How AI Agents Are Reshaping the Future of Digital Payments

By Ilya Podoynitsyn, CEO of FinHarbor

For three decades, digital payments have rested on a single quiet assumption – a human sits in front of a screen and presses a button. Every control the industry built, from 3-D Secure to the checkout page itself, is a ritual designed around a person who is present at that exact moment. In 2025 the industry admitted the assumption is expiring. Visa opened its network to AI agents with Intelligent Commerce, Mastercard launched Agent Pay with Agentic Tokens, and Google published the Agent Payments Protocol (AP2) with more than 60 partners on board. The AP2 specification states the problem with unusual candor – today's payment systems assume a human is directly clicking "buy" on a trusted website, and an autonomous agent breaks that core assumption.

What replaces the button is a standing permission granted to software. The buyer becomes a program acting inside boundaries that a person defined once, sometimes vaguely, and then stopped watching. The scale is no longer speculative – McKinsey estimates that by 2030 agentic commerce could orchestrate up to $1 trillion in US B2C retail revenue, and $3 trillion to $5 trillion globally. The same research notes that fraud engines were built around a human-in-the-loop model, and the risk stack now has to verify the agents themselves.

The attack surface moves up the stack

In the card era, a compromise usually meant a stolen credential. The damage was bounded – a dispute, a reissued card number, and the story ended there. With agents, the valuable target sits higher, in the orchestration layer where delegated credentials live and where a single workflow can string together dozens of payments. Whoever bends that layer inherits an entire flow of transactions, executed at machine speed under authorization that looks legitimate because it is.

The bending mechanism already has a name. Prompt injection – hidden instructions planted in a web page, an email or a product listing that the agent reads – holds the top position in the OWASP list of risks for LLM applications. OWASP's core observation is uncomfortable for anyone building payment flows on top of language models. The model cannot reliably distinguish its operator's instructions from text it encounters in the wild, and malicious payloads do not even need to be visible to a human.

A second vector is synthetic delegation. If authority is just a token or an API scope, an attacker who forges or replays it obtains something far more dangerous than a card number – a mandate. The fraudulent transaction that follows is well-formed and looks legitimate, because the agent really did have permission. Fraud detection tuned to spot anomalous humans has little to say about a perfectly authorized machine doing exactly what its stolen mandate allows.

Standing permission is a different object than a one-time authorization

A classic authorization is a point event, fixed in amount and in time, with the cardholder present. A standing permission granted to a program is a contract that lives in time. It fires while the user sleeps and interprets conditions such as "buy when the price drops below the threshold" – and any ambiguity in how those conditions were written eventually compounds into real money.

This is why the emerging standards read like legal instruments. AP2 represents each purchase as cryptographically signed mandates – an Intent Mandate capturing what the user actually authorized, and a Cart Mandate binding the specific items and price – creating a non-repudiable audit trail for disputes. Visa's framework lets consumers set spending limits and conditions that the network enforces in real time. Mastercard requires agents to be registered and verified before they can transact. The common thread is that consent has to survive as a durable, inspectable artifact instead of evaporating with the click.

The minimum the infrastructure must guarantee

From where I sit, safely serving autonomous buyers requires three guarantees, and none of them can live inside the model itself.

The first is identity. An agent has to be a first-class subject in the payment system, cryptographically distinct from the human it serves, so that every counterparty can see that a machine is transacting and which one. Identity means little without delegated authority behind it – proof of who granted the permission, on what terms, and a way to revoke it instantly. Controlled execution closes the loop. 

Spending rules have to be enforced deterministically at the transaction layer, outside the agent, precisely because the agent's reasoning can be manipulated by the content it reads. A limit written into a prompt is a suggestion, and attackers know it. Real control sits where the rail can refuse the transaction no matter what the model was persuaded to think.

At FinHarbor we build payment orchestration on this principle. Every automated actor in a client's money flow operates under its own permission envelope, and policy checks run at the infrastructure level rather than inside application logic. Anything outside the granted scope escalates to a human. In practice this mirrors how banks already treat corporate mandates and payment limits – the novelty is applying that discipline to software that negotiates and decides.

The checkout is dissolving into policy. Visa's launch of Artificial Intelligent Commerce Connect in April 2026, a single integration for merchants to accept agent-initiated payments across four protocols, shows how quickly the rails are converging. So my practical advice for anyone running money flows in 2026 is to ask their payment provider two questions now. 

Can your stack tell an agent-initiated transaction from a human one, and how fast can a compromised mandate be revoked? If the answers are vague, the infrastructure was built for a buyer who no longer exists. Firms that keep treating agents as slightly strange humans will spend the next decade patching a model built for people. The agent economy will run on infrastructure that recognizes them as a separate class of financial subject, with verifiable identity and limits the network itself enforces.

Disclaimer: The information provided in this article is for informational purposes only and should not be considered financial, investment, legal, or professional advice. Readers should conduct their own research and exercise independent judgment before making any decisions based on the information presented.