AI models are increasingly influencing payment decisions involving real money, from whether a transaction should be approved or declined to whether an agent should initiate a payment on a user’s behalf.
In fiscal 2025 Visa blocked nearly twice as many fraudulent ecommerce transactions as the year before, an extra 400,000 blocks a day. Ecommerce fraud rates across its ecosystem fell by eight percent.
Mastercard scores a transaction in 125 milliseconds and reports a 20% average improvement in fraud detection.
What you see there are production numbers from real traffic. Technology that uses AI now affects how payment systems are made.
This guide covers where AI works in a payment flow, the returns and the risks, and how the EU AI Act, PSD3/PSR and PCI DSS shape what reaches production.
AI in payments is the use of machine-learning models to score, classify, predict or generate inside a payment flow. Each task runs on its own model: fraud scoring inside the authorization window, routing at the switch, alert triage in the AML queue, matching in reconciliation.
The models take the estimating work. The counting stays where it is: ledgers, scheme rules and settlement calculations run on fixed code that has to be exact.
Robotic process automation belongs in a different category: it runs a fixed script that changes only when someone rewrites it.
Payment automation removes manual effort from a known process such as batch runs, template approvals or rule-based retries. A person writes the logic and it behaves identically every time.
AI in payment processing changes the decision itself. It weighs hundreds of signals per transaction, returns a probability in place of a verdict, and shifts as the data shifts.
The difference shows up after launch. Automation is shipped and then managed through releases, while a model degrades as the data changes and needs drift monitoring, retraining and reason codes. That commitment is hard to unwind later, so Kindgeek settles which one a project needs during AI adoption planning.
Four things changed at once. The pressure came from the data, the attackers, the market and the system design.
Data got richer. Swift’s MT/ISO 20022 coexistence period for cross-border payments ended on 22 November 2025, making structured party, address and remittance data the norm. Structured input is what makes screening and matching models viable.
Fraud got adversarial. Enumeration now scales faster than defenders can write rules, because attackers run generative tooling of their own.
Adoption crossed the majority line. The Cambridge Centre for Alternative Finance surveyed 628 organisations across 151 jurisdictions and found 81% adopting AI at some level, but only 40% at scaling or transforming stage.
Orchestration created a control point. Once routing sits in one layer, a single model can act on every transaction across acquirers, and cheap inference lets it run inside the authorization window.
The measurable gains are higher authorization rates, lower fraud losses, cheaper payment operations, faster reconciliation, and fewer good customers turned away at checkout.
Approval rate moves revenue directly. Stripe reported its AI acceptance product recovered $6 billion in falsely declined transactions during 2024, with retry success up 60% year on year.
Fraud loss and false declines have to fall together to count as a benefit. In Mastercard’s 2026 research, 83% of industry leaders said AI has significantly reduced false positives and customer churn over the past year. Fraud reduction bought with declined good customers costs more than it saves.
Reconciliation exceptions, dispute handling and alert triage are volume-heavy and pattern-rich, a profile ML handles well. The MRC’s 2026 report put the cost of resolving one first-party misuse dispute at $82, up from $74 a year earlier.
Probabilistic matching clears the long tail of partial payments, aggregated settlements and mismatched references that rule-based matching hands to a human.
Fewer wrongly declined cards, and fewer step-ups for customers already known to be good. Both reduce checkout friction for the customer and lost sales for the merchant.
The use cases run from onboarding a merchant to resolving disputes months after settlement.
Fraud detection is the most mature AI use case in payments. The model reads signals from the card, the device and the merchant, plus how fast the account is spending and how the customer normally behaves. It returns a risk score while the transaction is still waiting for authorization. A policy engine turns that score into an approval, a decline, or a step-up for extra verification.
In Kindgeek builds, the model also reads connections between entities. It can see that a device has touched cards already known to be compromised, or that a merchant sits on a path other fraud has travelled.
Most categories, grouped by what the attacker is exploiting:
Merchants rarely face one category alone. MRC respondents faced 3.8 attack types on average in 2025, down from 4.2 the year before.
Visa processed 257.5 billion transactions on VisaNet in fiscal 2025. It trained its VAAI Score on more than 15 billion of them to catch enumeration in card-not-present traffic, cutting false positives by 85% against prior models.
Mastercard makes the same case with different numbers. Decision Intelligence Pro scans a trillion data points, returns a score in 125 milliseconds, and reports a 20% average uplift in detection.
Both feed their scores back into issuer models. A bank using either one gets detection built on traffic well beyond its own portfolio.
Routing models pick the acquirer, rail or 3DS path most likely to authorize at the lowest cost. They learn how each issuer behaves, down to the card range and the country, and relearn it as issuers change their rules.
