Increasing digitalization requires a considered stock-take of cyber and operational resilience

Over the last decade, a steady stream of innovation has made digital payments easier and more convenient for everyone. We pride ourselves on the knowledge that a Visa transaction will always work. Visa performs at as close to perfect reliability as is possible in our industry – or any – something which requires an enormous amount of careful investment and management.

To underscore the scale of this achievement; the Visa network handles up to 65,000 transactions a second, all of which have 27 different routing options, across digital and physical network infrastructure which could stretch around the world over 400 times to ensure payments work seamlessly for merchants and consumers in real time. This contribution to Europe’s payments landscape is something we are rightly proud of.

 This does not however mean that we are complacent about cyber and operational resilience. Our response is constantly evolving, underscored by €8 billion in technology investments over the past five years and over a thousand cybersecurity specialists to deliver on our availability and resilience promise. Visa is also a first mover in leveraging the benefits of AI and data infrastructure, already having invested €2.5 billion towards risk management in the past decade. Responding to the constantly changing and increasingly borderless cyber attackers remains a challenge – for example, cyber terrorists can coordinate ATM runs across multiple jurisdictions, from another part of the world, in real time which require leveraging global data to detect and respond to them. Through a complex interlinking of innovation and expertise, we have been able to reduce fraudulent Visa transactions to less than 0.1% across Visa transactions – a historic low – preventing over €20 billion in fraud annually.

 Visa’s payment network is built around the truism that everything that can break at internet scale will break – and therefore, you cater to that with what we call pessimistic design. This means building the network in a manner that can handle a lot of unexpected turbulence – like natural disasters, technology disruptions, cyber threats – but also a sudden surge in demand for digital payments, as we have witnessed over the past few years. What we learnt from the complex threat landscape is that our network continues to be highly resilient.

In Europe, political appetite is growing for regional alternatives to global payment networks like Visa to reduce overreliance on certain or global networks. Whilst an important concern, developments must ensure there remains many options available to Europe’s consumers and merchants to prevent a single point of failure and to ensure the best resilience practices are available to Europeans. We consider a well-functioning European payment landscape to be a shared goal with policymakers and want to contribute through our expertise and network to make this a success.

As the tech gets better, we also observe criminals focusing on the weakest link in the payments chain - people. Scams are increasingly sophisticated, and anyone can be caught out. To mitigate this on our network Visa is working with clients to educate consumers – and make sure they can get their money back.

Other networks face different challenges. Instant credit transfer transactions volume is growing in Europe but faces a heightened vulnerability to fraud due to faster settlement times. For example, instant payments can be a lot like sending cash in the sense that once you send it, it’s gone. If you are duped into sending money to someone misrepresenting their identity, that money may be gone forever. Similar challenges exist in crypto and digital currencies, where there is no “claw back” mechanism if you make a transfer to some anonymous scammer’s wallet. When using any of these new technologies, it’s important to know who exactly you’re dealing with on the other end of the transaction.

European regulation is setting new parameters to level up risk and fraud management across the financial services sector as well as providing regulators with more insight on current risk management practices employed by firms today. Nevertheless, the levels of sophistication and the level of the best performing sectors, like payments, is the product of many years of innovation and expertise. It is important regulatory frameworks remain proportionate, principle based and reduce duplication where possible to give firms the necessary flexibility and focus on achieving the best resilience possible. We are however optimistic about the current regulatory approach and Visa stands ready and confident to meet our clients’ expectations in meeting the new requirements.