Scams and social engineering are changing the fraud conversation because many harmful transactions are technically authorized by the customer. Payment companies need to understand the difference between valid credentials, customer consent, manipulation, merchant risk, and transaction safety.

Virtual cards are moving deeper into B2B payments, embedded workflows, procurement, travel, supplier payments, and platform payouts. Smarter virtual card infrastructure is useful, but only if companies have controls around issuance, limits, approvals, reconciliation, vendor changes, exception handling, and payment ownership.

Processor approval does not protect a merchant, ISV, PayFac, or platform from card brand scrutiny, sponsor bank discomfort, scam merchant monitoring, excessive fraud, chargebacks, or prohibited activity exposure. Approval means someone let the account in. It does not mean the business model is safe.

Fraud tools are useful, but they are not a substitute for a real fraud strategy. ISVs, PayFacs, platforms, and payment companies need risk appetite, clean data, alert workflows, feedback loops, escalation paths, and people who know when the dashboard is lying.

AI agents may change how consumers and businesses shop, compare, select, and pay, but the old payments questions still matter. Agentic commerce will need clear authorization, token controls, user permissions, merchant trust, transaction context, fraud monitoring, dispute evidence, and liability clarity before “the AI did it” becomes the industry’s next favorite excuse.

A group spent $3M and years trying to build its own payments gateway — only to scrap it entirely. Here's what went wrong, and why most companies should never attempt this without seasoned payments experts.