Generative artificial intelligence has lowered the barrier for cybercriminals, making it easier to create convincing phishing messages, synthetic identities, and deepfake videos. These tools complicate standard know-your-customer (KYC) and merchant verification processes, forcing companies to rethink how they distinguish real users from fabricated ones during onboarding.
The payment industry is currently adapting to the PCI DSS 4.0 standard, which emphasizes the security of payment page integrations and the management of third-party risks. Companies must now evaluate the security programs of external partners operating within their checkout environments, as they often lack direct control over these providers' internal practices.
Balancing security with user experience remains a primary challenge for digital wallet providers. While additional authentication steps can mitigate fraud, they introduce friction that may impact conversion rates. Companies like Spreedly are now integrating security architecture directly into product development to test new technologies while maintaining defined risk tolerances.
To manage these evolving threats, Spreedly is working toward ISO 42001 certification for AI management systems. This framework aims to structure risk controls proactively rather than reactively. According to CISO Jennifer Rosario, companies should align their security priorities with their specific industry, geography, and data environment to build a sound defense program.
