G+D Netcetera has warned that existing payment authentication models are not sufficient for transactions initiated by AI agents. The industry now needs to verify intent as well as identity.

The shift reflects the rise of agentic commerce, in which software agents can initiate purchases and payments without direct human action. Examples include reordering materials, booking hotel stays, and settling tolls in real time. In these cases, trust moves away from a cardholder's direct approval and towards whether an agent is acting within an authorised mandate.

Current payment security systems were built around what the industry calls a human-in-the-loop model. Strong customer authentication, 3-D Secure, and biometric checks are designed to confirm that a person knows about a transaction and actively approves it.

That model becomes less clear when an AI agent acts on a user's behalf. Identity checks still matter, but they need to be paired with delegated authorisation and verification of the payment's context and purpose.

According to G+D Netcetera, many signals used in conventional fraud detection lose value in agent-led transactions. Device data, behaviour patterns, and location checks are less useful when the payer is not personally carrying out the purchase.

In their place, a different set of questions emerges. Payment providers and issuers need to know whether the agent's identity is known, whether the mandate remains valid, and whether the purchase falls within the authority granted to that agent.

The broader payments market has begun to address these issues, although the framework remains incomplete. E-commerce platforms are testing autonomous customer journeys, while card networks have introduced specifications for agent-driven payments, including Visa Trusted Agent Protocol and Mastercard Agent Pay.

Source link