When AI Agents Move Money: Investigating Authority, Intent and Fraud in Agentic Payments

By

Agentic payments could change a basic assumption in fraud investigation: that the person who owns the payment account is also the immediate decision-maker behind the transaction. As AI agents begin to search, select and potentially execute transactions within delegated parameters, investigators may need to reconstruct not only who authenticated a payment, but what authority was given to the agent, how that authority was exercised and whether the resulting action remained within its mandate.

Key Points

  • Agentic payments can separate human intent, delegated authority, machine decision-making, authentication and transaction execution into distinct stages. Evidence from one stage should not automatically be treated as conclusive evidence about another.
  • Successful authentication may establish that a recognised credential, agent or process was used without necessarily establishing that the particular transaction remained within the authority originally delegated by the customer.
  • An AI agent acting outside an expected mandate does not automatically establish fraud. Ambiguous instructions, configuration error, technical failure, excessive permissions, compromised credentials and deliberate manipulation are competing explanations that may require investigation.
  • Fraud Intelligence Lab proposes the Agentic Payment Authority Chain and Agentic Payment Investigation Triangle as analytical frameworks for reconstructing the relationship between human intent, delegated mandate, agent action and financial effect.
  • Fraud controls may eventually need to understand a relationship more complex than customer-to-transaction: customer-to-agent-to-mandate-to-transaction. If that relationship is not represented and preserved in accessible data, both detection and subsequent investigation may be constrained.
AI agent executing a payment while an investigator traces human intent, delegated authority, authentication, transaction execution and financial effect.

When AI Agents Move Money: From Delegated Authority to Investigative Reconstruction

Source: Fraud Intelligence Lab (F.I.L.) original analytical illustration. It is not a statutory test, regulatory model, technical payment standard or law-enforcement investigation standard.

Introduction

Payment investigation has traditionally been organised around identifiable human actions. A customer accesses an account, selects or creates a beneficiary, enters an amount and authorises a payment. Even when fraud is suspected, investigators can normally begin with a recognisable relationship between the account holder, authentication events and the resulting transaction. Agentic AI complicates that relationship because software may increasingly interpret an objective, make intermediate decisions, interact with external services and initiate financial actions within authority delegated in advance. The investigative question therefore expands from who executed the transaction to what chain of authority produced it.

This development is moving beyond theory. HM Treasury's July 2026 consultation on modernising payment services regulation specifically identifies agentic payments as an innovation that the UK's regulatory framework may need to accommodate. The government's accompanying Financial Services AI Adoption Plan identifies uncertainty around liability, consent and fraud in automated payment flows and recommends work towards a trust framework incorporating legal and liability arrangements, agent verification and authentication. These developments do not establish that agentic payments are already widespread, but they show that questions surrounding delegated machine action have entered formal UK financial-services policy. For investigators and control owners, the significance lies in preparing for a payment environment in which the immediate actor may no longer be the human account holder.

The investigative problem is therefore more precise than whether an AI system participated in a payment. If a customer instructs an agent to achieve an objective within specified constraints, the resulting transaction may reflect a sequence of machine-mediated decisions rather than one contemporaneous human payment instruction. A transaction record can establish what was paid and when, but it may not establish what the customer originally intended. It may also fail to establish what discretion the agent possessed, how the instruction was interpreted or whether manipulation occurred before the payment instruction reached the financial institution. The central proposition of this article is that agentic payments can separate intention, delegation, decision and execution, requiring fraud investigators to reconstruct the authority chain rather than infer human intent from the completed transaction alone.

What Makes an Agentic Payment Different?

Automation itself is not new to payments. Standing orders, recurring card payments, automated sweeps and machine-driven processes have existed for years. The important difference is the potential for an AI agent to receive a higher-level objective, determine intermediate steps, interact with external systems and exercise discretion within a delegated mandate rather than simply execute a predetermined instruction. The International Monetary Fund's April 2026 analysis of agentic payments describes systems capable of interpreting objectives, planning multistep actions and interacting with digital services with limited human intervention. Its analytical framework separates the process into intent, authorisation and settlement and identifies a fundamental tension between probabilistic AI behaviour and the deterministic requirements of payment infrastructure.

