On November 12, 2026, three companies on the payments and banking stack shipped three different answers to one question: how should a financial account treat software that acts for its owner. Feedzai gave banks a way to spot an AI agent at login. Wirex gave the agent its own bank account and card. Square gave sellers’ AI tools a fixed list of actions they can take on a Square business. A fourth design, a live pilot run by Visa, BILL and Billtrust, already lets an agent pay approved supplier invoices through supplier portals.
Each design checks the agent’s authority at a different point in the payment: the login, the card authorisation, the platform’s API, or the supplier’s portal. Where that check sits decides who carries the risk when an agent gets something wrong, and which system holds the record of what the agent was allowed to do.
Four places to check an agent’s authority
At the login: Feedzai’s Digital Trust
Feedzai expanded its Digital Trust product to help banks detect AI agents accessing customer accounts. The release starts from a plain observation about bank security: a successful login does not mean a session can be trusted, because AI agents can sign in with valid credentials.
Advertisement
The product works from three pieces. Persistent device fingerprinting and network signals recognise returning activity over time. A fraud score draws on Feedzai’s network view and intelligence shared across its clients, to surface signals a single bank could miss. Cryptographic device binding ties each session back to a known customer and device, so a bank can see who an agent is acting for.
Feedzai says Digital Trust identifies agents by combining the signals they declare about themselves with device fingerprinting and behavioural signals that reveal automated activity. Once an agent is recognised, a bank can trust that returning pairing of user and agent and skip a fresh challenge where its policies allow, while keeping control over which agent activity is allowed and how customer consent is handled.
“Personal and malicious agents can look very similar,” said Pedro Barata, Chief Product Officer at Feedzai. “Our latest advancements in Digital Trust help banks tell them apart, blocking unwanted agents and trusting the ones their customers choose to use.”
The release gives three results: 44% more fraud detected using shared signals in the highest-risk 0.1% of sessions with no increase in false positives, 6,000 fewer unnecessary authentication challenges per million logins compared with competing technology, and 41% fewer SMS one-time passcodes. It also quotes Vatsal Sharma, Director Analyst on the Banking team at Gartner: “Overreliance on weak multifactor authentication (MFA) is prevalent: 95% of banks use MFA, with one-time passwords (OTPs) sent via SMS as the most commonly cited method by Gartner clients.” Feedzai says it will expand its agent detection in the coming months.
In this model the agent uses the customer’s own account and the bank decides, session by session, whether to let it in.
At the card authorisation: Wirex’s Navoka
Wirex launched Navoka the same day in London, at its Full Stack London event. Wirex describes it as the first AI agent that pays on behalf of users from a dedicated bank account and card. Access is by invitation only for now.
Each Navoka agent gets its own IBAN, debit card and USDC and EURC wallet, kept separate from the user’s personal accounts. Users set allowed merchants, spending limits, daily caps and country lists, and those rules are checked every time the card is used. Wirex says agents cannot change the rules, and anything outside them waits for the user’s approval. Navoka can decline a charge, such as a subscription the user no longer wants. A kill switch freezes the card, pauses the rules and disconnects linked assistants.
Two further controls matter to anyone auditing an agent. Each payment records which rule it ran under, who approved it and why. The agent and connected AI assistants never see the user’s card numbers, and each agent runs on its own isolated machine that is wiped if the user revokes access. Users instruct Navoka through Telegram, with WhatsApp and iMessage to follow, or by connecting it to ChatGPT, Claude or Grok.
“Navoka gives the agent its own account and card, so people can hand over the paying without handing over their bank details,” said Pavel Matveev, CEO and Co-Founder of Wirex.
Wirex frames the product around a trust figure: it cites Visa’s Trust Index finding that only 23% of US consumers trust generative AI to handle payment transactions on their behalf, against a Juniper Research forecast of 1.3 billion people using agentic commerce by 2031.
At the platform’s API: Square MCP and Square CLI
Square made Squaremates generally available to US sellers, an evolution of the Managerbot agent that entered open beta six months earlier. Alongside it, Square introduced an improved Square MCP (Model Context Protocol) server and a new Square CLI.
Square MCP is for sellers who already use a third-party AI assistant. They connect their account once, then ask questions and make changes, with the assistant working from a defined set of Square actions. Square CLI gives sellers’ and developers’ own tools and agents command-line access to Square’s APIs. A Squaremates capability in beta can check what is running low, prepare an order and build it on a supplier’s own site, ready for the seller to complete. Square’s release says all of this runs while the seller decides what goes ahead.
“A lot of sellers already have an AI tool they like working in, and our job is to help that tool work directly with their Square business, so they can run things however’s most productive for them,” said Willem Avé, Square’s Global Head of Intelligence.
The control point here is the list of actions the platform publishes. An outside agent can do what the MCP server exposes and nothing else, and the supplier order stops one step short of payment.
