An international group of lenders published a report on Tuesday noting that AI agents operating autonomously to conduct transactions could create vulnerabilities to fraudulent activity, scams, and payment disputes. Six financial institutions — Bank of America, Capital One, ASB Bank, Commonwealth Bank of Australia, ING Group, and NatWest Group — jointly authored the report, entitled Building Trust in Agentic Commerce.
While buyers have expressed interest in these tools, the report notes that uncertainty persists, with many people questioning whether AI agents will act in their favour, purchasing the wrong items, overspending, or exposing them to financial fraud. "Many consumers remain uncertain about what protections apply to them or where to turn if something goes wrong with agentic commerce transactions," the report states.
An uptick in fraudulent activity, deceptive schemes, and consumer disputes is considered probable, according to the report. Diverging assumptions among buyers, intermediaries, and vendors are identified as generating points of conflict throughout the transaction process. Accountability for actions taken beyond an agent's sanctioned scope has yet to be determined.
Certain providers are reported to be carrying out practices that banks have characterised as posing safety risks. Card details are collected verbally and subsequently used to make purchases on online platforms. Some operators opt for transaction methods that carry reduced consumer safeguards and bypass established processing compliance requirements.
Unauthorised parties may attempt to infiltrate or impersonate agents and merchants, opening the door to novel forms of deception. Retailers are anticipating a rise in payment disputes and chargeback claims. Automated purchasing agents operating on consumers' behalf could generate refund requests at volume, potentially adding pressure to payment infrastructure.
Fraudulent use of artificial voice replication technology has increased over recent years. Such tools have reportedly been available for as low as $500, capable of producing realistic voice audio from brief publicly available recordings. Some households have reported monetary losses following telephone calls that used synthesised versions of relatives' voices to simulate distress.
Greek authorities broke up a criminal network that had deployed artificial intelligence to replicate individuals' voices and steal more than one million euros. Perpetrators used fabricated emergencies to deceive those they approached. Fraudsters obtained voice recordings of family members through deceptive means, then used synthesised audio to establish credibility with victims. Comparable instances have been recorded across India, Singapore, and the United States.
One of the six banks involved in the report stated that it processes tens of millions of transactions across its customer accounts each day, and that automation tools powered by artificial intelligence reduced yearly financial losses by more than a fifth compared with the preceding year. The same tools are available to those who exploit them for illicit purposes, while conventional protective measures face growing strain as capabilities and volume expand.
Federal officials held a series of discussions with banking executives earlier in the year. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell each voiced reservations about an artificial intelligence model's ability to detect software vulnerabilities, with oversight bodies noting that such a capability could place powerful instruments in the hands of those with harmful intent. The bank was granted preliminary access to conduct protective due diligence work.
The bank's chief executive subsequently called for enhanced disclosure around vulnerabilities, noting that cyber threats represent the institution's foremost concern and that artificial intelligence intensifies the challenge during this period of transition.
The document from the six banks sets out guiding principles rather than binding directives. The proposals include mandatory disclosure when an AI agent takes part in a transaction, openness in how decisions are reached, and enhanced protections for personal data held by businesses. The organisation intends to work directly with legislators to influence the development of new regulations.
OpenAI, Anthropic, Google, and Meta are among the firms advancing AI-powered shopping tools with expanding autonomous capabilities. Questions of accountability have yet to be formally established. Customers tend to expect financial institutions to absorb any losses, whereas banks direct responsibility toward retailers or technology providers.
Beyond payment processing, the handling of financial and personal data across multiple platforms by AI agents raises privacy risks, where any security failure could leave both buyers and sellers exposed. Community-oriented financial institutions, many of which depend on a narrow pool of technology providers, may face heightened vulnerability to orchestrated threats from autonomous AI-driven systems.
Studies have found that AI-driven agents exceeded the performance of human operators when tested in social engineering scenarios. During laboratory experiments, test subjects placed greater confidence in an AI-driven simulation than in a human counterpart, complied with its directives at notably higher rates, and just one individual detected the deception.
Losses attributed to AI-powered identity deception and fabricated media content have risen considerably across the globe. FBI figures show that AI-generated voices and deepfake media were used to carry out investment fraud totalling hundreds of millions of dollars across the country within a twelve-month period. Yearly losses to fraudulent activity across all sectors run into the hundreds of billions of dollars worldwide.
All six financial institutions have expressed support for artificial intelligence technology, and numerous organisations have adopted the technology for purposes such as fraud prevention and tailored user experiences. The group's position holds that responsible AI advancement requires built-in oversight mechanisms from the outset, encompassing transparency, accountability, and defined liability structures, so that public confidence is maintained and protections for both consumers and businesses evolve alongside the technology itself.
