Daniel Munson

In the run-up to the Leaders in Finance CRO Risk Event on 29 October in Amsterdam, we spoke with Daniel Munson of Visa, who recently moved from Washington, DC to London to oversee Visa’s risk advisory function across Europe. We discussed how AI is supercharging fraud and cybercrime, how Visa uses the same technology to fight back, the impact of geopolitics on global payments, and why resilience starts with how you organise yourself.

Could you briefly introduce yourself and tell us about your role at Visa?
I have been with Visa for about eight years and recently joined our Europe Risk Advisory team, relocating from Washington, DC, where I was part of our global risk organisation, to London. In my new role, I oversee our risk advisory function across Europe. That means working very closely with our clients to make sure they understand the risks across Europe and across Visa operations, how to surface and address those risks within their organisations, and how to bring in fit-for-purpose solutions, processes and tools to mitigate them. Before this role, I led our global payment threat intelligence team, investigating fraud and cybercrime activity across our global operations: understanding the root causes and the best practices, and identifying the fixes we can implement across the ecosystem to prevent that activity.

How do you see the risk landscape changing, and what are the biggest risks the industry is currently facing?
It is a cliche, but the only constant is change, especially from a risk and cybersecurity perspective. Our goal is to stay on top of the shifts in the landscape, anticipate them and get ahead of risks before they become a real-world problem.
Right now, it is AI. You cannot have a conversation about fraud and cybercrime without artificial intelligence coming up, especially now that we have agentic AI and frontier AI. AI is supercharging criminals’ attacks. They can scale them like we have never seen before, automate almost the entire attack chain and operate at far greater speed. The good news is that the industry is rallying to this call. We are doing a good job of understanding how criminals use the technology and building fit-for-purpose tools and processes that can be implemented across the ecosystem as mitigating controls.

Are you also using AI to counter the threat of AI?
Absolutely. We are really in an arms race with the criminals right now: who can use the technology most effectively, efficiently and quickly. At Visa, we take that seriously. We are implementing AI to scale our operations, taking away manual effort from our human analysts and automating as much as we can, while keeping the human in the loop at the most critical points so that we make the best decisions and keep oversight.
AI has been at the foundation of Visa’s risk models and our fraud prevention and cybersecurity tools for decades. Agentic and generative AI have significantly increased how effectively we can use it. Criminals are certainly using it to supercharge their abilities, but we are using it on the good side to become more effective fraud and cybercrime fighters.

Does Visa already use AI agents?
Yes, it is a big part of our operations across cybersecurity and fraud. A very public example that anyone can look at is the Visa Vulnerability Agentic Harness, or VAH. Many people will be familiar with Project Glasswing: instead of releasing its Mythos model publicly, Anthropic brought together a group of organisations to assess the model and make sure we are prepared should this kind of capability get into criminals’ hands. Visa participated in Project Glasswing. We pointed the model at Visa and used it to assess our infrastructure.
Out of that came our agentic harness. It is open-sourced on GitHub, so anyone can download it and use it for their own purposes. It is a very visible example of how we use the technology. We are also taking those learnings to harden the Visa ecosystem internally with agentic and generative AI, making sure we use it more effectively than the criminals do.

Besides technology, the event also focuses on recent geopolitical developments. How do these affect the global payments landscape, and how do you respond?
Geopolitical developments can always introduce new complexities to the payments landscape, but they also highlight the importance of trusted global networks. Fraudsters and cybercriminals do not operate within borders. Across the attack chain, we see consumers in one country being impacted by merchants in another. Protecting that ecosystem requires collaboration, continuous innovation and ongoing investment.
In fact, Visa has invested over 13 billion US dollars in technology and in strengthening our security posture in the last five years alone. In Europe, we have reduced the fraud ratio by about 24% over three years, and much of that is the result of this investment. Geopolitics is absolutely critical, but Visa’s advantage is our scale and global visibility. Because criminals operate across borders, we need a holistic approach to addressing fraud.

It seems geopolitical and technological developments increasingly overlap. How do you remain resilient in such uncertain times?
That is something we keep top of mind: how do you become resilient and adaptable to a changing environment, when criminals are changing their tactics at breakneck speed? For us, organisational structure is absolutely key. We are very mindful of how quickly we can respond to shifts, and we organise ourselves to remove bottlenecks and stay agile.
We spend a lot of time clearly defining accountability within Visa. That is especially important in an incident response scenario, where you need playbooks and standard operating procedures so there is no question about what needs to get done. Resilience is the result of how you organise your operations, how you anticipate threats, how adaptable you are to them and how you layer your defences across the organisation. Organisational structure, and the right technology and processes in the right places, are our key focal points.

At the CRO Risk Event on 29 October, you will join a panel with Rabobank and [bank – check], moderated by Twan Huys. What do you hope to bring to the event, and what do you hope to take away?
Collaboration is absolutely critical in fraud operations and security at large, especially in payments. Beyond the international nature of cybercrime, there are so many organisations involved in a single transaction, and so many points of visibility and vulnerability. It is critical that we share with our partners across payments: which trends we see, which data visibility helps prevent fraud and which controls can be put in place.
I am really happy to be sitting with panellists who bring unique visibility from their organisations, visibility that no other organisation has. The more we discuss those unique perspectives, the more it facilitates collaboration. That is why everyone joins these events: to get together as an industry, talk about the threats and learn how to collaborate more effectively. I cannot wait to hear from the other participants, and I expect a lot of compelling content.
From a Visa perspective, I hope participants take away that Visa is 100% committed to security and fraud prevention, and to staying ahead of threat actors in areas such as frontier AI, cyber and emerging risks around stablecoins and agentic commerce. We are thinking about these developments deeply from a security perspective, and we are putting in place the controls and frameworks needed to stay ahead.

Daniel Munson leads Visa’s risk advisory function across Europe. He will be speaking at the Leaders in Finance CRO Risk Event on 29 October 2026 in Amsterdam.