Team Oscilar kicked off Money20/20 with a Money Award win for AI & Automation in Banking. A great start to the week and a recognition of the work behind our Agentic Risk Platform, which brings fraud, credit, AML and onboarding together with AI agents that share intelligence, learn from analyst feedback and keep humans in control.

From there, as predicted, the theme of the week was agents, agents and more agents.

They were on the booth banners, in the keynotes and in nearly every hallway conversation. I spent much of the week talking about them myself, at an Axios Live roundtable on commerce in the age of AI on Sunday night, on stage on Tuesday, and in interviews with Yahoo Finance and NYSE TV.

Every conversation came back to the same problem. Banks are being asked to recognize agents acting for real customers, tell them apart from fraud and decide how much authority to give them. The tools the industry has relied on for years assumed a human was on the other end.

Consumers feel the gap too. American Express shared research on stage finding that 59% of US consumers are comfortable using AI for product research, but only 36% are comfortable letting an agent complete the purchase.

Good bot, bad bot no longer works

The tension is already playing out in public. Meta launched Muse, a personal agent that shops and checks out for people, on September 8. Within two weeks, Amazon had blocked it, objecting that the agent did not identify itself while it shopped. On JPMorgan’s earnings call this month, Jamie Dimon said the bank keeps outside AI agents from operating customer accounts, warning that you don’t want rogue agents. And just after Money20/20 wrapped, Axios reported that major U.S. banks are detecting unvetted AI agents inside customer accounts, some appearing to act beyond what customers asked them to do.

Each response makes sense on its own. Together they expose an assumption fraud controls have leaned on for two decades: whoever passed the login is the person acting. Muse breaks it. Its sessions mostly belong to real customers, filling in the same login forms and MFA prompts built for people. A customer can now authenticate, delegate and walk away.

That leaves every institution with a tough tradeoff. Tighten bot controls and you turn away customers using agents they chose. Loosen them and fraud walks in through the front door.

Four questions to ask before trusting an agent

On Sunday night I joined an Axios Live dinner, hosted by Dan Primack and Lucinda Shen, which put leaders from card networks, payment companies, agent startups and investment firms around one table. Most of them build the agents or the rails. I came to talk about the decision on each transaction, and I argued that a single label per visitor can’t carry it. It takes four questions, answered in order.

1. Bot or not. Whether this session is a person or an agent. Knowing software is running tells you very little on its own.

2. Which bot. Whether this is a kind of agent the institution allows. A signed agent from a known platform, an undeclared consumer tool and a fraud kit each call for a different policy.

3. Whose bot. Whether the account holder authorized this specific action. Checking a balance and sending $10,000 are different requests, even when the same credentials make them.

4. Still their bot. Whether the agent has been hijacked or manipulated since its owner set it loose.

   
   

Networks and protocols are building strong answers to the first two. Card networks are introducing scoped payment consent for the third, and Amex’s new Intent Intelligence framework lets an issuer receive the customer’s authorized purchase intent before an agent completes the transaction.

The fourth has no standard yet, and it’s where I expect the first big losses. The example I gave the table: you ask your shopping agent to buy a coffee maker under $200. It reads a fake review site and pays a scam store $180. The agent was real, authorized and within budget. The money is still gone. Stealing an agent’s credentials is hard. Steering it is cheap, and every signature still verifies.

Buying is the easy part

On Tuesday I joined Zor Gorelov of Blue Language Labs and Danielle Aviles Krueger of Plaid for Let the Agents Do More Than Pay, moderated by Amias Gerety of QED Investors, in front of a standing-room-only crowd.

Our premise was that an agent that can check out is only a very fast shopper.  An agent that does business finds counterparties, negotiates terms and carries obligations over time. Zor made the case that B2B is where this gets big, and Gartner expects AI agents to intermediate more than $15 trillion in B2B spending by 2028.

That’s also where the risk gets harder. Picture a small business whose purchasing agent can pay approved suppliers up to $5,000. A real invoice arrives, but the supplier’s payment instructions have been compromised. The amount is in budget, the agent is authenticated and the payment looks routine. Catching it requires a decision that sees the changed beneficiary and knows how this business normally pays. Without one, an agent can repeat the mistake across hundreds of payments before anyone notices.

Danielle drew a parallel I found illuminating: what makes agents trustworthy looks a lot like open banking, with explicit consent, revocation that works and data shared through governed channels. Revocation is the seam I watch most closely. An agent might hold a network token, a merchant session and an API key from a third service, and revoking one leaves the other two working. Until that’s solved, institutions will keep a person in the loop.

