This is a working list of the fraud typologies banks and acquirers will see as agentic payments scale. It is written for fraud operations and risk analysts who need to recognise these patterns in alerts, not for policy writers. Where helpful, each typology notes the signals that distinguish it from legitimate agent activity.
Prompt injection payouts
A malicious instruction is embedded in content the agent reads: a product description, an email, a scraped webpage, a file the user asks the agent to review. The instruction tells the agent to pay a specified counterparty under a plausible pretext. The agent follows the instruction.
Signals: the transaction occurs within seconds of the agent reading new content, the counterparty is new to the user, the amount sits just under the mandate limit, the declared intent at session start does not reference the counterparty.
Mandate obtained by deception
A bad actor convinces the user to grant a mandate under false pretext. The mandate itself is signed and valid at the protocol level. The use is fraudulent.
Signals: the mandate was granted very recently, the first transaction uses most of the limit, the counterparty is high-risk or newly created, the user's historical pattern does not match the agent's role.
Social engineering through the agent
The attacker manipulates the user into asking the agent to perform an action the user would otherwise refuse. The agent then transacts correctly on the user's instruction, but the user's instruction is the fraud.
Signals: a session is initiated at an unusual time, the first action is a payment to a new counterparty, there is no browsing or research activity before the payment, the amount is round and large.
Compromised agent session
The agent's credentials or session token are stolen. The attacker now holds a valid agent session.
Signals: a sudden shift in session behaviour mid-session, a change in the IP or network fingerprint for the agent host, mandate exhaustion within a very short window, counterparties outside the user's history.
Mule payouts inside the limit
The agent is instructed to pay a counterparty that is a mule. The amount is within the mandate, so the protocol accepts it. The fraud is in the identity of the receiver.
Signals: counterparty appears in cross-institution mule intelligence, counterparty has multiple inbound payments from unrelated users in a short window, counterparty is in a jurisdiction mismatched with the user.
Mandate drift and intent-vs-cart divergence
Within a session the agent moves off the declared intent. Each individual action is inside the mandate, the pattern is not.
Signals: increasing diversity of counterparties within one session, categories outside the declared intent, acceleration of transaction frequency, counterparties outside the agent's declared merchant graph.
Fake agent impersonation
A fraudulent process presents itself as a legitimate agent, piggybacking on another agent's identity or a stolen token.
Signals: mismatch between the agent's registered endpoints and the current request source, inconsistent agent version, missing or malformed mandate signature even when the protocol claims validity.
What UMCA Agent Risk Intelligence detects
Each of the typologies above corresponds to a feature or rule family in Agent Risk Intelligence. Agent reputation, intent-vs-cart divergence, session-level velocity, counterparty history, mandate age, and cross-institution mule intelligence are the primary signals. The platform is tuned for these patterns on both card and account-to-account rails.
