Agentic payments expose blind spots in fraud controls

As AI agents start making purchases on behalf of customers, the weak spot is no longer just the payment itself. Vivox AI says financial crime controls built around human behavior can miss fraud that begins earlier, at the point where an agent is instructed, misled, or manipulated.

1. Vivox AI’s analysis comes from a panel at QUBE Events’ sixth Financial Innovation Forum: Payments & RegTech. The session was moderated by Zainab Shode, deputy director of financial crime at Bank of London, with Manish Kumar, former head of payment acceptance products at Starling Bank; Priyanshi Mathur, Mastercard vice president of product management; Kamran Hedjri, PXP group CEO; and Ainsley Ward, CGI vice president of payments solutions.
2. The basic problem is that a transaction can look clean and still be wrong. Vivox AI gave the example of an AI agent booking a hotel through a convincing fake website and paying a fraudulent merchant with the customer’s full authority. In a more extreme case, the agent could cancel another guest’s booking to secure the room. In both cases, the final payment only shows the last step, not the manipulated decision that led there.
3. The panel’s answer was to treat consent as a set of specific permissions, not a single blanket approval. Payment providers need to know how much an agent may spend, which merchants or categories it may use, when its authority expires, and how a customer can amend or withdraw it. Those rules will differ across cards, digital wallets and account-to-account transfers, because authorisation, disputes and liability do not work the same way in each rail.
4. Identity gets more complicated too. Firms have to establish not only who the customer is, but which agent is acting and whether it is the one the customer actually authorised. Vivox AI said records linking customer identity, agent identity and the scope of authority would help investigators reconstruct what was requested, what the agent encountered and what it did. Revoking access in an app only matters if that change carries through the entire payment journey.
5. The fraud risk is moving upstream. Panellists pointed to fake merchant sites, fabricated catalogues and malicious instructions hidden in the content agents read, plus interference at the point where permissions are first set. Once an attacker finds a weakness, automated agents can exploit it repeatedly and at speed. Liability remains unresolved: participants disagreed on how responsibility should be split between customers, agent providers, payment firms and safeguard providers, and on how existing reimbursement rules would apply.

For PSPs, acquirers and banks serving higher-risk verticals, the operational takeaway is straightforward: test whether current fraud, AML (anti-money laundering) and sanctions controls can distinguish legitimate automated activity from misuse before agentic payment flows become normal rather than experimental.