That qualification matters because “agentic” should not be used as if every AI-assisted purchase involves complete machine autonomy. An agent that compares products before requiring explicit customer approval creates a different evidential problem from one authorised to purchase independently within predetermined limits. A system recommending a transaction is different again from one capable of initiating it. Investigators should therefore establish the actual degree of delegated autonomy rather than infer it from the technological label. The evidential question depends on what the particular system was authorised and technically capable of doing at the relevant time.

The investigative significance lies in the space between the customer's objective and the final payment instruction. The more discretion an agent possesses, the more important it may become to establish what the customer authorised the agent to decide. A customer might authorise an agent to identify a suitable product without authorising it to make the purchase. Another mandate might permit transactions below a defined value while requiring human approval above that threshold. The question is therefore no longer merely whether a payment was technically executed through an authorised channel, but whether the agent possessed authority for the particular decision that produced it.

The Investigative Problem: Who Authorised What?

Authorisation can conceal several different propositions in an agentic environment. A customer may have authorised the use of an AI agent without granting unlimited purchasing authority. The agent may have been authorised for particular merchants, transaction values, product categories or time periods. Some decisions may require renewed human approval while others can be executed autonomously. Treating these different forms of authority as a single event risks attributing evidential weight to an authentication record that it may not possess.

Investigators may therefore need to separate several questions within the same enquiry. Was the agent genuinely authorised to act for the customer, and what was the scope of that authority? Did the disputed transaction fall within that scope, including any relevant amount, merchant, product or timing restrictions? Did anything compromise, manipulate or materially alter the process between delegation and execution? Those questions should be tested individually before they are combined into a final disposition.

This issue has entered US central-bank discussion. In his September 2026 speech on payments in the age of AI agents, Federal Reserve Governor Christopher Waller discussed authentication, fraud and other trust questions surrounding agentic commerce. His analysis points towards a developing authentication problem in which payment infrastructure may need to establish not only that the payer is legitimate, but that an agent has authority to act on the payer's behalf. For fraud investigators, the question becomes narrower still because proof that an agent is legitimate does not necessarily establish that every action it performs falls within its mandate. The mandate itself therefore becomes an evidential object that may need to be reconstructed.

The F.I.L. Agentic Payment Authority Chain

F.I.L. Agentic Payment Authority Chain showing the investigative sequence from human intent and delegated mandate through AI agent decision, authentication, transaction execution, financial effect and investigative reconstruction.

Model 1 — The F.I.L. Agentic Payment Authority Chain

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model, technical payment standard or law-enforcement investigation standard.

The Agentic Payment Authority Chain treats an agent-initiated transaction as the product of a sequence rather than a single event. Human intent begins that sequence, but intent must be translated into some form of instruction, permission or mandate. The agent interprets the objective, exercises whatever discretion its architecture permits and interacts with relevant systems. Those actions may eventually produce an instruction capable of entering an authentication and payment process. The eventual financial effect sits at the end of the operational chain but may become the starting point for investigative reconstruction.

Each transition creates a potential evidential break point. Intent is not necessarily identical to mandate because a customer may communicate an objective imprecisely or a system may translate it into broader permissions. Mandate is not necessarily identical to agent decision because discretion exists precisely to permit the system to select among alternatives. Agent decision is not necessarily equivalent to valid authority because the decision may exceed a constraint. Authentication can establish facts about an authentication process without necessarily proving the customer's contemporaneous intention regarding every aspect of the resulting transaction.

Transaction execution therefore answers only part of the investigative question. The investigator may need to work backwards from financial effect towards the authority that produced it. What was executed, what decision produced that action and what permissions existed when the decision was made? What information did the agent receive or infer, and did the customer retain an approval point before execution? The model's purpose is to identify these evidential transitions rather than prescribe how an agentic payment system should technically operate.

