Mastercard doubles compromised card detection rate using generative AI and graph technology

The payment industry faces mounting card fraud losses — Juniper Research estimates global payment fraud will reach $40.62 billion by 2027. Mastercard, operating across billions of cards and millions of merchants, confronted a specific detection gap: fraudsters selling stolen credentials on illegal marketplaces typically expose only partial card numbers (such as the last four digits) to attract buyers while evading identification. This partial data can match multiple cards, making proactive blocking nearly impossible. BIN attacks — where automated software systematically tests card number combinations starting from bank identification numbers — and large-scale account takeover schemes compounded the challenge further, leaving issuing banks in a reactive position and cardholders exposed until fraud had already occurred.

Mastercard developed a proprietary system combining generative AI and graph database technology, integrating it into its Cyber Secure product. The generative AI component — trained on large transaction datasets — extrapolates full 16-digit card credentials from the partial numbers circulating on illegal marketplaces, converting incomplete signals into actionable intelligence. The graph technology builds a dynamic network mapping relationships between cards and merchants, continuously updating risk links with each new data iteration. Rather than directly scanning illegal websites, the system analyzes recently reported fraud transactions, suspected compromised merchants, and pre-authorization testing patterns, sourcing data through partners and third parties to maintain compliance. This capability was also layered into Mastercard's Decision Intelligence platform, creating a self-reinforcing detection loop that adapts as fraud tactics evolve.

The system delivered a 2x improvement in compromised card detection rate, identifying at-risk cards before fraudulent transactions occur and enabling banks to block and reissue cards far faster than previously possible. In one documented example, a single card's graph linkage surfaced 200 additional cards sharing risky connections to a merchant where 30 compromised cards had already been used — dramatically narrowing the fraud window. Mastercard's Decision Intelligence platform, enhanced with generative AI, now scores 143 billion transactions annually. Key outcomes:

• 2× increase in compromised card detection rate, upstream of point-of-sale
• 143 billion transactions scored per year via Decision Intelligence
• Faster bank alerts enabling prompt card blocking and reissuance
• Improved coverage against BIN attacks and large-scale account takeover schemes

• Generative AI's ability to reconstruct missing data — predicting full 16-digit credentials from partial card numbers — creates a fraud signal class unavailable to traditional rule-based or tabular ML systems.
• Graph databases are particularly suited to payment fraud detection because they natively model card-merchant-fraud-event relationships that relational schemas represent inefficiently.
• Proactive upstream blocking, before a fraudulent transaction is attempted, is categorically more effective than reactive point-of-sale scoring alone.
• Partnering with third parties for data sourcing, rather than directly engaging illegal marketplaces, enables effective intelligence gathering while maintaining regulatory and ethical compliance.
• Fraud detection models must be architected for continuous adaptation — attacker methodologies shift rapidly, and static models degrade as BIN attack patterns and credential-theft tactics evolve.