 70 billion fraudulent transactions — to distinguish between malicious bots and authorized agents.

Why is it important?

40% of Mastercard's business is services, and a third of those services are already AI-based, growing faster than the rest. The company is building its own transformer model on transactional data to power new security and personalization solutions. "With the new technology we can incorporate more data and context, and we now identify between 300% and 400% more fraudulent transactions in high-risk bands, without adding friction for consumers," Ulrich noted.

This paradigm shift affects the entire payments industry. If traditional systems treat any automation as suspicious, agentic commerce — where a user delegates authority to an agent to make purchases — would be paralyzed. Mastercard is solving the dilemma of how to verify the intent, behavior, and constraints of each delegated transaction.

Consequences and context

Mastercard's transformation has implications for issuers, merchants, and consumers. Issuing banks will receive more precise risk scores that include the agent's context, not just the card's. Merchants will be able to accept automated transactions without fear of massive chargebacks. And consumers will gain the ability to delegate recurring or complex purchases to AI assistants with the same security as if they did them themselves.

Ulrich compared the challenge to the evolution of e-commerce fraud: "We went from a world where risk was assessed transaction by transaction to one where we need to assess intent and delegated authority." Mastercard is already testing mechanisms for users to define explicit constraints for their agents, such as spending limits, product categories, or approved vendors.

What should readers know?

• Not all bots are bad: The payments industry is redesigning its systems to distinguish between fraudulent bots and authorized agents.
• Generative AI is already in production: Mastercard uses transformer models to analyze transactions in milliseconds, improving fraud detection without adding friction.
• Agentic commerce requires new trust infrastructure: Security no longer depends solely on the user, but on verifying the agent's intent and constraints.
• Mastercard leads the change: As a global processor, its approach will set the standard for other players (Visa, PayPal, banks) to adopt similar models.

"What will enable AI to continue scaling is not the capabilities of the agents, but how much we trust that those agents act on our behalf" — Greg Ulrich, Chief AI and Data Officer, Mastercard

Mastercard shows that trust is the new battleground of digital commerce. Its adaptation is not just technical: it's a cultural shift that redefines what it means to be a legitimate buyer in a world where machines buy for us.