As financial services continue to adopt artificial intelligence, AI agents are beginning to take on a more active role in digital payments, moving beyond providing recommendations to initiating transactions on behalf of individuals and businesses.
This shift presents opportunities to improve payment efficiency and convenience, but it also introduces new security challenges. As AI agents gain the ability to move money, financial institutions must ensure that their actions remain within the authority granted by customers and that payment security measures can adapt to increasingly automated transactions.
During Cybersecurity Awareness Month, these developments highlight the importance of strengthening security across the financial services sector. Traditional safeguards such as passwords, one-time codes and biometric authentication remain important, but they may not be sufficient to establish whether an AI-initiated payment reflects a customer’s intentions.
The challenge extends beyond verifying who is accessing an account to determining what an AI agent is authorised to do, how its actions are monitored and whether unusual activity can be distinguished from legitimate automated transactions.
As AI-powered fraud and payment automation continue to evolve, the fintech industry faces a broader question of trust and accountability. Financial institutions, technology developers and payment providers must consider how to establish clear spending limits, prevent unauthorised transactions and determine responsibility when something goes wrong.
Against this backdrop, the Inside the Firewall fintech commentary brings together perspectives from Shulin Tay, Regional Head of Legal for Southeast Asia, India and Japan at Revolut, Gaurav Gupta, SVP Platform and India Site Lead at Payoneer and Aditi Sawhney, SVP, Security Solutions, Asia Pacific at Mastercard to examine how the industry can balance the potential of AI-driven payments with the need for stronger security, customer protection and accountability.
From verifying identity to confirming intent
For years, digital payment security has focused on confirming who is accessing an account. But when an AI agent initiates a transaction on someone’s behalf, verifying identity is only part of the task. The system must also establish whether the agent has permission to make that specific payment.
Gaurav Gupta of Payoneer, said conventional authentication methods do not necessarily establish what a customer has authorised.
“What needs to sit on top is context and evidence: a record of the mandate the user granted, checks against normal behaviour, device and session signals, step-up verification when something is unusual, identity checks for the agent itself, and a complete audit trail,” Gupta said.
Meanwhile, Shulin Tay of Revolut, similarly said authentication must be considered alongside the authority granted to an agent.
“Security should establish not only who is acting, but also what they are permitted to do,” Tay said.
For Aditi Sawhney of Mastercard, the distinction is especially important as AI agents begin to transact continuously on behalf of people and businesses.
“When an AI agent acts on someone’s behalf, confirming who they are isn’t enough. You also need proof of what they actually intended,” Sawhney said.
That shifts the security question from whether an account has been accessed legitimately to whether the payment itself falls within the customer’s instructions.
Setting boundaries before an agent can pay
Establishing intent also requires clear limits on what an agent can do. The interviewees agreed that autonomy should not mean unrestricted access to payment capabilities.
At Payoneer, Gupta said spending controls should be built into the payment system rather than left to the AI’s instructions.
“The most important design choice is to implement the right controls to make the velocity safe and sustainable. Spending limits should live in the payment system itself, rather than in the AI’s instructions,” he said.
He said agents should operate within pre-approved parameters covering transaction amounts, daily limits, approved counterparties, currencies and payment purposes. Anything outside those boundaries should be referred to a human, with product, risk and compliance teams involved in designing the controls.
Sawhney described this approach as “bounded autonomy”, where people and businesses decide what they are comfortable delegating and agents operate within those limits.
“The goal isn’t maximum autonomy. It’s bounded autonomy, where people and businesses decide what they’re comfortable delegating, and the agent acts within those limits,” she said.
Tay said those boundaries should be defined before an agent receives access to payment capabilities, with controls proportionate to the risk. Routine transactions may be handled automatically, while high-value, unusual or difficult-to-reverse payments may require additional approval.
When a payment goes wrong, who is responsible?
Limits can help prevent unintended transactions, but they also raise a question: who is accountable if an agent exceeds its authority or misunderstands an instruction?
For Tay, responsibility must remain with identifiable people and organisations, supported by evidence of what the customer authorised and what the agent did.
“As AI takes on more responsibility for financial decisions, accountability must remain with identifiable people and organisations. It cannot be delegated to the agent itself,” Tay said.
Gupta said responsibility should follow control. Users establish the instructions and permissions; developers are responsible for building agents that follow them; and platform providers must enforce limits at the point where an AI decision becomes a payment.
“Responsibility should follow control…If an agent makes an unintended payment, accountability should depend on where the safeguards failed,” Gupta said.
He said a user should not automatically be held responsible if an agent disregards explicit limits, just as developers and platform providers should be answerable for failures within the systems they control.
Sawhney said the use of an agent should not make responsibility less clear, and that a valid credential does not necessarily mean a payment reflects the customer’s intent.
“Accountability has to be designed into agentic commerce, not worked out after something goes wrong,” she said.
Fraud defence depends on context
The same distinction between legitimate and unauthorised activity is central to the evolving contest between AI-enabled fraud and AI-powered defences. The interviewees said AI can help attackers scale impersonation and social engineering, but defenders may have access to broader transaction context.
Gupta said payment operators can assess activity beyond an individual transaction, including counterparties, transaction history and patterns across a network.
“An attacker sees one transaction and works to make it look clean. An operator running the rail sees everything around it, i.e., the counterparties, the history, how money has moved through the network over years,” he said.
“AI is giving both attackers and defenders more speed and scale. It’s critical that defenders are using AI where it can drive value…However, what tips the balance won’t be who has more AI. It will be who has better context,” Sawhney said.
That context will matter as legitimate AI agents may produce transaction patterns unlike those of human customers. Tay said financial institutions will need to distinguish authorised automation from malicious activity through high-quality data, identity controls, real-time monitoring and risk-based human intervention.
“The advantage will not come from deploying AI alone, but from combining it with high-quality data, strong identity controls, real-time monitoring and risk-based human intervention when needed,” Tay said.
Building trust across borders
AI agents may interact with different developers, platforms, merchants and payment providers, including across national borders. The interviewees pointed to the need for clearer expectations around agent identity, authorisation, auditability and liability.
Gupta identified gaps in accountability rules, agent identity standards and common cross-border auditability expectations. Tay said consistent approaches to authorisation, fraud handling and liability will be important as AI-initiated payments develop across markets.
The central issue is therefore not whether AI agents should be allowed to make payments, but how their authority can be defined, enforced and reviewed. The perspectives from Revolut, Payoneer and Mastercard converge on the need for AI-enabled payments to remain bounded by customer intent, protected by layered security and accountable when something goes wrong.
As AI agents take on a more active role in moving money, trust will depend not only on whether a payment can be completed, but on whether it was authorised, appropriately controlled and traceable.