That was the point I offered on stage. Authentication and payment permissions don’t tell an institution whether a particular transaction is safe. That takes a decision informed by the customer, the counterparty and the agent’s authority, and as more agents take part in the same transaction, shared standards for identity and delegation matter just as much. Online payments went through this once, when real-time fraud decisioning made commerce between strangers possible. Agentic commerce needs that capability extended to new actors, changing permissions and risks that can emerge after an agent is authorized.

How banks decide which agents to trust

In practice, the same agent might check a balance without friction, need extra verification to change an address, or require customer approval to add a new payee. As customers hand tasks to agents or step in midway, banks also need to know who was in control when the money moved.

When interviewed by Yahoo Finance, I put it in consumer terms: set clear limits, get a plain-English record of what your agent did, and expect your bank to check each action before money moves. An agent asking for your password is a red flag.

On NYSE TV’s Taking Stock, J.D. Durkin and I discussed the advantage criminals have in adopting new AI models immediately, while banks rightly take time to validate them. But banks have an advantage of their own: visibility into the full customer relationship, not just one interaction. That advantage only works when data is connected, and in most institutions, it still isn’t.

Off the main stage, risk leaders described the same gaps

The conversations away from the stage were just as revealing. Between our executive banking dinner with Kaufman Rossin and SentiLink, a fraud breakfast with Mastercard, our fintech executive brunch with iDENTIFY, FS Vector, the American Fintech Council and Eisen, and four days at our booth, we kept hearing the same frustrations.

Sponsor banks are trying to onboard fintech programs faster than onboarding built for a large bank allows. Risk teams are still paying different vendors for KYC, KYB, sanctions and monitoring, each with its own view of the same customer. And nearly everyone wants to bring AI into their operations while still being able to explain every consequential decision to an examiner.

These are problems institutions face today, before autonomous agents add another layer of complexity.

Closing the gap between fraud and credit with TransUnion

One of my favorite moments of the week came at our booth, where Jeff Johnston, TransUnion's Director of Global Fraud Strategy and Business Operations, joined me to unveil TransUnion's Credit Washing and Synthetic Fraud Scores, the industry's first adverse-actionable scores for synthetic identity and credit washing, available first in Oscilar.

These risks have historically fallen between fraud and credit teams. A lender might recognize signs of a synthetic identity but lack what it needs to support an adverse credit decision. Scores with reason codes a lender can cite close part of that gap, and they do the most good when fraud, identity and credit run in one decision. That matters even more as agents start to take part in decisions across those same functions.

Agents are only as trustworthy as the foundation they run on

Drop autonomous agents into that siloed environment and the cracks widen. An agent can decide faster, but it can't make up for context it never received or authority nobody defined.

I've seen this pattern before. At Confluent, fraud and risk decisioning became our biggest use case. Some of the most sophisticated banks in the world streamed data in real time, then handed it to fraud, credit and AML systems that each saw one slice of the customer. They had real-time data. They didn't have real-time risk. That's why we built Oscilar on a single, real-time view of each customer's risk first, and only then put our own agents to work on top of it.

The same principle applies to agents arriving from outside. A verified agent doesn't automatically make a transaction trustworthy. Agents should earn their authority one job at a time, and institutions should always be able to take it back and explain every consequential decision.

Three predictions for the next 18 months

1. Standing permissions will arrive in narrow lanes first. Reorders, travel rebooking and business purchasing with fixed budgets are recurring, bounded and easy to measure, and B2B actions will likely move ahead of consumer ones because budgets, guardrails, and approval chains already exist there.
   
   

2. The first major agent fraud story will most likely involve a real agent with real permission, steered by a scam storefront, a compromised invoice or a hidden instruction on a web page.
   
   

3. Know your customer will become know your customer and their agents. Banks will start treating agents as their own category of actor, with permissions, limits and a risk profile, checked in real time on every action.

Nearly every company in Las Vegas had an agent to show. Far fewer could say what has to be true before an institution lets that agent act on a customer's money. That's the question I expect to define the year ahead.

The more financial authority we give agents, the more important it becomes to know what they're doing, whose interests they're acting for, and when to intervene. The infrastructure institutions build now will determine how much autonomy they can safely support.

Until next year

Thank you to our customers, friends, advisors and partners who made Money20/20 so memorable. We're especially grateful to our co-hosts at Kaufman Rossin, SentiLink, Mastercard, iDENTIFY, FS Vector, Eisen and the American Fintech Council, and to everyone who showed up in a big way, shared their perspectives and brought such great energy to the week.

It was wonderful to reconnect with familiar faces, meet new ones and have so many meaningful, productive conversations. And a special thank you to the inimitable Oscilar team (both on the ground and from afar) for bringing it all to life.