Visa Malaysia Unveils 2026-2028 Security Roadmap to Tackle AI Scams

Visa has unveiled its Malaysia 2026-2028 Security Roadmap, a strategic framework designed to combat the rise of AI-driven scams and social engineering. For fintech leaders, this initiative signals a shift from technical credential protection to behavioral security, addressing the RM2.97 billion lost to financial fraud in Malaysia during 2025 as digital commerce hits record highs.

What was announced

The roadmap outlines six core priorities to fortify Malaysia’s payment ecosystem over the next three years. Central to the plan is the transition away from SMS one-time passwords (OTPs) toward more secure biometric and in-app authentication methods, including payment passkeys. Visa is also pushing for the wider adoption of tokenization to replace sensitive personal account numbers (PANs) and the implementation of Click to Pay to streamline e-commerce checkouts.

The initiative responds to a shift in the threat landscape where fraud has evolved from simple credential theft to sophisticated authorized payment scams. These scams often exploit human behavior through urgency and social engineering. To counter this, the roadmap emphasizes network-level intelligence and real-time risk detection. This includes improving cyber readiness and oversight of third-party vulnerabilities while strengthening fraud reporting and merchant onboarding compliance.

Technologically, the strategy leverages Visa’s global infrastructure, which includes over 150 AI and machine-learning models. Specific tools mentioned include Visa Advanced Authorisation for real-time risk assessment, Visa Provisioning Intelligence to prevent token fraud, and Visa Protect for account-to-account payments. The roadmap also incorporates behavioral analytics from Featurespace, which evaluates over 400 signals in milliseconds to identify anomalies. This comes as ICT and e-commerce contributions to Malaysia’s economy reached RM451.3 billion in 2024, making the security of these digital channels a national economic priority.

"As Malaysia’s digital economy continues to expand, maintaining confidence in digital payments is fundamental to ensuring that consumers and businesses can participate fully in that growth. Yet trust cannot be sustained by any one organisation acting alone. It requires financial institutions, regulators, merchants, technology providers and consumers to work together, combining shared accountability with the right security capabilities. With this roadmap, Visa is setting out a common direction for the industry to collectively work towards in strengthening the resilience of Malaysia’s payments ecosystem, while continuing to enable secure and seamless digital commerce,"

Jason Phua, Head of Clients, Visa Malaysia.

The companies involved

Visa is a global leader in digital payments, facilitating transactions between consumers, merchants, and financial institutions across more than 200 countries and territories. The company has invested over US$12 billion globally in technology over the past five years to enhance network security and reduce fraud. Visa Malaysia operates as the local arm of the payments giant, working closely with regional regulators and financial institutions to implement market-specific security frameworks, such as the roadmap first introduced in 2019 and refreshed in 2023.

The roadmap also highlights the role of Featurespace, a specialist in fraud and financial crime prevention. Featurespace provides the behavioral analytics technology that underpins many of Visa’s real-time detection capabilities. By analyzing hundreds of behavioral signals at high speed, the firm helps identify fraudulent activity that traditional rules-based systems might miss. This collaboration is part of Visa’s broader strategy to integrate advanced machine learning into its global network, which has already disrupted more than US$1 billion in fraud attempts through its Scam Disruption initiative over a single year.

What FF News has reported before

Visa has remained active in expanding its platform capabilities and regional reach. FF News recently reported on how Visa, _able, and Onafriq Partner to Expand Visa Flex Credential Across CEMEA Markets, demonstrating the company’s focus on flexible payment credentials. In the infrastructure space, REPAY Signs Reseller Agreement with Visa to Empower ISOs and ISVs with Direct Visa Platform Connect Access, highlighting the opening of Visa’s platform to more service providers. Additionally, the network's role in global issuance was underscored when Nium Expands Global Infrastructure with Domestic Card Issuance Launch in the United States using Visa’s rails. These developments show a consistent pattern of Visa scaling its technological core while localizing security measures in specific markets like Malaysia.

What this means

The Malaysian roadmap reflects a broader industry realization: technical encryption is no longer enough to stop modern fraud. As scammers pivot toward social engineering and "authorized" scams, the burden of security is shifting from the perimeter to the point of authentication. The move away from SMS OTPs toward biometrics and passkeys puts significant pressure on smaller financial institutions and merchants to upgrade their legacy stacks or risk becoming the weak link in the ecosystem. This announcement highlights that AI is now a double-edged sword; while it enables more sophisticated attacks, it also provides the millisecond-level behavioral analysis required to defend a high-velocity digital economy.