Authorization optimization is a separate discipline from fraud control. It covers retry timing, network tokens, message enrichment, soft-decline classification and issuer-specific formatting. The gains are measurable at platform scale.
Stripe reports that its authorization optimizations recover 20% of false declines on average and lift acceptance rates by 3.8%, worth as much as $27 billion a year in incremental revenue across its users. The loss arrives as absent revenue instead of a support ticket, which is what makes it easy to overlook.
Models match settlements to payouts, classify unidentified credits, predict which batches will fail, and flag fee discrepancies against scheme tables. This work happens after the authorization window closes, so the latency budget stretches to minutes.
Transaction-monitoring models rank risk to cut alert volume, and NLP handles name matching across transliterations and aliases. In KYC and KYB, document classification and liveness checks compress onboarding from days to minutes.
The regulatory treatment differs from fraud. An AML system that scores customer risk and drives de-risking carries obligations beyond those of a pure fraud detector.
Underwriting models score prospective merchants on registry data, web presence, category risk and portfolio history. That score then sets reserve terms.
Classification models predict which disputes are winnable and assemble the compelling evidence to contest them, while LLMs summarise case history for analysts. With 64% of merchants reporting rising first-party misuse, dispute volume now runs beyond what manual review absorbs.
Forecasting models predict settlement timing, nostro balances and intraday funding needs. Tighter forecasts can reduce the buffer capital held against uncertainty.
Assistants grounded in real transaction data answer status, fee and decline-reason questions, and draft replies that analysts review before sending.
Agentic payments are transactions a piece of software initiates on someone’s behalf, using authority granted to it in advance. The card networks, the FIDO Alliance and the major AI platforms have each released a way to authorize them.
Transactions initiated by software acting under delegated authority from a person or business. McKinsey estimates AI agents could mediate $3–5 trillion of global consumer commerce by 2030, up to $1 trillion of it US B2C retail. The MRC found 63% of merchants exploring or planning agentic AI payments.
Four frameworks are in play, spread across three layers: authorization, network infrastructure and checkout. They address different parts of the same problem, so a merchant may end up supporting more than one.
| Framework | Primary purpose | User authorization | Payment rails | Merchant integration | Governance / status |
|---|---|---|---|---|---|
| Google AP2 | Prove an agent had authority to pay; accountability | Signed Intent and Cart Mandates; “Human Not Present” pre-authorisation (v0.2) | Rails-agnostic: cards, A2A, stablecoins | Verify mandates alongside existing checkout | Donated to FIDO Alliance, April 2026; community-governed |
| Mastercard Agent Pay | Network infrastructure for agentic commerce | Consent policy bound into an Agentic Token via MDES | Mastercard rails; Agent Pay for Machines adds accounts and stablecoins | Accept a tokenised credential scoped to agent + merchant | Mastercard-operated, live; Verifiable Intent donated to FIDO |
| Visa Trusted Agent Protocol | Agent identity, intent signalling and merchant trust | Signed intent payload with a verified agent credential | Visa rails / Visa Token Service | Recognise verified agents at checkout | Published on GitHub Oct 2025; folded into Visa Intelligent Commerce |
| Agentic Commerce Protocol (ACP) | Agent-to-merchant checkout specification | Buyer confirms in the AI surface; scoped single-use payment token | Merchant’s own PSP | Merchant stays merchant of record; keeps refunds and chargebacks | Open spec maintained by OpenAI and Stripe, with Meta |
An open, rails-agnostic protocol for proving an agent had authority to pay, built on signed Intent and Cart Mandates. Version 0.2 added “Human Not Present” transactions against pre-authorised instructions. Google donated AP2 to the FIDO Alliance in April 2026, along with Verifiable Intent, a tamper-evident log of authorised agent actions co-developed with Mastercard.
Mastercard Agent Pay is network infrastructure. Agentic Tokens extend MDES to bind a tokenised credential to a specific agent, merchant scope and consent policy, keeping the PAN out of the agent’s hands. Agent Pay for Machines, launched June 2026, extends it to machine-to-machine settlement across cards, accounts and stablecoins.
Published on GitHub in October 2025 and folded into Visa Intelligent Commerce, TAP gives an agent a verifiable identity and a signed intent payload so merchants can tell a delegated agent from a bot.
An open checkout specification maintained by OpenAI and Stripe, with Meta as co-creator, using scoped single-use payment tokens. The merchant stays merchant of record and keeps its own PSP, settlement, refunds and chargebacks.
B2B agents mostly operate inside the company that owns them. Procurement agents raise and match purchase orders. Treasury agents move funds within policy limits. Accounts payable agents schedule runs against forecast cash, and machine agents settle per-call API charges. Existing approval thresholds and dual control still apply.
Agentic commerce creates a new problem. Fraud models trained on human behaviour read agent traffic as bot traffic and decline legitimate orders in bulk.