A Mandate Deviation Is Not Automatically Fraud

One of the greatest risks when investigating emerging technology is allowing novelty to substitute for evidence. If an AI agent produces an unexpected transaction, describing the event as “agentic fraud” before establishing why it occurred would reverse the investigative process. The unexpected action is a fact or signal, while fraud remains a hypothesis requiring evidence. This distinction becomes especially important where software behaviour can result from configuration, interpretation, technical failure or external interference. Investigators should therefore classify the anomaly before attempting to classify the cause.

Consider a customer who instructs an agent to find a suitable flight to Paris for no more than £500, but a £720 ticket is ultimately purchased. The discrepancy is significant, but several explanations remain possible. The spending limit may not have been encoded as an enforceable constraint, another instruction may have superseded it or the customer may have approved an exception. A technical or software error may also have occurred, while a malicious actor could alternatively have interfered with credentials, permissions or a connected service. The £720 payment therefore creates an investigative question rather than proving which explanation is correct.

The precise attack surface will depend on the architecture. Credentials, agent permissions, connected accounts, external tools and information supplied to an agent could potentially become relevant to a compromise or manipulation hypothesis. Emerging theoretical vulnerabilities, however, should not be presented as established fraud typologies without evidence that they are occurring operationally. This distinction follows the evidential principle developed in FIL's Fraud Indicators Are Not Evidence. An anomaly can justify enquiry without proving its explanation.

Authentication Is Not the Same as Agent Authority

Agentic payments add another dimension to an attribution problem already familiar to investigators. Account takeover can involve apparently valid credentials or authentication events even though the legitimate customer has lost effective control. APP fraud can involve a customer personally authenticating a payment while deception shapes the decision that produced it. Agentic payments introduce the possibility that a recognised agent performs an authenticated action while the dispute concerns whether that particular action remained within its delegated authority. Successful authentication should therefore be interpreted according to the proposition that the authentication evidence actually establishes.

It is useful to distinguish agent identity, authentication, delegation, intent and execution. Agent identity concerns which software actor participated, while authentication concerns whether specified authentication requirements were satisfied. Delegation concerns what the customer permitted the agent to do, and intent concerns the objective the customer sought to achieve. Execution concerns the transaction ultimately processed. These concepts may corroborate one another, but they are not interchangeable.

A valid agent identity cannot by itself prove transaction-level authority. A broad delegation cannot automatically prove that a particular action fell within its limits. Conversely, an unexpected transaction does not establish compromise simply because its outcome differs from what the customer later says was intended. This distinction is particularly important because authentication evidence may be technically strong while answering a narrower question than the investigation ultimately needs to resolve. Agentic payment investigation therefore requires investigators to identify exactly what each authentication event proves before relying on it as evidence of authority.

Europe: From Agentic-Payment Concept to Live Transactions

European payment experiments show that these questions are moving into operational payment infrastructure. In March 2026, Santander and Mastercard announced what they described as Europe's first live end-to-end payment executed by an AI agent within a regulated banking framework. The transaction used live Santander payment infrastructure but took place in a controlled environment. Mastercard reported that the agent operated within predefined limits and permissions. The example therefore establishes a reported live technical experiment rather than widespread consumer adoption.

That evidential distinction is important. A successful controlled transaction demonstrates that an agent can interact with real payment infrastructure under defined conditions. It does not establish how frequently consumers will delegate purchasing authority, how commercial architectures will ultimately allocate approval points or how often fraud will arise. Nor does a provider announcement independently establish the effectiveness of the controls being demonstrated. For practitioners, the appropriate conclusion is that technical deployment is advancing while the risk and evidential environment remains immature.

In June 2026, Worldline, ING and Mastercard announced another live European agentic payment. Their reported transaction involved an ING cardholder and a merchant in the Netherlands using existing authentication and authorisation infrastructure. The example is useful because it illustrates how agentic capabilities can be integrated with established payment controls rather than necessarily replacing them. It also reinforces that “agentic payment” may describe different distributions of decision-making and human approval across different systems. Investigators should therefore establish the architecture of the specific transaction rather than assume that all agentic payments produce the same evidential trail.

