Rethinking trust in payments for the age of AI

Úna Dillon of PCI SSC explores AI's growing threat to payments, 20 years of security lessons, and building trust for the future.

Last time we spoke, you were just settling into the Regional Director Europe role. What developments stand out to you since then?

The biggest change for me has been moving from understanding the European payment security landscape to really seeing the breadth of it through the PCI Council community. Over the past year, my focus has been on supporting the industry through direct conversation with our Participating Organisations across Europe, understanding where the standards are landing well for stakeholders and where companies are still preparing for change, and implementing the requirements. 

Perhaps the most encouraging development has been the level of collaboration. Merchants, payment service providers, technology companies, assessors, and financial institutions all have different perspectives, but there is a clear recognition that payment security is a shared responsibility. That is exactly where the Council adds value to the industry, bringing those perspectives together and helping turn them into practical security outcomes.

What does the threat landscape look like from where you sit at PCI SSC, given how much of the picture comes to you through the Council's work with merchants, providers, and regulators across Europe?

The threat landscape is becoming more dynamic, more interconnected and increasingly, more automated.

One thing that stands out is that attackers are able to move at speed. AI is contributing to that, whether through more convincing social engineering and phishing, the automation of attacks, or the ability to identify and exploit weaknesses at scale. At the same time, the payment ecosystem itself is becoming more complex, with cloud environments, APIs, mobile acceptance, third-party providers and ever more interconnected services all forming part of the picture.

That means we need to think beyond protecting a particular system or payment application in isolation. Security has to take account of the whole ecosystem and the relationships between organisations, technologies and people.

Ecommerce is a good example. The industry has had to pay attention to the security of payment pages and the integrity of the scripts and components involved in the payment process. PCI DSS v4.0.1 reflects that changing threat environment with requirements designed to address these types of risks.

Then there is the human element, which remains incredibly important. Technology can make attacks more sophisticated, but people are still an important part of both the attack surface and the defence. The answer isn’t simply more technology. It is a combination of strong technical controls, good processes, informed people, and a culture where security is treated as an ongoing business responsibility. We should never remove the human in the loop when using AI and technology in this context.

From our perspective, that is why collaboration is so important. We see different pieces of the puzzle through our engagement with merchants, service providers, assessors, technology companies, and other stakeholders. Bringing those perspectives together helps us understand where the risks are heading and where standards and guidance need to evolve.

Edinburgh's hosting the Europe Community Meeting again this October, a decade after it last did in 2016, and this year AI is the headline theme. What's the gap in understanding you're hoping this event will help close?

I think the biggest gap is between understanding what AI can do and what it means from a security and accountability perspective.

Everyone is talking about AI, but the conversation can become too focused on the technology. The more important questions for payment security are: what happens when AI has access to sensitive environments? What happens when AI agents can make decisions or take actions without a person directly involved at every step? How do we manage access, accountability, and oversight in that environment? How do we know that the controls we have today are still appropriate as the technology evolves?

That is really the thread running through this year's programme. Sessions such as 'AI Agents and Emerging Risks in the Cardholder Data Environment' and 'Human vs. Machine: Rethinking Security, Compliance and Accountability' are designed to make that risk concrete rather than theoretical.

I hope Edinburgh helps move the conversation from ‘AI is coming’ to ‘this is how we use it securely’.

AI can be an important part of defence, helping organisations detect anomalies, identify vulnerabilities and respond more quickly. The question is how we use those capabilities responsibly while maintaining appropriate human oversight.

The timing of this year’s Community Meeting is particularly significant. We are bringing the European payment security community together at the same time as the PCI Council celebrates 20 years, so we can look back at what has worked, but also ask what trust needs to look like in an increasingly automated payments ecosystem.

2026 marks PCI SSC's 20th anniversary. Looking back on the industry over those 20 years, what’s the biggest lesson it has learned about building trust?

The biggest lesson is that trust isn’t created by a single technology, a single standard or a single organisation. It is created through consistency, transparency, and collaboration.

Twenty years ago, the payment ecosystem looked very different. The technology has changed enormously; the ways consumers pay have changed and the threat landscape has changed with it. But one thing has remained constant: consumers need to be able to trust that when they make a payment, their information and their money are being protected.

The industry knows security cannot be bolted on after the fact. It has to be built into the way payment systems are designed, operated, and improved. Standards provide an important foundation for that, but standards alone don’t create security. They need to be supported by people, processes, technology and a willingness across the ecosystem to share knowledge and learn from one another.

The other lesson is that trust has to evolve. What created confidence 20 years ago isn’t enough today. As payments become more digital, interconnected, and autonomous, we need to continually ask whether our security approaches are keeping pace. That is the most important role for us at the PCI SSC over the next 20 years: helping the industry stay ahead of the threat landscape while bringing everyone to the table to shape what good security looks like. If the first 20 years were about building the foundations for payment security, the next 20 need to be about making those foundations resilient enough for a world of AI, automation, and complex payment ecosystems. Ultimately, security and trust remain inseparable.

About Úna Dillon

Úna Dillon is Regional Director Europe for the PCI Security Standards Council. She has 28 years in the payments industry and has held various roles, including payments advisor to Financial Regulators, policy makers, standards bodies, and card schemes, influencing change globally. Advisor on the European Commission Payments Systems Market Expert Group, Úna was on the Board of EMVCo and Chair of the European Payments Council Card Fraud Prevention Expert Group. 

About PCI SSC