This is the UMCA guide to agentic fraud prevention. If AI agents are starting to transact on behalf of your customers, this page is the end-to-end picture: what agentic payments are, where the fraud actually sits, what trusted-agent protocols do and do not cover, which typologies are new, and how to build detection that works across card and account-to-account rails.
1. What agentic payments are
An agentic payment is a transaction initiated by an AI agent operating under a user's authority. The user grants the agent a scoped mandate with limits on amount, category, frequency, and recipient. The agent transacts within that mandate on the user's behalf, without the user in the loop at the moment of payment.
In 2026 agentic payments are already in production in travel booking, consumer shopping, procurement, and personal finance. The networks have deployed infrastructure. The banks that process the transactions mostly have not.
For a deeper overview see Agentic Payments 2026: What Banks Need to Know.
2. What trusted-agent protocols actually do
Trusted-agent protocols confirm the agent is valid, that it has a signed mandate from the user, and that the current request is cryptographically bound to that mandate. They register agents, carry policy, and provide the authentication plumbing.
This is important and useful. It does not detect fraud happening inside the mandate. The protocol does not know whether the counterparty is a mule, whether the agent was prompt-injected, whether the mandate was obtained by deception, or whether the agent session has been compromised.
The full breakdown lives in The Trust Gap: Why Agent Protocols Do Not Stop Fraud.
3. The new fraud typologies
Prompt injection payouts, mandate obtained by deception, social engineering through the agent, compromised agent session, mule payouts inside the limit, mandate drift, and fake agent impersonation are the primary new typologies. Each has distinct signals that distinguish it from legitimate agent activity.
A field guide for fraud analysts: Fraud Typologies in the Agentic Era.
4. The A2A problem
Trusted-agent protocols live on card rails. Account-to-account rails like Interac, SEPA Instant, FedNow, and open banking under PSD3 have no equivalent. For banks operating on these rails, the entire detection burden sits in-house.
This matters most for Canadian institutions on Interac, European institutions on open banking, and US institutions on FedNow. Deep dive: Agent Risk on A2A Rails.
5. How to build detection
Agent-aware fraud detection requires five things. First, instrument the transaction stream to capture agent indicators and mandate metadata. Second, add agent-level features to the model: agent ID, mandate hash, declared intent, session ID, agent reputation, intent-vs-cart divergence. Third, maintain cross-institution agent intelligence where available. Fourth, expose a consent and policy layer to the customer so the bank remains the owner of what agents are allowed. Fifth, provide per-decision explainability for policy review, dispute, and regulator inspection.
UMCA Agent Risk Intelligence is built against all five requirements.
6. Model governance under E-23 and parallel regulations
An AI-enabled fraud layer sits inside the institution's model risk governance perimeter. OSFI E-23 in Canada, SR 11-7 in the US, and the EU AI Act's high-risk category all pull agentic fraud detection into model governance scope. Explainability, independent validation, and continuous monitoring are not optional.
Related: AI Fraud Analysts Under OSFI E-23 and OSFI E-23 Vendor Cascade.
7. Where to start
Instrument your transaction stream to capture agent indicators and mandate state. This is the foundation. Everything else runs on top of it.
Pilot agent-aware fraud detection on the rail where you see agent activity first. Measure in-mandate fraud catch rate, false positive rate, and decision latency against your current baseline.
Expose a customer-facing consent layer for agent authorisation. Keep ownership of consent in the bank.
Book a demo of Agent Risk Intelligence or talk to UMCA about the design for your rail and jurisdiction.