United Kingdom: Building the Trust Framework Before the Disputes

The UK provides a different type of real-world example because policy and regulatory architecture are being developed while the technology remains emergent. HM Treasury's July 2026 consultation considers how the regulatory framework should accommodate payment innovations including agentic payments while maintaining appropriate consumer protection. The accompanying Financial Services AI Adoption Plan identifies uncertainty around legal and regulatory accountability, including liability and consent, alongside concerns about fraud in automated payment flows. It recommends work towards a trust framework incorporating legal and liability arrangements, “Know Your Agent” protocols and interoperable authentication and governance standards. These proposals illustrate the direction of policy development rather than an already-established investigative standard.

The terminology points towards an additional identity and authority relationship. Financial institutions have long developed controls around customers, accounts, devices, beneficiaries and transactions. An agentic environment may require systems to represent the identity and authority of a software agent as well. Knowing that an agent exists, however, is only part of the investigative requirement. Understanding what that agent was authorised to do may be equally important when a payment becomes disputed.

The FCA's July 2026 Mills Review provides further evidence about potential consumer adoption. FCA-commissioned research reported that around one fifth of UK adults, equivalent to approximately 11 million people, were likely to use AI capable of acting autonomously within pre-set goals. That figure concerns stated likelihood rather than observed use of agentic payment systems. It should therefore not be interpreted as evidence that 11 million UK consumers are already delegating financial transactions to autonomous agents. The distinction between expected adoption and observed behaviour is especially important when assessing an emerging risk.

The UK evidence consequently establishes something narrower but professionally significant. Policymakers and regulators are preparing for an environment in which delegated machine action could become more important. Questions involving consent, accountability, authentication and fraud remain under development rather than settled. Investigators should therefore resist importing assumptions from conventional payment disputes into an architecture whose authority relationships may be materially different. The opportunity is to define evidential requirements before high-volume disputes expose gaps in the available data.

United States: When Authentication Must Include the Agent

The United States brings the authority problem into sharper focus. Governor Waller's September 2026 Federal Reserve speech describes payment infrastructure developing to support agents capable of executing multistep processes and transacting with greater autonomy. He also identifies fraud, cybersecurity, authentication and trust as important considerations as this capability develops. For investigators, the significant shift is from authenticating only the human or conventional payment credential towards establishing a trusted relationship among principal, agent and transaction. Another actor can therefore sit between customer intention and payment execution without eliminating the customer's underlying role.

This makes transaction-level authority particularly important. Proof that the customer enrolled or activated an agent may establish general delegation, but it does not necessarily resolve whether the agent had authority to transact with a particular merchant or above a particular amount. Nor does it necessarily establish whether further customer confirmation was required. Those questions depend on the mandate and the technical architecture through which it was expressed and enforced. Investigation therefore requires more than demonstrating that the agent itself was genuine.

The UK, European and US developments converge on a common investigative issue even though their legal and market contexts differ. Agentic payments create a need to make delegated authority observable, verifiable and reconstructable. Without that evidence, disputes risk becoming arguments about what a customer or agent was supposed to do rather than investigations capable of establishing what authority actually existed. Technical innovation therefore creates an evidential requirement alongside the payment capability itself. The quality of that evidence may ultimately determine how effectively institutions can distinguish genuine compromise from error, misunderstanding and legitimate autonomous activity.

The F.I.L. Agentic Payment Investigation Triangle

F.I.L. Agentic Payment Investigation Triangle showing the relationship between the customer or principal, AI agent and transaction or counterparty, with delegated authority at the centre of the investigative analysis.

Model 2 — The F.I.L. Agentic Payment Investigation Triangle

Source: Fraud Intelligence Lab (F.I.L.) original analytical framework. It is not a statutory test, regulatory model, technical payment standard or law-enforcement investigation standard.

The triangle asks investigators to test three relationships rather than looking only at the payment. The customer-to-agent relationship establishes what was delegated and under which constraints. The agent-to-transaction relationship establishes what the agent actually did and which systems, merchants or counterparties it interacted with. The customer-to-transaction relationship asks whether the resulting financial effect remained consistent with the authorised objective. Delegated authority sits at the centre because it connects and gives meaning to all three relationships.

