A customer tells an AI assistant to book the best flight to London for less than AED 4,000. The agent compares airlines, weighs departure times, rejects inconvenient connections, chooses a fare, selects the customer’s preferred card and completes the purchase. The customer authorised the objective, but almost every decision that produced the payment was made by software. That distinction is about to matter enormously. Payments have traditionally been built around proving that a transaction belongs to a legitimate customer. Agentic commerce introduces something different: a legitimate customer delegating financial authority to a machine. Banks may soon need to determine not only who owns the money, but whether an AI agent had permission to spend it, what it was allowed to buy and whether the transaction remained within the customer’s original intent.
The Customer May No Longer Initiate the Payment
Digital payments already happen with remarkably little effort, but most still begin with an identifiable customer action. Someone taps a card, confirms a purchase, presses a payment button or authorises a wallet transaction.
Agentic payments change that sequence because the customer can authorise an outcome rather than an individual purchase.
An AI agent could be instructed to reorder household essentials whenever supplies are running low, replace a cancelled flight within a particular budget, renew business software if a cheaper alternative cannot be found or purchase additional computing capacity when an application needs it. The person establishes the objective and constraints, but the agent determines when and how individual transactions occur.
This is moving beyond experimentation. Visa says AI agents are already beginning to book travel, reorder inventory, purchase computing resources and access paid data services, while its recent research with Artemis examined live on-chain agentic payment activity. Mastercard has also moved Agent Pay into live transactions and in June introduced Agent Pay for Machines for programmatic payments executed between systems.
The payment industry therefore faces an unfamiliar situation. The account holder remains human, but the entity arriving at the merchant and initiating the transaction may not be.
Identity Is Only Half the Problem
Banks have spent years improving their ability to establish whether somebody really is the customer. Passwords gave way to one-time passwords, biometrics, device intelligence and behavioural authentication.
Agentic commerce requires another layer of trust.
The bank may know exactly who owns the account and still not know whether the AI agent attempting to use it has authority to make a particular purchase.
Visa’s Trusted Agent Protocol is an early attempt to address this problem. It enables approved AI agents to identify themselves to merchants using cryptographic signatures and provides signals intended to distinguish legitimate commerce agents from malicious automated traffic. Visa describes the challenge as establishing whether the agent is recognised and authorised to act for an authenticated consumer.
That moves payment security from identity towards delegated authority.
Finnoex recently examined a closely related problem in The AI Agent Has a Bank Login. Who Is Responsible for What It Does?, where autonomous systems create new questions around identity, permissions and accountability inside financial institutions. Agentic payments bring the same issue directly into the customer’s wallet.
Knowing who the customer is will no longer be enough. Banks may also need to know what the customer allowed the agent to do.
Your Next Payment Credential Could Be a Set of Instructions
This could fundamentally change the meaning of a payment credential.
Instead of simply giving an AI agent access to a card or account, customers could give it a financial mandate.
A traveller might authorise an agent to spend up to AED 8,000 on a return flight to Sydney, travel only on specified dates and require human approval if no direct flight is available. A company could allow a procurement agent to buy supplies from approved vendors up to $20,000 each month. A household agent could manage recurring purchases but be prohibited from taking credit or starting new subscriptions.
The credential would therefore carry more than access. It would carry boundaries.
Visa’s agentic commerce infrastructure already envisages controls such as spending limits, approval workflows and authentication requirements, while Mastercard’s approach to agentic commerce focuses on making agents identifiable and transactions traceable.
Banks could eventually expose these controls directly through digital banking. Customers might see a list of authorised agents alongside their cards and direct debits, with permissions covering spending limits, merchant categories, geography, duration and situations requiring additional approval.
Managing AI agents could become another everyday banking function.
Banks Will Have to Distinguish Good Bots From Bad Bots
Agentic commerce also challenges one of digital commerce’s longest-standing assumptions: automated behaviour is suspicious.
Banks, merchants and payment companies have spent enormous effort detecting bots used for credential stuffing, card testing, promotion abuse, account takeover and other forms of fraud. Now legitimate customers may intentionally send bots into commerce environments to transact for them.
