Mastercard Bots Allowed: AI Reshapes Risk Framework

Mastercard's chief AI and data officer, Greg Ulrich, announced a pivotal shift in the company's risk management strategy on July 14, 2026. Previously designed to block bots, the network's risk rules are now being adapted to enable bot transactions. This change is facilitated by generative AI, which has dramatically improved fraud detection capabilities, identifying 300-400% more fraudulent transactions at high-risk bands without negatively impacting consumer experience.

Ulrich highlighted that approximately 40% of Mastercard's business now relies on services such as fraud prevention and business intelligence, with AI-driven services growing significantly faster than other segments. A key focus is building trust in AI agents, essential for scaling their capabilities. Mastercard is developing its own transformer model using transaction data to underpin new safety, security, and personalization solutions.

The company has established a five-layer framework to secure agentic commerce, which involves delegating authority beyond single transactions. These layers include identity verification (KYA), verifiable intent, controls, execution through Mastercard Agent Pay, and intelligence for risk assessment and insights. This robust infrastructure is designed to manage the complexities of autonomous transactions.

Looking ahead, Mastercard sees significant opportunity in business-to-business procurement, envisioning agents that manage inventory, replenish stock, and adhere to budgets autonomously. This requires scaled trust infrastructure and clear standards for identity and intent across multiple agents—procurement, supplier, and banking. Mastercard is actively collaborating with AI leaders like Anthropic and OpenAI, viewing these powerful models as new tools to enhance existing security measures rather than altering the fundamental security approach.