A transaction may be technically valid while the authority relationship remains disputed. Equally, a customer's assertion that an outcome was unintended should be tested against the mandate and other contemporaneous evidence rather than accepted automatically. The framework therefore supports both corroboration and refutation rather than presuming that the customer, agent or transaction record provides the definitive account. Where all three relationships are supported by consistent independent evidence, the authority chain becomes stronger. Where they diverge, the divergence identifies the part of the transaction requiring deeper investigation.

The model also exposes a potentially important evidential problem: relevant information may be distributed across different organisations. A bank may possess detailed payment and authentication records but limited visibility of the original agent instruction. An agent provider may possess instruction, permission or decision logs without complete settlement data, while a merchant may identify an agent interaction without knowing the full scope of the customer's mandate. Agentic payment investigation may therefore become partly an evidence-architecture problem. The organisation capable of detecting the suspicious transaction may not hold all the information necessary to explain it.

Investigating a Disputed Agentic Payment

A defensible investigation should begin with temporal reconstruction. Investigators should establish when the customer objective was created, when authority was delegated, what permissions existed and whether those permissions subsequently changed. The chronology should then identify material agent decisions, relevant external interactions, authentication events, payment execution and post-transaction activity. Sequencing matters because evidence discovered after the event should not automatically be treated as evidence available to a control before the payment occurred. A chronology can therefore distinguish retrospective explanation from information that could reasonably have informed an earlier intervention.

The next task is mandate reconstruction. Natural-language instructions and technically enforceable permissions should be distinguished where the architecture permits that distinction. A customer saying “find me the best option under £500” is not necessarily the same as a system recording a hard £500 transaction limit. If an agent translates natural-language intent into operational permissions, the translation itself may become relevant evidence. Investigators should therefore establish both what the customer communicated and what constraints the system actually applied.

Investigators should then reconstruct agent action. Depending on lawful availability and system design, relevant material could include agent identifiers, permission histories, transaction logs, authentication events, API or tool interactions, merchant communications, device or session information, timestamps and changes to connected credentials. The evidential weight of each item should depend on provenance, reliability, independence and its relationship to the hypothesis being tested. Several records do not necessarily provide independent corroboration if they all originate from the same underlying system. Source independence should therefore be assessed alongside apparent consistency.

Finally, investigators should test competing explanations. Legitimate authorised activity, customer misunderstanding, configuration error, software failure, compromised credentials, malicious manipulation and deliberate customer misrepresentation can potentially produce overlapping signals. The purpose of investigation is not to select the most technologically interesting explanation, but to determine which explanation is best supported by the available evidence. This is the same progression from signal to assessment developed in FIL's From Fraud Alert to Investigative Intelligence. The presence of an AI agent changes the evidence requiring examination, but it does not remove the requirement to corroborate, refute and document the reasoning supporting the disposition.

What Agentic Payments Change for Fraud Controls

Many existing fraud controls analyse relationships among customer, account, device, beneficiary, transaction, location and historical behaviour. Agentic payments introduce another potentially material object: the mandate governing the relationship between a customer and an authorised software agent. A transaction can appear ordinary when evaluated solely against amount, merchant and account history while still exceeding the authority delegated to the agent. The reverse is also possible because an agent may transact in ways that appear unusual compared with direct human behaviour while remaining entirely consistent with a valid mandate. Control design therefore needs to distinguish behavioural novelty from authority deviation.

The problem is partly one of control visibility. A detection system cannot reliably test mandate deviation if the mandate is not represented in data accessible to the control. An investigator cannot reliably reconstruct authority after a dispute if relevant permissions, approval events and agent actions were never retained. More sophisticated modelling cannot compensate for evidence that the architecture does not capture. Logging, data architecture and evidence preservation therefore become fraud-control issues rather than merely technical implementation details.

