In 2026 the major payment networks shipped the first wave of infrastructure for AI agents to make payments on behalf of users. The protocols are real, the pilots are live, and the first banks are beginning to see transactions arrive carrying an agent indicator. This article is a plain-language overview for banks and payment providers that have not yet put a position together.
What agentic payments actually means
An agentic payment is a transaction initiated by an AI agent acting under a user's authority. The user grants the agent a scoped mandate, usually with limits on amount, category, frequency, and recipient. The agent then transacts within that mandate on the user's behalf.
The practical examples are already in production: travel booking agents, shopping agents, enterprise procurement agents, and personal finance agents. The common pattern is that the human is not in the loop at the moment the payment is made.
What the networks have built
Card networks have deployed agent protocols that answer two questions: is this agent valid, and does it have a signed mandate from the user. The protocols provide cryptographic tokens, agent registration, and policy carriers for amount and category limits. For card rails this closes the authentication side of the problem.
Interoperability frameworks have been proposed around a 'know-your-agent' concept, where networks mutually recognise registered agents and the user's authorisation travels with the transaction.
What the networks have not built
The protocols confirm the agent and the mandate. They do not detect fraud happening inside the mandate. A valid agent, with a signed mandate, can still be instructed by a malicious prompt to pay a mule. A compromised agent session can still look valid at the protocol layer. A mandate obtained by social engineering is still a signed mandate.
This is the fraud gap. Banks and acquirers that rely only on the protocol will see traffic that looks clean to the protocol and fraudulent in the records a day later.
What happens on account-to-account rails
Interac, SEPA Instant, FedNow, and open banking under PSD3 have no equivalent of a trusted-agent protocol. Agents transacting on these rails arrive with far less context than agents on card rails. The protocols are not coming on the same timeline, and in some jurisdictions they may never arrive in the same form.
This is the geography where in-house fraud detection matters most. Canadian institutions on Interac, European institutions on open banking, and anyone handling cross-border A2A will carry the burden of agent-aware fraud detection themselves.
What a bank should do in 2026 and 2027
First, instrument the authorisation stream to capture the agent indicator and any mandate metadata the networks or your acquirer forward. This is low-cost and future-proofs the fraud stack.
Second, add agent-aware features to the fraud model. Agent ID, mandate hash, intent-vs-cart divergence, agent reputation, and session-level velocity are features the model does not currently have.
Third, expose a consent layer to the customer. Which agents are allowed, with what limits, when step-up is required. The bank owns consent, not the network.
UMCA's Agent Risk Intelligence solution is built for exactly this gap. Agent-level features, intent-vs-cart detection, agent reputation, and compatibility with major trusted-agent protocols and A2A rails.
