Visa recently started using a generative AI (GenAI) tool to crack down on brute force attacks. According to the company, the tool can assign real-time risk scores to transactions, allowing it to identify and stop enumeration attacks based on automated scripts and botnets. Such attacks are typically used to test systems for vulnerabilities, which more sophisticated methods can then exploit.

How do brute force attacks work?

Essentially, brute force attacks, or enumeration attacks, as they are also known, take place when hackers use software or automated scripts to submit a type of transaction called a card-not-present transaction.

These transactions go through a combination of payment values, like CVV2 (card’s verification value) or Primary Account Number (PAN), postal codes, expiration dates, and alike. Once they receive an approval response, they will know that the payment account details they have are legitimate.

All that remains after that is to drain the bank account or push the original user’s credit card bill sky high, landing them in debt. According to Visa, these attacks have become a major issue, responsible for over $1.1 billion in financial losses yearly.

The card testing attacks still require sophisticated technologies, but things like botnets and automated scripts are easy to obtain. This is all the hackers take to exploit vulnerabilities at an unprecedented speed and scale.

Visa responds by utilizing GenAI capabilities

While numerous solutions against this issue have been tested in the past, Visa believes that the key to combating enumeration attacks lies in generative IA.

The company is updating its Visa Account Attack Intelligence (VAAI) with a new tool that uses generative AI components. This way, the firm can identify and score enumeration attacks to determine their level of risk.

In other words, the VAAI Score, a new security measure that Visa added, will assign a risk score to each transaction in real time. The score will show whether transactions are low-risk or high-risk, and it will be able to detect enumeration attacks early and warn the card issuers that someone is trying to test the cards via Card-Not-Present (CNP) attacks.

Visa will enable the solution to US issuers first, while it will become available in Europe starting April 2025.

The company stressed that around 30% of enumerated accounts tend to experience some sort of fraud within five days from when the fraudster obtains access to their payment information. With the VAAI Score able to detect the attacks in real-time, issuers will have time to react before the fraudsters make their move.

Furthermore, Visa’s chief risk and client services officer, Paul Fabara, stated that the tool reduced the false positive rate by 85% compared to other existing risk models. This is possible because the VAAI Score focuses on specific signals accompanying enumeration, which lets it perform better than other solutions.

He added: “Enumeration can have lasting impacts on our clients and there’s an immediate need for tools that can better detect and prevent these attacks in real-time. With the VAAI Score, our clients now have access to real-time risk scoring that can help detect the likelihood of an enumeration attack so issuers can make more informed decisions on when to block a transaction.”