Cybersecurity Awareness Month 2026
What merchants need to know about the next wave of fraud
Key points
- AI is making fraud faster and easier to scale, from personalized phishing and credential theft to automated card testing and impersonation.
- Small and medium-sized vbusinesses can be especially exposed when their digital footprint grows faster than their security resources, controls and monitoring.
- Key risks in 2026 include bot attacks, account takeover, chargeback and friendly fraud.
- Layered defenses can help businesses catch risk earlier through fraud monitoring, stronger authentication, employee training and better dispute management.
- Strong security starts with consistent fundamentals including software updates, backups, limited administrator access, payment monitoring and a clear incident response plan.
AI has changed the economics of fraud. Criminals can research targets, create convincing phishing messages, build fake websites and test stolen credentials at speed.
For small and medium-sized businesses that accept payments, Cybersecurity Awareness Month is a great time to take another look at risk.
Payment fraud and cybersecurity increasingly affect the same identities, accounts and systems. Small and medium-sized businesses can be especially exposed because their digital footprint may have grown faster than their security maturity, with fewer dedicated resources, less formal controls and more limited monitoring.
The top risks small and medium-sized businesses should watch in 2026
AI-powered bot attacks
Bots allow criminals to repeat actions at a scale. They can rapidly test stolen cards, use compromised username and password combinations in credential-stuffing attacks or target account creation, checkout flows, promotions and loyalty programs.
Warning signs can include sudden increases in authorization attempts or declines, repeated failed logins, bursts of new accounts, multiple card attempts from the same device or unusually fast activity across logins and checkout.
AI-driven account takeover can follow the same pattern. Once an attacker gets into a customer account, they may use saved payment information, spend loyalty balances, view personal data or change delivery details.
The impact can extend beyond one fraudulent order to refunds, support costs and lost customer trust.
Chargeback and friendly fraud
Chargeback abuse and friendly fraud are growing, especially online, creating revenue pressure and additional work for businesses responding to disputes.
Not every dispute is criminal. Customers may not recognize a billing descriptor, forget a subscription renewal or misunderstand a refund policy. Others, however, may knowingly dispute a legitimate purchase.
Some disputes can be prevented through clear communication. Recognizable billing descriptors, order confirmations, renewal reminders, transparent refund policies and good customer support can resolve issues before they reach the bank.
When a chargeback does occur, businesses should be able to reconstruct the customer journey with records such as order details, proof of delivery, login history and device or IP information.
Agentic commerce
Not all bots are bad. AI shopping assistants can browse products, compare options, add items to a cart and act on a customer’s behalf. That means some AI activity is likely to be legitimate.
As agentic commerce becomes more common, businesses will need to distinguish trusted consumer agents from malicious bots without adding unnecessary friction. Businesses may need ways to recognize approved agents through identifiers, permissions, tokens or explicit customer consent; as well as have the right safeguards in place at every point of the agentic commerce journey.
Third-party and supply chain risk
Technology providers, app integrations and vendors can create additional exposure points. Businesses should know which third parties can access websites, payment environments, customer accounts or sensitive internal systems and make sure those permissions match the service being provided.
Administrative access should also be limited to people who need it, with unnecessary access removed.
Building a modern merchant defense strategy
1. Adopt layered fraud prevention
A modern payment fraud prevention strategy covers more than checkout. Real-time transaction analysis, risk scoring and behavioral analytics can help identify suspicious activity, while controls around login, account changes and customer support create other opportunities to catch risk earlier.
AI can accelerate fraud detection and triage across large volumes of activity, but human judgment still matters when a case requires context, especially when blocking a legitimate customer could create its own cost.
2. Strengthen authentication
Passwords remain vulnerable to theft, phishing and reuse. Multifactor authentication adds another check, and businesses can consider phishing-resistant authentication while monitoring adoption of passkeys and biometric verification.
Authentication should also reflect risk. A routine returning customer may have a fast and smooth experience, while someone resetting credentials, adding a payment method or shipping a high-value order to a new address may warrant another verification step.
3. Improve chargeback management
Chargeback management starts before a dispute reaches the bank. Clear billing information, timely order communications, understandable cancellation policies and responsive customer support can remove surprises early.
Businesses should keep delivery records, transaction history and account information organized. Automation can help collect evidence and support routine response workflows while employees focus on cases that need closer review.
4. Train employees regularly
AI-generated phishing and deepfake impersonation mean employees can no longer rely on obvious signs that a message looks fake.
Training often should focus on whether the requested action is legitimate. Requests involving payments, credentials, sensitive information or changes to account access should trigger a clear verification process. Employees need to know how to flag unusual requests through a trusted channel.
5. Build security into everyday operations
Businesses don’t need a large cybersecurity team to improve their defenses. For SMBs in particular, the priority is getting the fundamentals right and maintaining them consistently.
That means using strong, unique passwords, enabling multifactor authentication, keeping software and systems updated, backing up important information, limiting administrator access and monitoring payment activity for unusual behavior.
Businesses should also have a clear incident response plan so employees know what to do if something goes wrong. Security should be part of everyday operations.
Make security a year-round practice
A once-a-year review won’t keep pace with fraud that is becoming more automated, convincing and harder to separate from legitimate activity. Businesses should regularly review access, authentication coverage, unusual login and payment activity and how employees respond to unexpected requests.
Heading into 2027, the challenge will be confirming identity, permission and trust without making legitimate customer interactions harder than they need to be.
Related insights