AP2, Verifiable Intent and Trusted Agent Protocol all address this, and they converge on six controls. The agent proves who it is, and proves the user asked for the purchase. Its authority carries a defined scope and a spending limit. The transaction is signed, so neither party can deny it afterwards. If the agent gets it wrong, the liability has a named owner.
Dispute rights for agent-initiated payments remain unsettled.
Generative AI in payments works on language, so it belongs where the output is text rather than a decision.
Generative AI in payments works best on tasks that produce text for a person to read. It drafts the things people would otherwise write by hand: dispute summaries, merchant support replies, fraud investigation write-ups. And it reads the things people would otherwise read: invoices, onboarding packs, reconciliation breaks. Analysts query logs in plain language instead of SQL. A human reviews the output in every case.
Generative AI stays out of anything that moves money without a person checking it first. In real-time authorization there is no room for it: the budget is milliseconds, and the same input has to return the same answer. Ledger and settlement writes must be exact and reproducible. Sanctions hits and SAR filings wait for a human signature. Nothing executes on authority that was not granted in advance.
Most of the engineering goes into the infrastructure that feeds the model, constrains it, and watches it for decay.
Feature computation has to be identical between training and serving, with event-level lineage per decision. A managed feature store handles this at scale. Shared feature libraries with a streaming layer for velocity counters do the same job at lower cost.
Different decisions get different amounts of time. Fraud scoring happens while the transaction waits, so it finishes in milliseconds or it fails. Merchant risk review has seconds to a few minutes. Reconciliation and forecasting run overnight in batches. A copilot answering an analyst’s question can take a few seconds without anyone minding.
Kindgeek ships every payment model behind a policy engine. The model supplies a probability. The policy layer turns that into a decision and a reason code, applying regulatory limits, scheme requirements, merchant overrides and kill switches as explicit rules an auditor can read.
Inside the authorization path the practical budget is tens of milliseconds for scoring, within an end-to-end window set by issuer and scheme timeouts.
A new model runs against live traffic for a full seasonality cycle, scoring every transaction while the existing system keeps making the decisions. That comparison shows how it would have behaved before it is given the chance to behave that way. Monitoring covers score distribution, feature drift, approval and decline rates by segment, and precision against confirmed outcomes.
Three questions get answered at design time. Which decisions does a human make outright? Where can a human overturn the model? And how does that correction get back into training? Under the EU AI Act, answering the first two is a documented design requirement for high-risk systems, so the answers belong in writing rather than in practice.
Under EU law, payment fraud detection falls outside the AI Act’s high-risk list while consumer credit scoring falls inside it, and DORA, PCI DSS and GDPR apply to the model infrastructure in either case.
Annex III, point 5(b) of Regulation (EU) 2024/1689 classifies AI that assesses the creditworthiness of natural persons or sets their credit score as high-risk. It expressly excludes AI used to detect financial fraud.
Purpose decides it, and the label on the system carries no weight. A model that only detects payment fraud sits outside the clause. Add affordability or credit-limit logic and the creditworthiness function inside it becomes high-risk.
AML falls between the two. Pure detection is carved out, while customer risk scoring that drives de-risking attracts scrutiny under GDPR Article 22.
The deadline moved. Regulation (EU) 2026/1744 pushed the Annex III date from 2 August 2026 to 2 December 2027, leaving the requirements themselves unchanged. Article 50 transparency duties kept their original date, apart from a four-month grace on watermarking systems already on the market.
PSD2 remains the law in force. PSD3 and the PSR reached provisional political agreement in November 2025, with the Council publishing final compromise texts on 23 April 2026. Both remain pending. Application should follow roughly 18–21 months after Official Journal publication, realistically late 2027, so for now they inform design decisions.
GDPR governs automated decision-making. DORA has applied since January 2025 and covers ICT and third-party model risk.
The current card-data standard is PCI DSS v4.0.1, replacing v4.0, which retired at the end of 2024. The 51 formerly future-dated requirements became mandatory on 31 March 2025.
Explainability in payments comes down to six operational properties: a reason code per decision, an audit trail linking decision to model version and feature values, reproducibility of any historical decision, a customer appeal path, traceability from training data to deployment, and documented human oversight.
The recurring problems are fragmented data, model drift against adaptive attackers, over-tuned controls that decline good customers, third-party model exposure, and the running cost of ownership.
Payment data is usually spread across several systems: a core ledger, a switch, acquirer file feeds and whatever vendors are in the stack. The same customer or transaction often carries a different identifier in each one. An older core may also report in daily summaries when a model needs the individual transactions behind them.
Joining that data up can take longer than building the model, which is why fintech software development projects at Kindgeek scope the integration work first of all.
Attackers probe production models and can adapt within days. Fraud models are among the fastest-decaying in financial services, which puts retraining cadence, challengers and fast rollback into the architecture.
