PETALING JAYA: Visa, a global leader in payments, recently launched its Malaysia 2026-2028 Security Roadmap, outlining six fundamental priorities to strengthen the country’s payments ecosystem as artificial intelligence (AI), automation and increasingly organised scam networks reshape the threat landscape.
Introduced in 2019 and refreshed in 2023, the latest edition of the roadmap builds on the framework of its previous iterations, as it responds to a payment environment where fraud is evolving beyond the unauthorised use of stolen credentials towards authorised payment scams that exploit trust, urgency, and human behaviour. It provides market-specific guidelines for Visa and its partners across the ecosystem to strengthen security while preserving the seamless payment experiences expected by consumers and businesses.
This is especially crucial at a time when information, communications technology and e-commerce have contributed 23.4%, or RM451.3 billion, to the national economy in 2024 (source: Malaysian Department of Statistics, Malaysia Digital Economy 2025).
At the same time, Malaysians lost RM2.97 billion to financial scams in 2025, the highest annual amount recorded in three years, underscoring the need to advance security alongside the country’s digital growth (source: Ministry of Home Affairs, January 2026).
Visa Malaysia clients head Jason Phua said: “As Malaysia’s digital economy continues to expand, maintaining confidence in digital payments is fundamental to ensuring that consumers and businesses can participate fully in that growth. Yet trust cannot be sustained by any one organisation acting alone. It requires financial institutions, regulators, merchants, technology providers and consumers to work together, combining shared accountability with the right security capabilities.
“With this roadmap, Visa is setting out a common direction for the industry to collectively work towards in strengthening the resilience of Malaysia’s payments ecosystem, while continuing to enable secure and seamless digital commerce.”
The Visa Malaysia 2026-2028 Security Roadmap identifies six interconnected priorities to secure the payments ecosystem in the age of AI. They are:
• Strengthening cybersecurity to anticipate emerging threats and enhance ecosystem resilience, including improving cyber readiness and oversight of third-party vulnerabilities.
• Advancing authentication for a seamless and secure digital experience by moving beyond reliance on SMS one-time passwords towards biometric and in-app authentication, including payment passkeys.
• Enabling safer transactions with tokenised payments by replacing sensitive payment credentials such as personal account numbers with tokens to reduce the value of stolen card data.
• Transforming e-commerce checkouts to enhance consumer confidence and convenience through secure and streamlined experiences such as Click to Pay.
• Leveraging foundational standards to drive network performance by strengthening fraud reporting, merchant onboarding, third-party accountability and compliance.
• Building a resilient payments ecosystem to combat fraud and scams in the AI era through network-level intelligence, real-time risk detection and cross-sector collaboration.
“As AI and automation make fraud attacks increasingly targeted and scalable, security strategies must be more dynamic, intelligence-led and responsive. Visa’s roadmap focuses on strengthening protection throughout the payment journey, from cybersecurity and modern authentication to tokenisation, secure checkout and stronger ecosystem standards.
“Together, these priorities can help make fraud harder to execute while reducing unnecessary friction for legitimate transactions,” Phua said.
The roadmap calls on every participant in the payments ecosystem to play a defined role. Issuers can strengthen real-time decision-making, customer guidance and secure authentication, while acquirers and merchants can improve onboarding, monitoring and checkout security. Third-party service providers also play an important role in reinforcing data protection, compliance and operational resilience.
Regulators and industry bodies remain critical to enabling responsible innovation, intelligence sharing and common standards. Consumers can also reduce their exposure by using secure authentication, enabling transaction alerts, and remaining vigilant against scams.