Electronic payment
Unsplash

In the history of electronic payments, we've been doing real-time automated fraud detection for years. And sometimes controls even relied on a quiet assumption: a human sits somewhere in the chain, and that human might introduce delay. In that case, someone reviews the invoice, notices the vendor name looks slightly wrong, and waits until Monday to resolve it. What has actually changed? AI agents don't merely accelerate the payment; they potentially accelerate the entire decision-making process that precedes the payment.

Autonomous agents won't necessarily eliminate human involvement. And many high-value financial transactions will still have approval policies, limits, dual controls, authentication, etc. But autonomous agents can eliminate pauses that were previously built into human workflows. Software that can authenticate, negotiate terms, and settle a transaction in a fraction of a second doesn't wait for anyone to feel uneasy. It doesn't slow down when the credentials were stolen twenty minutes earlier.

That is the structural problem the payments industry is now working through, and it is one reason so much attention has shifted toward unified visibility into payment data rather than after-the-fact reporting. As Ralph Dangelmaier has argued, detection that arrives in a monthly reconciliation file isn't the right kind of detection, especially when the counterparty is a machine.

The Detection Window Was Always the Real Control

The industry data on account takeover has been consistent for years. The idea was that the time between a credential being compromised and its discovery could be days or weeks, not seconds. Password reuse gets noticed when a login looks odd. A phished executive mailbox gets noticed when a colleague asks about a strange request. It worked on a human clock, and it was enough.

Payment infrastructure tolerated that lag because the transaction clock ran at a comparable speed. Wires had cutoff times. Card disputes had windows. Batch settlement created natural checkpoints where anomalies surfaced before money left the building for good. The problem is loss accumulation during the detection window, not necessarily deterioration of the fraud model itself.

Agentic systems compress that transaction clock, but the detection clock runs the same. With delegated authority, an agent can execute hundreds of legitimate-looking transactions, and it can do it inside the window that a security team still needs to notice if anything is wrong. That means the consequences add up before the spotting begins, not that the compromise itself is any harder to spot.

Corrupt the Decision, Not the Rail

Here's a better way to think about this. Attackers no longer have to target the payment rail. Instead, they target the decision that reaches the rail. This framing has gained traction among many payment practitioners.

The last artifact of an upstream choice is a wire instruction. It doesn't matter if the choice itself is corrupted by a synthetic voice on a call, a convincing video of a finance leader, or a compromised token handed to an agent. The rail will still execute its instruction perfectly. The payment rail can execute the instruction exactly as designed. If the fraudulent decision occurred upstream, the transaction itself may look perfectly valid to downstream systems.

That's why the distinction between verifying identity and intent matters. Ralph Dangelmaier has pressed it with banks, processors, and software platforms across dozens of markets. Identity verification answers who asked, but it doesn't answer whether what was asked for was ever authorized.

Once agents enter the picture, that gap really matters. An agent's identity is a credential rather than a face, which can be copied. Voice and video were once relatively difficult and expensive to forge convincingly at scale. That assumption is no longer safe.

Three Weaknesses Specific to Finance Functions

Payment approval has structural vulnerabilities that have little to do with technology. How finance teams operate these processes can change the game entirely.

Sometimes, they normalize urgency. A request marked time-sensitive does not stand out in a treasury inbox because a meaningful share of legitimate requests are urgent. The signal that should trigger scrutiny is indistinguishable from ordinary Tuesday traffic.

Then, there's the matter of hierarchy. Asking a senior executive to confirm a request through a second channel feels like an accusation to many employees. The organizational cost of being wrong about a real executive outweighs the perceived cost of being wrong about a fake one.

That's not even mentioning the fact that audio and visual input can be forged. Callbacks, voice recognition, and video approval were reasonable controls when convincing synthesis required real resources. They're cheap, and any control whose strength depended on the cost of forgery has quietly lost most of its value.

Add machine-speed execution on top of those three, and you get a system where the weakest link is not encryption or network security, but rather the exact moment of authorization.

Building Controls That Assume the Channel Is Already Compromised

The practical response is to move beyond authentication alone and toward verifiable authorization. For example, prioritize cryptographic proof of authorization. People who work on this seriously find that several principles keep recurring.

Authorization should travel as a signed mandate. Instead of an agent saying there's permission, this kind of authorization gives a verifiable record of the specific permission granted. This includes limits on amount, counterparty, and time. The receiving system validates the mandate rather than trusting the request.

Treat every communication channel as compromised by default. Of course, email, voice, and video help with coordination, but none of them should carry authorization on their own.

Behavioral anomalies also deserve more weight than mere credential validity. A new vendor, an account with no payment history, an amount just under a review threshold, or a payment pattern that doesn't match a business cycle are all signals that survive even when the identity presented is technically valid.

Friction needs to scale with actual risk rather than apply uniformly. Blanket delays get engineered around. Targeted delays on unusual transactions can still be tolerable and effective.

Instead of litigation when it's too late, accountability has to be assigned before agents act. If an autonomous system executes a fraudulent payment within its granted authority, the contract and control design should answer who owns that loss. Building trust into payment systems means deciding these questions while they are still cheap to decide.

The Cultural Layer Nobody Can Buy

None of these technical controls can work if the organization hasn't given people the explicit permission they need to verify transactions. A finance associate who pauses a payment because something feels off needs to know the pause will be accepted rather than seen as obstruction, even if the request turns out to be legitimate. That's a policy and leadership decision, not a single software purchase.

The same logic extends to agent deployments. Teams need a clearly sanctioned way to halt an autonomous process. They need to know that halting it will not be held against them. Speed is only an asset when there is a brake attached.

Where This Leads

The honest read on agentic payments is that the technology is arriving faster than the assurance model around it. That's not to say that organizations should refuse autonomy, since efficiency is a real need when competitive pressure is visible.

The future of agentic payments won't belong to organizations that can establish trust before an agent acts, continuously evaluate whether that trust still holds, and intervene when the transaction moves outside its authorized context. The challenge isn't putting a brake on autonomous payments. It's building a brake that operates at machine speed.

It's an argument for deliberately closing the detection gap: shortening the time to notice compromise, narrowing the scope of what any single agent can authorize, and shifting verification from appearance to cryptographic evidence.

Ralph Dangelmaier keeps returning to sequencing. Organizations that do that work will gain an advantage.

About Ralph Dangelmaier

Ralph Dangelmaier is a payments executive and advisor with three decades of payments leadership, including roles as chief executive of BlueSnap, president of ACI Worldwide, and chief executive of P&H Solutions. He founded the Payments Advisory Team, which works with banks, processors, software platforms, and merchants on go-to-market strategy, payment orchestration, and transaction due diligence, and he leads Paymetrix, a payments intelligence platform focused on fee visibility, reconciliation, and authorization performance. A graduate of Stonehill College with a degree in economics, he speaks and writes regularly on payment infrastructure, fraud, and the operational realities of moving money across borders.