This produces an important control question. Traditional systems frequently ask whether this customer is authorised to transact. Agentic systems may increasingly need to ask whether this agent is authorised to perform this transaction for this customer, under this mandate, at this time. Answering that question could require agent identity, permission scope, transaction constraints and evidence of any required human approval to be available as control inputs. The authority relationship itself may therefore become a feature that fraud systems need to represent.

Existing fraud controls nevertheless remain relevant. Authentication evidence, device intelligence, behavioural analytics, beneficiary intelligence, transaction velocity and network relationships can continue to contribute to detection and investigation. Agentic authority adds another layer that must be connected to those signals rather than replacing them. This reflects the broader principle behind the F.I.L. Fraud Intelligence Cycle: analytical value increases when signals are enriched, connected and assessed rather than interpreted in isolation. The control challenge is therefore integration, not wholesale replacement.

Practitioner Guide

The first investigative question should be what the evidence establishes about the authority under which the agent acted. That question prevents the enquiry from beginning with the assumption that the mere presence of AI explains the disputed transaction. It also forces a distinction between the customer's objective, the mandate technically available to the agent and the action ultimately executed. Where those three elements align, the authority hypothesis becomes stronger. Where they diverge, the divergence identifies a specific issue requiring corroboration.

Investigators should establish chronology before classification. Reconstruct the original instruction, activation of the agent or mandate, relevant permission changes, material agent decisions, external interactions, authentication events, payment execution and subsequent activity. Where part of that sequence cannot be established, record the evidential gap explicitly rather than filling it with an assumption. Determine which facts were available contemporaneously and which became visible only after the transaction. That distinction can be critical when evaluating both the fraud disposition and the effectiveness of pre-transaction controls.

The mandate should then be tested against the transaction. If the transaction appears outside scope, the next question is why. Ambiguity, configuration, technical failure, credential compromise, manipulation and deliberate criminal interference carry different evidential implications. Mandate deviation should therefore trigger hypothesis testing rather than an automatic fraud disposition. The investigator should record which evidence supports or weakens each credible explanation.

Authentication should also be assessed according to what was actually authenticated. Customer identity, device possession, agent identity, mandate validity and transaction approval can be separate propositions. Evidence that strongly establishes one proposition should not acquire unsupported weight in relation to another. Investigators should also assess whether multiple records constitute genuine independent corroboration or merely reproduce the same underlying event. This protects the investigation from mistaking data volume for evidential strength.

Finally, the disposition should capture control learning. If an investigation cannot resolve whether an agent acted within mandate because the relevant authority record was never captured, that is more than an evidential inconvenience. It may reveal a control-design or evidence-preservation weakness requiring remediation. Repeated cases may also reveal patterns in permissions, authentication, merchant interactions or agent behaviour that were not visible in an isolated investigation. Mature fraud intelligence should feed those findings back into system design, logging, detection, control calibration and future investigative requirements.

Conclusion

Agentic payments do not remove human agency from fraud investigation. They change where investigators may need to look for it. As payment activity moves from direct human instruction towards objectives executed partly through autonomous software, the distance between what a person intended and what the payment system ultimately processed can become more difficult to reconstruct. The investigative response should therefore focus on the authority chain connecting the customer, agent and financial effect. The completed transaction is evidence of an outcome, not necessarily a complete explanation of the decision that produced it.

The appropriate response is neither to presume that autonomous action is inherently suspicious nor to treat successful authentication as resolving questions it was never designed to answer. Investigators need to distinguish human intent, delegated mandate, agent interpretation, agent action, authentication, transaction execution and financial effect. Each stage contributes evidence, but the evidential weight of that evidence depends on the proposition being tested. An anomaly may justify investigation without establishing fraud, while a technically valid transaction may still require further examination of the authority behind it. The quality of the investigation will depend on preserving those distinctions.

The F.I.L. Agentic Payment Authority Chain and Agentic Payment Investigation Triangle provide complementary ways to structure that analysis. The first reconstructs the sequence through which human authority becomes financial effect. The second tests the relationships among principal, agent and transaction. Together, they expose where authority may remain intact, where it may become ambiguous and where manipulation or compromise requires further investigation. Their value lies in organising investigative questions rather than predetermining the answer.

