SINGAPORE, 20 May 2026 - Mastercard RiskX 2026 brought senior risk, identity, and fraud leaders from across APAC to Singapore. The agenda reflected the shape of the year ahead:
Payment attack surface keeps widening
Scam economy is becoming industrial
AI is reshaping both offence and defense
Customer-centric trust hasn't stopped being non-negotiable
The most forward-looking conversation in the room was about agentic commerce. What happens when the customer is no longer the one tapping the button?
The conversations driving the industry
As digital commerce extends across more devices, more channels, and more cross-border flows, the surface that needs to be defended now spans onboarding, account changes, post-purchase interactions, and the increasingly autonomous traffic moving through APIs and platforms. Quite simply, there are more places things can go wrong.
Authorized push payment (APP) scams, romance and investment fraud, and synthetic-identity abuse are no longer isolated incidents. They operate as organized supply chains, and disrupting them takes coordinated defenses across issuers, schemes, merchants, and platforms. No single participant has full visibility on its own.
Furthermore, the same generation of AI now strengthening risk models is also being adopted by adversaries who generate synthetic identities, automate social engineering, and probe defenses at scale. The early signs of agentic commerce, where autonomous agents transact on behalf of consumers, raise risk questions the industry has not yet fully designed for.
The contradiction between customer experience vs tighter security workflow isn’t new. Customers expect invisibility and assurance at the same time, and designing for both is now a structural design problem, not a tuning exercise.
The maturity question is no longer whether organisations have fraud intelligence. It’s whether that intelligence flows into operational decisions in the moment. The teams that win are the ones that closed the loop between signal and action long before the moment of truth.
What McLaren pit lane teaches risk leaders
Imagine a team of over 1000+ people spending months to strategize and prepare for a single F1 race. The strategy team and aerodynamicists analyze historical data from previous years, tire degradation rates, and weather patterns to map out baseline expectations. Simulations run thousands of race scenarios to find the optimal pit window. Yet, despite meticulous planning and practice aimed at flawless pit stop, an unforeseen mechanical failure can still occur – turning 1.8-second pit stop into an elongated process that took over 10 to 15 seconds.
“Typically, humans don’t make great decisions under extreme pressure. So we make those decisions in the calm moments of practice. — Marc Priestley, F1 commentator, high-performance expert and former member of the McLaren pit crew. ”
Fraud prevention strategy requires the exact same discipline, where teams must prepare extensively to execute in advance, establishing comprehensive risk management system that not only aim to thwart fraudulent activities but also anticipate for entirely new vectors. Untested scenarios are where vulnerabilities live. The best decisions under pressure are the ones rehearsed in calm. No single technology, data source, or analyst delivers advantage alone.
The transferable lesson isn’t that fraud prevention should look like a pit lane. It’s that the qualities that win in either environment are identical – preparation, real-time response, coordinated specialists, and the discipline to keep finding small advantages. These are the qualities that define a modern risk program.
All the attention is on the agentic commerce frontier
The most forward-looking thread of the program was agentic commerce. As autonomous AI agents begin to transact on behalf of consumers (searching, booking, negotiating, paying), speed, scale, and autonomy all increase. Human intervention in the moment of transaction decreases. The risk surface has to be redrawn.
TrustDecision's view is shaped by working with global merchants, fintechs, and digital platforms, is that the agentic commerce risk surface breaks down into 3 distinct layers the industry will need to work on in parallel.
Entity risk (Identifying the agent): Is this a legitimate AI agent acting for a real user, or something else? Device and behavioral fingerprinting becomes the foundation for trusting an agent at all.
Injection risk (A security challenge): Adversaries will attempt to manipulate the prompts and instructions an agent receives. New defensive techniques are needed to detect and contain prompt-level attacks before they propagate into transactions.
Hallucination risk (A model challenge): Large language Models (LLMs) can by their nature, hallucinate. Guardrail engineering, the architecture around the model that constrains, verifies, and grounds its outputs, remains an open problem across the industry.
Behind those 3 layers sits a larger structural gap, the authentication infrastructure itself. Today’s authentication frameworks were largely designed for human-in-the-loop transactions that pause to ask a human for confirmation. Agentic commerce moves at machine speed and machine scale. The industry will need new authentication models built for instant, autonomous, high-volume decisions. This conversation will undoubtedly occupy the risk sector for the next 2-3 years.
Where this goes next
Technology in fraud prevention is now broadly available. The durable advantage lies in how it’s combined – with proprietary behavioral intelligence, disciplined preparation, and trusted ecosystem partnerships. The customer experience bar is rising in parallel with the threat surface, leaving little room for organizations that treat trust as an isolated control rather than an end-to-end design problem.
The year ahead will be defined by how quickly the industry closes the loop between richer behavioral data, sequential AI models, and ecosystem-level decisioning. And by how seriously it treats agentic commerce as the next ruleset, not a future curiosity. The teams that prepare in the calm moments before the race are the ones that hold the line when it begins.
