A detailed analysis of preventing attacks on Visa payment gateways in 2025

[Student]

Hello! For educational purposes, I will describe in detail how Visa, one of the largest global payment systems, prevented attacks on its payment gateways in 2025. Payment gateways are critical infrastructure nodes that process transactions between merchants, acquiring banks, card issuers, and end users. Attacks on gateways can lead to card data leaks, financial losses, and a breach of trust in the system. In 2025, Visa faced an increase in sophisticated cyber threats such as digital skimming, enumeration attacks, and merchant gateway compromises, but successfully mitigated the damage through years of investment in technology, analytics, and collaboration. Let's examine the mechanisms, approaches, and results in more detail.

1. Threat Context in 2025​

In 2025, cyberthreats to payment systems became more sophisticated due to the growth of e-commerce, the use of AI by fraudsters, and the increase in supply chain attacks. Key threats to Visa payment gateways included:

• Digital Skimming: Malware (such as Magecart) was implanted on merchant websites to intercept card data as it was entered on payment pages. This posed a threat to gateways, as the compromised data could be used for fraudulent transactions.
• Enumeration Attacks: Fraudsters massively validated card data combinations (e.g., card number, CVV, expiration date) through gateways, then used them for purchases. Visa recorded a 22% increase in such attacks in the second half of 2025, with potential losses of $1.1 billion.
• Payment Return Abuse (PRA) Fraud: Fraudsters compromise merchant gateways to initiate fake refunds or unauthorized transactions. PRA fraud increased by 83% in 2025, often through vulnerabilities in third-party payment plugins.
• Ransomware and infrastructure attacks: While there were fewer direct attacks on Visa gateways, merchant- or acquirer-side ransomware was an indirect threat by blocking access to transaction processing systems.

Visa processes over 200 billion transactions annually, and gateways are a key component. Protecting them requires both preventative and reactive measures, including AI, analytics, monitoring, and international collaboration.

2. Technological and organizational measures​

Visa has invested $11-12 billion in cybersecurity over the past five years (2020-2025), a significant portion of which went toward gateway protection and fraud prevention. Here's a detailed breakdown of its approaches:

2.1. Transaction Monitoring and AI Analysis​

• Infrastructure: Visa uses a global data processing network (VisaNet), which analyzes over 500 million transactions daily in real time. Payment gateways are integrated into this network, and every transaction is checked for anomalies.
• AI and Machine Learning:
  • AI algorithms detect suspicious patterns, such as multiple login attempts with different CVVs (typical of enumeration attacks) or unusually high activity from a single IP address.
  • In 2025, Visa's AI models improved fraud detection accuracy by 15% compared to 2023, reducing response times from hours to minutes.
  • Example: On Cyber Monday 2025 (a peak day for eCommerce), Visa blocked 85% more suspicious transactions than in 2023, preventing hundreds of millions of dollars in potential losses.
• Payments Ecosystem Risk and Controls (PERC) team: This group analyzed risks in the ecosystem, including gateways, and coordinated with issuers and acquirers. They used AI data to create transaction risk profiles.

2.2. eCommerce Threat Disruption (eTD)​

• Goal: Protect gateways from digital skimming, which often begins at the merchants' web page level.
• Mechanism:
  • The eTD system automatically scanned millions of eCommerce websites for malicious code (such as JavaScript skimmers).
  • When a skimmer was detected, Visa notified acquirers and merchants, requiring immediate remediation of the vulnerability (e.g., updating CMS or plugins).
  • In 2025, eTD identified and neutralized skimmers on hundreds of websites, preventing the leakage of card data that could otherwise be used through gateways.
• Effectiveness: The number of skimming attacks remained stable compared to 2023, but their impact was minimized through rapid response.

2.3. Visa Account Attack Intelligence Score​

• Description: A new tool, launched in 2025, based on generative AI. It assessed the risk of account attacks in real time by analyzing user behavior at all stages of the purchasing process (from the shopping cart to the gateway).
• Application:
  • The tool predicted enumeration attacks by analyzing patterns such as mass authorization requests from a single source.
  • Between 2024 and 2025, it blocked 80 million fraudulent transactions worth $40 billion, with a significant portion of that occurring in 2025.
• Features: AI took into account data from millions of sources (IP, geolocation, device, transaction history), which made it possible to block attacks before they were implemented through gateways.