Visa said AI-driven traffic to US retail websites had risen sharply when it launched Trusted Agent Protocol in 2025, highlighting the challenge merchants face in determining whether automated traffic represents a genuine consumer or an attacker.
The behaviour of legitimate agents could also look unusual by today’s fraud standards. An agent can compare hundreds of products in seconds, transact at unusual hours, communicate with multiple merchants simultaneously and make purchases considerably faster than a human.
Fraud detection will therefore need to understand more than behaviour. It will need context around the agent itself, the customer behind it and the mandate governing the transaction.
When the Agent Makes a Bad Decision
Fraud may not even be the most difficult problem.
Consider a legitimate AI agent using an authentic payment credential with genuine customer permission. It purchases something the customer subsequently says they never wanted.
The agent may have chosen a non-refundable hotel despite the customer expecting flexibility. It might purchase ten items after misinterpreting a request for ten options. It could select a merchant the customer would have rejected or use a payment card that generates additional fees.
None of these situations fits neatly into the traditional definition of an unauthorised transaction.
The customer authorised the agent. The agent authorised the payment. The dispute concerns whether the software correctly interpreted what the customer intended.
Mastercard’s emerging concept of Verifiable Intent reflects this challenge by seeking to create auditable evidence of the permissions and preferences underpinning an agent’s actions. Mastercard argues that trust in agentic commerce will depend partly on being able to establish that agent behaviour remained grounded in explicit consumer instructions.
This could eventually change dispute management. Banks, networks and merchants may need records not only showing that a payment was authenticated, but what instruction preceded it and what authority the agent possessed at that moment.
Payment Choice Could Move From Humans to Machines
There is another strategic consequence for banks.
Consumers currently make many payment choices themselves. They select a card because of rewards, choose an account because of available funds or use a wallet because it is convenient.
An AI agent could make those decisions instead.
If several payment methods are available, the agent might automatically select whichever minimises fees, maximises rewards or best satisfies rules established by the customer. In machine-to-machine commerce, it could go further and choose between cards, bank-account payments and programmable digital money according to cost and settlement requirements.
Mastercard’s Agent Pay for Machines is explicitly being developed to support machine-driven transactions across cards, bank accounts and stablecoins.
That raises an uncomfortable possibility for issuers: customers may continue owning several payment products while algorithms increasingly decide which ones actually get used.
It extends the strategic issue explored in Your Bank Is Becoming an API. Customers May Never Know It. If AI agents become a new interface to banking and commerce, financial institutions may increasingly compete not only for human preference but for selection by software.
The Bank Could Become the Guardian of Financial Authority
Banks have a potentially powerful position in this new ecosystem because they already sit between identity, money, risk and authorisation.
Agentic commerce could add a fifth responsibility: determining how much financial authority a customer has delegated to a machine.
That could eventually become an important source of differentiation. A trusted banking environment could allow customers to grant authority, monitor agent activity, change permissions instantly and establish situations where human approval is mandatory.
The safest agentic payment may therefore not be the one with the most advanced AI. It may be the one surrounded by the clearest boundaries.
Payments have always required trust between customer, merchant, bank and network. Agentic commerce does not remove that model. It inserts another participant directly into the middle of it.
And once machines are allowed to spend money, proving who owns the account becomes only the beginning.
What it means for the industry
- Payment security will expand from authentication to delegated authority. Banks will need to understand not only who owns an account, but what an AI agent has permission to do with it.
- Agent permissions could become a new banking control layer. Spending limits, merchant restrictions, expiration periods and approval requirements may eventually sit alongside conventional card controls.
- Fraud models will need to recognise legitimate automated behaviour. AI agents will force institutions to distinguish authorised machine activity from malicious bots.
- Disputes could increasingly centre on intent rather than identity. The industry will need mechanisms for determining whether an agent acted within the customer’s original instructions.
- Payment choice may increasingly be made by algorithms. Banks and payment providers could eventually compete to be selected by AI agents rather than directly by consumers.
- Banks could become the trust layer for agentic commerce. Institutions able to manage identity, payment credentials and delegated machine authority could occupy a strategically important position in the emerging agent economy.
