Broadcom has launched Arcot Scam Defense, a new feature of its Arcot payment authentication service that aims to block social engineering scams in online card purchases even after the cardholder has passed the security check. The company announced it on October 21, 2026, in Palo Alto, California, and says a pilot test with one card issuer would have prevented about $4 million in fraud in a single month.
Broadcom’s Arcot Scam Defense in 30 seconds
- Arcot Scam Defense acts as a second layer after 3-D Secure authentication in online card purchases.
- It analyzes the device, history, location, and how the verification challenge was resolved.
- Broadcom puts fraud in passed challenges at almost $500 million over the past 12 months.
- In a pilot, reviewing 1% of challenges would have protected about $4 million in a month.
The problem Broadcom wants to tackle is a familiar one for banks and card issuers. When a customer buys something online and confirms the transaction with a one-time code or a fingerprint inside the 3-D Secure system, the payment is treated as legitimate. Scammers no longer need to break that system: it’s enough to trick the cardholder, posing as their bank or a trusted brand, into entering the code or approving the transaction themselves.
A Second Layer After Authentication
Matt Cooke, vice president and general manager of Broadcom’s payment security division, said financial institutions are seeing a broad rise in fraud attempts driven by AI-powered social engineering attacks. According to Cooke, security systems are working well, but criminals have shifted to attacking customers directly, who often don’t realize they’ve handed over their credentials until the scam has already gone through.
Arcot Scam Defense works in real time as a second line of defense and can flag a transaction as suspicious even if the cardholder has passed the verification challenge. To do that, it combines signals from the transaction, the device, historical behavior, and the way the challenge itself was resolved. Broadcom gives examples of those signals:
- Differences in location or behavior between the device used to make the purchase and the one used to authenticate.
- An unusual delay in entering the one-time code.
- Use of an alternative authentication method.
- A large physical distance between the two devices.
These signals are evaluated together, not in isolation, to make a real-time decision. The solution can also integrate with third-party tools that detect whether the authenticating device is on an active phone call, a typical sign that someone is coaching the victim through the scam.
The Pilot’s Numbers
Broadcom says almost $500 million in fraud was recorded over the past 12 months in transactions whose authentication challenge had been passed successfully, though it doesn’t detail the exact scope of that figure. In a pilot test using real data from a full month, reviewing just 1% of a large issuer’s passed challenges would have protected about $4 million in fraud, at the cost of a 0.38 percentage point drop in its successful authentication rate. These figures come from the company itself, which doesn’t name the issuer.
The company plans to expand the tool with new signals about the cardholder and the device, plus an engine that learns each customer’s challenge history to detect behavioral changes. Arcot is Broadcom’s line dedicated exclusively to 3-D Secure payment authentication, and it came to the company through its acquisition of CA Technologies. The announcement doesn’t include pricing or country availability dates.
Frequently Asked Questions
What is Arcot Scam Defense?
It’s a feature of Arcot by Broadcom that analyzes online card purchases in real time to block social engineering scams even after 3-D Secure authentication has been passed.
What signals does it analyze?
Transaction and device data, the customer’s history, and how the challenge was resolved, such as delays in entering the code or the distance between devices.
What results did the pilot show?
According to Broadcom, reviewing 1% of a large issuer’s passed challenges would have protected about $4 million in fraud in a month.
What is 3-D Secure?
It’s the online card payment authentication system that asks the cardholder to confirm the purchase with a code or a biometric factor.
Sources:
