Stolen payment information has value to criminals only if it works. That’s where enumeration comes in.
What is enumeration?
Enumeration is the systematic testing of payment credentials, such as an account number, expiration date, or security code, to determine whether the credentials are valid. It’s often the first stage of a broader fraud attack.
Enumeration isn’t new, but its scale, speed, and sophistication are changing. Visa analysis indicates that enumeration contributes to more than $1 billion in fraud losses across the global payments ecosystem annually¹, and automation and artificial intelligence are making these attacks easier to scale.
During the second half of 2025, Visa identified hundreds of millions of enumeration attempts across the network, underscoring both the scale and persistence of the threat.
How do enumeration attacks work?
Attackers frequently use automated tools to submit large volumes of online transactions. Approval and decline responses help them determine which combinations are correct.
These transactions can be difficult to recognize in isolation because they may resemble ordinary authorization traffic. Attackers can also distribute activity across merchants, acquirers, issuers, and geographies, making it difficult for any single participant to see enough of the attack to understand its full scale.
Why is enumeration growing in importance?
Enumeration reflects a broader change in the economics of payment fraud.
Investments in EMV, tokenization, encryption, PCI compliance, and faster incident response have made stolen payment data harder for criminals to use. By late 2025, fraud associated with compromised-data events had fallen from more than 10% of global fraud to less than 4%. Meanwhile, enumeration-related fraud increased from 6% of global fraud in 2022 to 8.7% in 2025.
As AI agents become more widely available, this trend is likely to accelerate. Malicious actors can use agentic tools to automate and continuously refine credential testing, increasing the scale and speed of attacks while reducing the effort required to execute them.
The transaction patterns reveal how enumeration works in practice. Approximately 31% of suspected enumeration attempts involved US$0 authorizations, often used to verify accounts, and more than half were cross-border, potentially making them harder to detect. In addition, 91% used raw account numbers.
Taken together, these patterns suggest that fraudsters are finding inexpensive ways to test credentials and spread their activity to make it harder to detect.
What do criminals do with valid payment information?
Once fraudsters have determined which accounts are active, they can move quickly to make subsequent fraudulent transactions or sell credentials to other criminal actors.
In Q3 2025, approximately 56% of enumeration-related fraud affecting issuers in Central and Eastern Europe, the Middle East, and Africa (CEMEA) occurred within seven days of enumeration, up from approximately 38% a year earlier. In North America, the proportion occurring within the first week increased from 19% to 27%.
This compresses the window for intervention. When fraud occurs within days, detection may come too late to prevent losses.
What are the consequences of enumeration?
For consumers, the consequences can include unauthorized transactions, account disruption, and the burden of resolving fraud. That’s why stopping enumeration early, before validated credentials can be used for fraud, is an important part of protecting consumers and the broader payments ecosystem.
What can acquirers and merchants do to help stop enumeration?
Acquirers and merchants can play an important role in disrupting enumeration because they can see transaction and customer-interaction data that may not be available to issuers or payment networks. That visibility can enable action before suspicious transactions enter the broader payment ecosystem.
Effective defenses should focus on three priorities:
- Identify testing behavior early: Monitor for authorization spikes, high decline rates, repeated low-value or US$0 attempts, rapid credential changes, and signs of automated activity.
- Respond quickly: Escalation and intervention should occur before downstream fraud confirms that credential testing was successful.
- Watch for concentrated activity: Acquirers should identify merchants generating disproportionate enumeration activity and intervene when necessary.
Because criminals can test credentials with one merchant and use them somewhere else, stopping enumeration requires coordinated defenses across the payments ecosystem.
How is Visa responding to potential enumeration attacks?
Visa's approach to combatting enumeration combines advanced analytics, artificial intelligence, and network-level visibility to help identify and disrupt attacks before they lead to downstream fraud.
A key component of that strategy is Visa Account Attack Intelligence (VAAI), a real-time risk scoring capability that helps issuers and acquirers identify suspected enumeration activity.
By detecting complex account-testing attacks as they occur, VAAI helps clients make more informed authorization decisions and strengthen their fraud defenses.
Visa is also extending protection through Visa Network Defense (VND). Using intelligence from capabilities such as VAAI, VND can identify and disrupt high-risk enumeration activity at the network level, helping stop attacks before they spread more broadly.
The value of this network-wide perspective is already evident. Visa has blocked hundreds of millions of enumeration transactions at the network level while continuing to improve downstream fraud outcomes.
Together, earlier detection and stronger controls can help stop enumeration attacks before they lead to further fraud.