Authenticating AI agents: who is the customer in agentic payments?

Know-your-customer processes were built on an assumption so basic nobody wrote it down: the customer is a person. That assumption is starting to break. AI agents can now browse, compare and buy on a user's behalf, and the payment networks are building the rails for it. In its recent report on deepfake-enabled financial fraud, identifAI warned that autonomous agents handling financial workflows could be influenced by manipulated inputs, shifting security toward verifying the authenticity of the information those systems receive.

For fraud and identity teams, that raises a question with no settled answer yet: when an agent initiates a payment, who exactly are you authenticating?

Why agentic payments break the old model

Traditional controls assume a human at a keyboard or a phone. Bot defences treat automated traffic as suspicious by default, and KYC verifies a person once at onboarding. An agent that shops legitimately looks, to a legacy system, a lot like a bot, and a malicious bot can easily pose as a legitimate agent.

Vendors in the identity space frame the gap as Know Your Agent (KYA). Vouched, for example, argues in its guide to KYA controls that KYC can verify a human but cannot show whether an agent has authority to act, or whether that authority is still active. That is vendor material, so treat its statistics with care, but the underlying question is a fair one.

What the payment industry is building

The networks are not waiting. According to Cloudflare's October 2025 announcement, Visa's Trusted Agent Protocol and Mastercard's Agent Pay both use Cloudflare's Web Bot Auth as the agent authentication layer, and American Express plans to as well. The key ideas are:

• Cryptographically signed requests. Agents sign each HTTP request with public-key cryptography, replacing user-agent strings and IP addresses that are easy to spoof.
• Registered agents. Agents register with the payment network, and their public keys sit in a directory that merchants can check.
• Time-bound, non-replayable messages. Timestamps and nonces make it harder to capture a valid request and use it again.
• Signed mandates. Mastercard's Agent Pay, as one analysis describes it, relies on cryptographically signed mandates to authorise what an agent may spend.

These mechanisms answer an important part of the problem: is this a registered agent, and is this request genuine?

The gap that cryptography does not close

The human behind the agent

A signed request proves which agent sent it. It does not prove that the person who granted the agent its authority was real, or was acting freely. The mandate itself, the moment a user says "you may spend up to this amount on my behalf", is a high-value identity event. If a fraudster passes onboarding with a synthetic identity or a deepfake, they can then create an agent that is perfectly authenticated and entirely fraudulent.

Manipulated inputs and impersonated approvals

Agents also consume content: emails, documents, voice messages and video. A cloned voice can approve a transfer or change a spending limit. A forged document can steer an agent's decision. In each case the cryptography is intact and the input is false.

A practical checklist for banks and fintechs

1. Verify the human at mandate creation, not only at account opening, using liveness checks and voice and face analysis that can detect synthetic media.
2. Bind every agent to one verified owner with explicit limits on amount, merchant category and time window.
3. Re-authenticate for high-risk changes, such as raising limits or adding payees, with a step-up check that a deepfake cannot easily pass.
4. Inspect the inputs agents rely on. Screen incoming audio, video and documents for manipulation before they can trigger a payment.
5. Log and monitor agent behaviour so unusual patterns can be traced back to a person and a mandate.

Authenticate the agent and the person

Agentic commerce will not remove identity fraud. It will move it to new points in the journey: the moment of delegation and the content an agent trusts. Banks that combine agent authentication with strong verification of the human behind it will be better placed than those that secure only one side. Learn how Corsound AI helps prevent identity fraud and how Deepfake Detect flags synthetic voice and video before they reach a decision point.