A few years ago, a tourist in Mexico used his credit card to withdraw cash from an ATM. When he got home and looked at his card statement, he saw that the card had also been used to purchase several pieces of jewelry. This was strange: Not only had he not bought anything with the card on vacation, the transaction had happened five minutes after the ATM withdrawal — at a store on the other side of the country.

Fortunately, after reviewing his case, a team at his bank agreed that — although their AI fraud detection tools had not flagged the purchase as suspicious — it was highly unlikely that he had bought the jewelry himself, so they refunded the purchase. As they dug further, the team determined that scammers had probably stolen his credit card information from a reader hidden in the ATM and sent it to an accomplice on the opposite coast.

The ease, speed and anonymity of modern payments has given rise to fraud schemes like this on a scale that’s impossible for humans to keep pace with. Fortunately, they don’t have to, since AI applications now monitor every transaction and keep watch over the entire card network for attacks. These AI models sort through data more efficiently than any human could.

Mastercard has been harnessing AI for years for fraud detection and currently uses it to secure more than 159 billion transactions annually, preventing billions of dollars in fraud losses. Last year, Mastercard acquired Recorded Future, which uses AI to analyze millions of data points daily, identifying patterns and anomalies that signal potential threats.

But as much as humans need AI, AI also needs humans. While automated tools do the grunt work, for the results to be useful, developers must continually supply real-life context — by identifying new types of fraud, determining how to prevent it without disrupting the larger network and programming the new rules into the algorithm. This human input is what turns raw AI power into relevant and practical intelligence.

As AI and machine learning models grow more powerful, it’s tempting to believe that technology alone can outpace today’s cybercriminals, says Mastercard’s Johan Gerber, global head of Security Solutions. “But behind every alert, anomaly or flagged transaction is a crucial, incremental layer that algorithms can’t replicate: human judgment. When human judgement is combined with AI, that is what makes it truly effective and ensures it remains responsible.”

While AI is designed to discern subtle patterns in reams of data, it isn't always equipped to handle outliers. Without human oversight, unexpected events could trigger missed threats, false alarms and other distortions.

“Even with these powerful tools, you still need people,” says Vince Haulotte, director of market delivery in Mastercard’s fraud and risk decisioning business. “You have to use a grain of salt and take context into account to make sure the AI’s response is effective.”

For example, AI systems were monitoring the traveler’s credit card use during his Mexico vacation. But the AI needed a human to tell it that there was something funny about two transactions in quick succession on opposite sides of the country, and it needed a human to show it how to look out for similar incidents in the future.

To prevent this particular scam from affecting other customers, Haulotte, then a programmer working on the Brighterion AI platform, created a new rule that would flag geographically impossible transactions. Brighterion monitors credit card transactions in real time, 24/7, and scores them based on how risky they seem; when a transaction is flagged as potentially fraudulent, the system immediately notifies the card user’s bank. (Each bank can customize the score threshold for taking action, such as sending an alert or even rejecting the transaction.) 

Safety Net, another Mastercard product, uses AI to monitor the entire card network for signs of attacks. For example, if a website is flooded with thousands of new accounts within a short period, it could be because fraudsters are spamming the site to guess valid card numbers through brute force.

Of course, an AI model doesn’t know that; it can’t necessarily understand the finer details of human behavior. As a result, it might also raise a red flag when a successful promotion — or, say, Cyber Monday — causes a site’s traffic to spike. Recognizing the difference is where the humans come in.

“With a surge of genuine transactions like that, I’ll partner with an account manager to understand what’s going on and put precautions in place to prevent false alarms,” says Brett Thomson, director of product development at Safety Net. “You’ve got to give the AI some direction.”

Because criminal strategies are continually evolving, human expertise is also essential for identifying new threats and determining how to stop them. As soon as fraudsters realize that their strategies aren’t working anymore, they devise new schemes. But because AI is trained on past data, monitoring tools don’t always spot these new patterns immediately. So it’s up to human developers to update and train the algorithms in an ongoing game of cat and mouse.

“After we put a mitigation in, they'll change their strategy. Then we'll notice that strategy and add a new mitigation,” Thomson says. “It’s a constant back and forth, each of us watching how the other reacts to the next development.”

This relentless dynamic ensures that Thomson, Haulotte and their colleagues across the industry remain key players in the fight against fraud.

“I’m continually surprised by the audacity and imagination of the fraudsters,” Haulotte says. “There are always new fraud trends, so we have to keep building new solutions to stay ahead of them. Our work never stops.”