The deeper control implication is that agentic payments create an authority problem as much as a technology problem. Financial institutions may need not only to recognise agents but also to preserve evidence of the mandates under which they act. Detection systems may need to understand those mandates, while investigators may need access to records distributed across banks, agent providers, merchants and payment networks. Systems that enable autonomous financial action without preserving the evidence necessary to explain that action risk creating an avoidable investigative blind spot. Evidence architecture should therefore develop alongside payment capability.

The decisive fraud question may consequently become more demanding than “Who made the payment?” Investigators may need to establish who authorised which agent to perform which action, under what constraints and at what point human approval ceased to be necessary. They may then need to determine what occurred between delegation and execution and whether the resulting transaction remained inside that authority. Where the evidence cannot answer those questions, the uncertainty should be identified rather than converted into an unsupported fraud conclusion. Agentic payments may be new, but the core investigative discipline remains familiar: establish what the evidence proves, test credible alternatives and document why the final conclusion is defensible.

Methodology and Evidential Note

This article is based principally on primary and official material published in 2026 by HM Treasury, the Financial Conduct Authority, the International Monetary Fund and the US Federal Reserve, supplemented by primary corporate material documenting reported live European agentic-payment experiments. Corporate announcements are used as evidence of the transactions, tests and technical arrangements those organisations report. They are not treated as independent evidence of market-wide adoption, fraud prevalence or control effectiveness. The analysis distinguishes emerging technical capability from established operational prevalence. That distinction is necessary because agentic payments remain an evolving field.

The F.I.L. Agentic Payment Authority Chain and F.I.L. Agentic Payment Investigation Triangle are original Fraud Intelligence Lab analytical constructs developed for practitioner analysis. They are not statutory tests, regulatory standards, payment-network specifications or law-enforcement investigation methodologies. They are intended to help practitioners distinguish intent, delegation, machine action, authentication, execution and attribution when analysing agent-mediated transactions. The frameworks organise investigative questions rather than determine whether fraud has occurred. Any operational application should remain subject to the evidence and relevant legal or regulatory requirements.

Hypothetical fraud scenarios in this article are analytical examples unless expressly identified as documented events. Unexpected agent behaviour, mandate deviation or an anomalous transaction does not by itself establish fraud, criminal intent, negligence or legal liability. Relevant conclusions will depend on the evidence, applicable law, payment architecture, contractual relationships, regulatory framework and circumstances of the individual case. The article therefore distinguishes indicators and hypotheses from established findings. No hypothetical scenario should be interpreted as evidence that a particular emerging fraud method is currently prevalent.

Agentic payments remain an emerging field, and technical standards, regulatory treatment and commercial architectures continue to develop. Responsibilities among customers, AI providers, merchants, financial institutions and payment networks may also vary by jurisdiction and architecture. Practitioners should verify the current legal, regulatory and technical position applicable to the particular payment arrangement before relying on emerging industry practices. Future evidence may require aspects of the analytical framework presented here to be refined. The analysis should therefore be understood as a practitioner framework for an evolving investigative problem rather than a prediction of how agentic-payment liability will ultimately be determined.

References and Further Reading

1. HM Treasury — Modernising Payment Services Regulation, July 2026

2. HM Treasury — Financial Services AI Adoption Plan, July 2026

3. Financial Conduct Authority — Mills Review: AI and the Future of Retail Financial Services, July 2026

4. International Monetary Fund — How Agentic AI Will Reshape Payments, April 2026

5. US Federal Reserve — Payments in the Age of AI Agents, September 2026

6. Mastercard — Santander and Mastercard Complete Europe's First Live End-to-End Payment Executed by an AI Agent, March 2026

7. Mastercard — Worldline, ING and Mastercard Complete a Live End-to-End European Agentic Payment in Production, June 2026

Related Analysis

Continue reading investigations and analysis across Fraud Intelligence Lab.