2.4. Scam Disruption Practice​

• Establishment: Formalized in 2025, but began operations in 2025 as a response to the rise of PRA fraud and sophisticated attacks.
• Case example:
  • Visa discovered a network of approximately 12,000 fake websites linked to fraudulent gateways in dating apps. These websites used compromised credentials for fake logins.
  • By correlating transactions with IP addresses and behavioral data, Visa shut down the network, preventing $37 million in losses.
  • The data was passed on to law enforcement agencies, which helped prevent further attacks.
• Result: By 2025, this practice prevented $350 million in fraud, including gateway attacks.

2.5. Tokenization and Security Standards​

• Tokenization: Visa Token Service replaces actual card numbers with tokens, which are useless to fraudsters if intercepted. By 2025, tokenization will cover over 50% of eCommerce transactions, reducing the risk of breaches through gateways.
• 3D Secure (Visa Secure): The updated protocol added two-factor authentication (2FA) for online transactions, reducing the likelihood of unauthorized card use.
• PCI DSS and EMV: Visa required merchants and acquirers to comply with PCI DSS (card data security) standards and use EMV chips, making gateways more difficult to compromise.

2.6. Ecosystem Collaboration​

• Notifications: Visa promptly informed banks, acquirers, and merchants about identified threats. For example, in the first half of 2025, opportunistic ransomware attacks on merchants decreased by 12.3% thanks to Visa recommendations (real-time alerts, vulnerability patches).
• Training: Visa provided training to merchants on gateway security, including implementing secure APIs and monitoring for suspicious traffic.
• International collaboration: Visa has collaborated with law enforcement and other payment systems (such as Mastercard) to share threat intelligence.

3. Technical aspects of gateway protection​

Payment gateways are hardware and software systems that process authorization, transfer, and settlement requests. Their security requires a multi-layered approach:

• Encryption: All data passing through gateways is encrypted using TLS 1.3 and AES-256 standards. This prevents data interception even if the channel is compromised.
• API Security: Visa has implemented strict checks on API requests, including rate limiting and token authentication.
• Real-time monitoring: Visa's systems detected anomalies, such as a surge in transactions from one merchant or region, and automatically blocked suspicious gateways.
• Vulnerability detection: Regular scanning of gateways for vulnerabilities (e.g. SQL injection or XSS) and mandatory patches for all ecosystem participants.

4. Final results and statistics​

Threat	Growth in 2025	Visa Actions	Result
Enumeration Attacks	+22% (hundreds of millions of attempts)	AI analysis, real-time blocking	$1.1 billion in potential fraud blocked
Digital Skimming	Stable	eTD scanning, merchant notifications	Hundreds of websites cleaned, leaks prevented
PRA-Fraud	+83%	Scam Disruption Practice, IP Correlation	$350 million prevented, including $37 million from a network of fake websites
Ransomware	-12.3% (opportunistic attacks)	Notifications, patch recommendations	Minimizing indirect threats to gateways
General fraud	-	Visa Account Attack Intelligence Score	$40 billion blocked for 2024–2025

5. Educational conclusions​

1. A multi-layered approach: Securing gateways requires a combination of technologies (AI, tokenization), standards (PCI DSS, EMV), and organizational measures (collaboration, training).
2. The Role of AI: Generative AI and machine learning make it possible to predict and block attacks in real time, reducing response times to minutes.
3. Ecosystem approach: Payment systems depend on the security of all participants (merchants, banks, acquirers). Visa actively coordinates efforts to minimize vulnerabilities.
4. Proactivity: Tools like eTD and Account Attack Intelligence Score demonstrate the importance of proactively detecting threats before they occur.
5. Global Impact: Gateway security not only prevents financial losses but also maintains trust in the digital economy.

For in-depth study, we recommend:

• Отчёты Visa Payments Ecosystem Risk and Controls (PERC) и Payment Fraud Disruption (PFD).
• Documentation on PCI DSS and EMV standards.
• Research eCommerce cyber threats like Magecart through specialized cybersecurity resources.

If you'd like to dive deeper into a specific aspect (such as technical details of AI or tokenization), let me know!