At the supplier portal: Visa, BILL and Billtrust
The fourth design is already moving money. In a live pilot from Visa, BILL and Billtrust, the BILL Payment Agent is registered using Visa’s Trusted Agent Protocol and Agentic Directory. It uses tokenized payment credentials and controls aligned with the buyer’s approved payment instructions. On the supplier side, Billtrust uses the same protocol to recognise, authenticate and grant access to the agent so it can complete the invoice payment.
The release says this agent authentication can satisfy the site protections that CAPTCHA and other bot blocking used to provide, without an additional agent login. Buyers do not share supplier-portal logins, and the companies’ FAQ says the agent only executes eligible payments that the buyer has already approved. The pilot is processing end-to-end transactions with participating buyers using BILL and suppliers using Billtrust.
“This pilot applies agentic commerce to a real B2B-payment problem, by having trusted agents complete payments across platforms,” said Mark Nelsen, SVP and Head of Product, Commercial and Money Movement Solutions at Visa. Kunal Patel, SVP Payments at Billtrust, set the condition for wider use: “Agentic commerce will only move forward if businesses can trust agents to operate across systems with the same clarity and accountability they expect from people.”
What the four designs share
All four tie the agent’s authority to a decision a person made earlier. In the BILL pilot it is an approved invoice. In Navoka it is a rule set the user wrote and the agent cannot edit. At Square it is the seller’s go-ahead and the published action list. At a Feedzai bank it is the customer’s choice of agent, which the bank can then recognise on later visits.
None of the four asks the agent to prove it is human. Each one identifies the agent as an agent and then decides what that agent may do. That is a change for bank fraud teams, whose login controls were built to stop software. Feedzai’s release says banks should block unwanted agents and trust the ones their customers choose, and the BILL pilot replaces CAPTCHA with agent authentication for the same reason.
Our earlier coverage of bank AI agents sold on old cores with boundaries set at runtime found vendors placing controls at the moment of action. These four launches extend that pattern from the bank’s own agents to agents that customers bring with them.
Where the designs differ
Whose money the agent holds
Navoka moves the agent off the customer’s account entirely, so the most it can spend is what the user has funded into its separate wallet and card within the caps. Feedzai’s model leaves the agent on the customer’s main account and relies on the bank to read each session. The BILL agent pays from the buyer’s tokenized card credentials, limited to approved invoices. Square’s MCP acts on the seller’s business account through the actions Square exposes.
Who sees the credentials
Wirex says the agent never sees the user’s card numbers. The BILL pilot uses tokens and ends shared portal logins. Feedzai’s model accepts that an agent may arrive holding the customer’s valid credentials, which is why it leans on device binding to link the session back to a known person and device.
Who keeps the record
Navoka writes the rule, the approver and the reason into each payment. The Visa, BILL and Billtrust pilot lists visibility into the authorisation and completion of the payment among its features. Feedzai’s bank-side model leaves the record with the bank’s fraud and identity systems. When a customer disputes a payment an agent made, those are the logs a dispute team will need.
What it means for the finance leader
For banks
Feedzai’s release states that AI agents can sign in with valid credentials, so a bank’s login check alone no longer tells it who is acting. A bank that treats every automated session as an attack will block agents its customers chose, and a bank that waves them through loses the session-level signal. The Feedzai model gives a third option, recognising the pairing of customer and agent and setting policy on it. Banks should decide now which agent activity they allow and how consent is recorded, since Feedzai’s product leaves both decisions with the bank.
For finance teams paying suppliers
The BILL pilot covers the step where a staff member logs into a supplier portal and keys in a card number after the invoice is approved. Archana Prasad, SVP of Payments and Financial Services at BILL, said: “For too long, supplier portals have been friction points, requiring a person to manually complete what should be an automated step.” The pilot runs with participating buyers and suppliers, and Billtrust admits the agent under each supplier’s acceptance policy, so finance teams should ask their AP provider which of their suppliers accept agent payments through a recognised protocol before planning around it.
Our analysis of Visa’s AI shopping benchmark covered the consumer side of the same network work.
For merchants and platforms
Square’s approach shows a platform publishing the agent’s permitted actions as a product. Sellers connecting an outside assistant should list which actions it can take through the MCP server and which still need their sign-off, such as completing a supplier order.
How to evaluate an agent payment product
In our reading, the four launches give finance buyers a working checklist for any agent that touches money:
- Where the authority check runs: at login, at card authorisation, at an API, or at the receiving portal.
- Whether the agent spends from the customer’s main account or a separate, capped one.
- Whether the agent ever handles raw card numbers or shared logins, or only tokens.
- Whether the agent can change its own rules. Wirex says Navoka cannot.
- What each payment record contains: the rule, the approver and the reason, as in Navoka, or only the transaction.
- How a user revokes access, and what happens to the agent’s environment when they do.
Vendors that answer all six in writing will make a dispute, an audit or a fraud review easier to run. The Visa, BILL and Billtrust pilot and Feedzai’s planned expansion are the next places to watch for how these answers hold up at volume.
Source: Feedzai
