Mastercard is updating its fraud-detection rules to support AI agents that make purchases for consumers and businesses.
The company handles 175 billion transactions each year, assessing each for fraud risk in under 100 milliseconds. Its existing rules were created to block automated systems. Now, they must permit them.
Greg Ulrich, Mastercard’s chief AI and data officer, explained the change to an audience in Menlo Park. “We created risk rules over time to stop bots from transacting,” he said. “Now we need to let the bot transact.”
Related: OpenAI slashes GPT-5.6 Luna prices by 80% in AI price war
Ulrich, who joined the company 11 years ago after an acquisition, said trust has always been central to its operations. It allows merchants to accept payments from strangers and ensures consumers can dispute charges when necessary.
That trust now applies to AI agents. “What will allow AI to scale isn’t the agents’ capabilities, but how much we trust them to act on our behalf,” he said.
Mastercard’s fraud-detection system, Safety Net, has already stopped more than 70 billion fraudulent transactions. The company is now developing its own transformer model trained on transaction data to improve security and personalization without slowing down users.
Related: Samsung Enhances Galaxy Z Flip Cover Screen
To secure transactions made by AI agents, Mastercard introduced a five-layer framework:
- Identity: Verifying both the consumer and the agent, linking them in a KYA or “know your agent” system.
- Verifiable intent: A cryptographic record of the original instructions, ensuring the agent follows them precisely. If a consumer orders black Nike sneakers in size 12 but receives a final-sale pair that can’t be returned, the system can detect the mismatch.
- Controls: Limits on approved merchants, spending caps, and other restrictions.
The larger opportunity lies in business-to-business procurement. A manufacturer could use an AI agent to manage inventory, automatically reordering supplies when stock is low—all within a set budget and approved supplier list. Scaling this across companies requires standardized trust infrastructure for identity, intent, and communication between agents.
For consumers, the change may go unnoticed—until it doesn’t. When an AI agent books a flight or orders groceries, the transaction still appears on a bank statement. Behind the scenes, the rules for fraud, disputes, and liability are being adjusted to account for this new type of buyer.
Related: Target’s AI edge lies beyond the models
“Security and guardrails must be built in from the start,” he said. “They can’t be added later.”
The next step is agent identity. Mastercard’s system already links an AI agent to a consumer’s identity, but Ulrich expects open standards to develop.
Mastercard has expanded its identity work for years, covering both “know your customer” and “know your business” systems. It is now adding KYA to that list. The same network that processed 175 billion transactions last year is being updated to handle the new requirements.
