Card fraud, scams and payment security.
Guides and analysis for card issuers on stopping fraud without stopping good customers.
Approving card payments without biometrics, still signed by the phone
Not every cardholder uses biometrics. How a device passcode can approve a card payment without weakening proof that it came from the cardholder's own phone.
Michael IngiccoDevice binding vs browser fingerprinting: proving a payment came from the cardholder's phone
Browser fingerprinting guesses who a device is. Hardware-bound keys prove it. What issuers should know before choosing how to verify the cardholder's phone.
Michael IngiccoRemote access scams: when an impostor is controlling the cardholder's phone
Remote access scams trick cardholders into installing screen-sharing apps, then use their own phone to pay. How the scam works and how issuers can respond.
Michael IngiccoShadow mode: how to test fraud rules on live traffic without declining anyone
Shadow mode lets an issuer run a new fraud rule on real payments and see what it would have stopped, without affecting a single cardholder. How to use it well.
Michael IngiccoVisa VAMP explained: the ratio, the thresholds and what changed in 2025-2026
The Visa Acquirer Monitoring Program combines fraud and disputes into one ratio. The thresholds, the April 2026 change and what it means across the payment chain.
Michael IngiccoFail open: why a fraud system's outage should never decline a card
An anti-fraud layer that sits inside card authorisation needs a rule for when it fails. Why 0Fraud fails open, and how issuers keep visibility when it does.
Michael IngiccoReal-time authorisation decisioning: how issuers can decide every card payment
Modern issuing processors let issuers approve or decline each card payment in real time. How it works, what to decide on and what to watch for latency.
Michael IngiccoAPP fraud vs card fraud: what card issuers need to know
Authorised push payment fraud and card fraud are counted separately, but scams increasingly cross between them. The 2025 numbers and what they mean for issuers.
Michael IngiccoSIM swap fraud: how it works and why SMS codes aren't enough
In a SIM swap, an impostor takes over the victim's phone number and with it their SMS passcodes. How the attack works and how to protect card payments from it.
Michael IngiccoDoes 3D Secure stop fraud? What it does well, and the gap it leaves
3D Secure confirms the cardholder is the one paying. Here is what that protects against, the 2026 numbers, and the scams that pass it because the cardholder is real.
Michael IngiccoBank impersonation scams: how fake bank calls work and how to stop them
Impostors posing as the bank's fraud team are among the most costly scams. The script they follow, the 2025 losses, and what issuers can do at the moment of payment.
Michael IngiccoManually keyed card payments: why typed-in card numbers attract fraud
Payments where the card number is typed in by hand skip the chip entirely. Why keyed and phone-order transactions are a fraud risk and how card controls can block them.
Michael IngiccoCard testing fraud: what it is and how issuers can stop it
Card testing uses small or zero-value payments to check which stolen cards still work. How the attack works, why issuers should treat it as an early warning, and how to respond.
Michael IngiccoWhat is card-not-present fraud? A guide for card issuers
Card-not-present fraud is the largest category of card fraud. What it is, why it keeps growing, and the controls card issuers can use to stop it before payments move.
Michael Ingicco