Over-tuned fraud controls can destroy more revenue than they save. The cost is hard to see because a declined transaction leaves no record of the sale it prevents. A fraud target measured alongside an authorization-rate target makes that cost visible.
Hosted and third-party models introduce data-residency and retention exposure, and DORA puts that dependency in scope. They also open a prompt-injection surface that a self-hosted model does not.
A production model carries serving infrastructure, monitoring, retraining, documentation and audit support for its whole life. A production model also asks risk teams to act on a probability.
The sequence that works runs from one measurable use case through the data foundation, shadow mode against live traffic, policy guardrails, and expansion by traffic share on measured results.
The strongest candidates have a clean label and a P&L line: decline recovery, alert triage, reconciliation matching.
Event-level transaction data with stable identifiers, held in one place with lineage, is the starting point. That is far easier on a modern core than on a mainframe.
A model that has never seen production traffic has never really been tested. Kindgeek runs the model in shadow mode inside the client’s production environment for a full seasonality cycle, then quantifies the difference against the incumbent before control transfers.
The model sits inside a policy engine, with escalation thresholds defined and reason codes instrumented from day one.
Expansion goes by traffic share: 5% to 25% to full volume on measured results, with a rules-only fallback still available.
Baselines captured before the model exists are what make its impact provable. The list runs to nine metrics:
Five shifts are underway: agentic payment infrastructure, continuously adaptive routing, fraud detection that reads identity and intent, generative AI in operations, and governance becoming a standing platform capability.
Agent authorization is becoming rails-level infrastructure. The FIDO Alliance now stewards AP2, through working groups that Mastercard and Visa help chair. Mastercard has extended Agent Pay to machine-to-machine settlement. India’s NPCI is developing a Unified Agent Protocol over UPI, which processed 24.51 billion transactions in August 2026.
Routing models now re-learn issuer behaviour weekly.
As agents transact and scams shift toward authorised push payments, two questions matter. Is the actor who they claim to be? Does the customer intend this payment? Models now take identity, delegation and intent as direct inputs.
Generative AI returns value fastest on disputes, reconciliation breaks, onboarding documents and analyst copilots.
The AI Act, DORA and supervisory expectations are landing at the same time, which turns model inventories, documentation, drift dashboards and decision-level audit trails into permanent platform components.
Five main risks recur. Data sits across systems that serve other purposes and expose it in the wrong shape. Fraud models decay as attackers adapt. Over-tuned controls decline good customers and cost more than the fraud they stop. Hosted models move the PCI boundary and fall under DORA. And the running cost of monitoring, retraining and documentation continues after launch.
Models predict which batches will fail and classify unidentified credits. They match settlements to payouts, flag interchange discrepancies and forecast settlement timing. This work happens after authorization closes, so the latency budget stretches to minutes.
They fall into three groups. Before a payment, models underwrite merchants and run KYC and KYB checks at onboarding. During the payment, they score fraud, pick a routing path and work to get the transaction approved. After the payment, they match reconciliation records, rank AML alerts, sort disputes, forecast liquidity and answer support questions.
A model reads hundreds of signals per transaction, covering the card, the device, how fast the account is spending and how the customer normally behaves. It relearns as attacks change. Visa reports an 85% false-positive reduction on enumeration detection, and Mastercard reports a 20% average uplift.
Automation executes rules a person wrote, and it behaves identically every time. AI produces a probability from learned patterns, and its behaviour moves with the data, so it needs drift monitoring, retraining and reason codes.
Agentic payments are transactions a piece of software initiates on someone’s behalf, using authority granted to it in advance. Four frameworks support them: AP2, now stewarded by the FIDO Alliance, Mastercard Agent Pay, Visa Trusted Agent Protocol, and the Agentic Commerce Protocol from OpenAI and Stripe.
Yes. Models optimise retry timing, routing, message enrichment and network token use per issuer. Stripe reports that these optimisations lift acceptance rates by 3.8% on average and recover 20% of false declines.
Five main risks recur. Data sits across systems that serve other purposes and expose it in the wrong shape. Fraud models decay as attackers adapt. Over-tuned controls decline good customers and cost more than the fraud they stop. Hosted models move the PCI boundary and fall under DORA. And the running cost of monitoring, retraining and documentation continues after launch.
As more companies choose a blockchain consulting partner every year, the success of their blockchain…
A complete application to become an Electronic Money Institution takes the FCA roughly three months…
Take $49.995 as an example. This amount can be part of a discount, tax, or…
Fedwire, the US domestic wire system, settles more than $4.7 trillion in transfers a day,…
AI coding assistants speed up individual tasks. AI-native engineering changes how the entire delivery pipeline…
QA doesn't automatically scale the same way your product does. We learned this while building…