#107
What’s up fraud fighters, and welcome back to Fraud Forward!
Over the last few months, I've had more conversations about agentic payments than just about any other topic. At conferences, on webinars, and in discussions with some of the smartest people in payments, compliance, and fraud, one thing has become clear to me: I think we're asking the wrong question.
Most people want to know whether AI will start moving money.
The question I keep coming back to is this: How do fraud teams investigate transactions when software starts making decisions?
In this solo episode, I pull together insights from recent conversations with Matt Vega, Mary Ann Miller, and Matt Janiga to explore what agentic commerce really means for fraud investigations, SAR reporting, and the future of financial crime investigations. We talk about why traditional fraud models have always assumed a human initiated the payment, why that assumption no longer holds, and what investigators will need to understand when AI agents begin making decisions on behalf of customers.
The technology may be changing, but the principles of good fraud prevention are not. Documentation, audit trails, authority management, explainability, and strong transaction monitoring will become even more important as agentic payments move from theory to reality.
What you’ll hear in this episode:
- Why agentic payments are fundamentally different from traditional payment automation.
- How agentic commerce changes the way fraud teams investigate payment fraud.
- Why audit trails, attribution, and explainability will become essential during fraud investigations.
- How SAR reporting and AML investigations may evolve as AI becomes part of the payment decision process.
- Why regulators are focused on enabling innovation safely instead of slowing it down.
- The three questions every fraud investigator should begin asking today to prepare for the future.
You should listen to this episode if you:
- Work in fraud prevention, AML compliance, investigations, or financial crime.
- File suspicious activity reports or conduct SAR reporting.
- Lead fraud operations, transaction monitoring, or payment investigations.
- Are evaluating how AI and agentic commerce will affect your institution.
- Want practical steps your team can begin implementing today instead of waiting for the rulebook to catch up.
Episode notes
Agentic payments require a new investigative framework
For decades, fraud investigations have started with one assumption: a person initiated the payment. We reconstruct who logged in, what device they used, how they authenticated, and what actions they took.
Agentic payments challenge that model.
When software begins making decisions on behalf of a customer, investigators need to understand not only who owns the account, but also who authorized the AI agent, what permissions it received, whether it stayed within those permissions, and what information influenced its decision.
That represents an entirely new investigative framework for fraud teams.
Audit trails will become just as important as transaction history
Tomorrow's investigations may rely as much on software history as transaction history.
Investigators will increasingly need:
- Agent activity logs
- Permission history
- Decision history
- Authority changes
- Data inputs
- Human review records
These audit trails will help investigators reconstruct why an AI agent made a particular payment decision and support both internal reviews and regulatory examinations.
SAR reporting will continue to evolve
Current SAR reporting was built around human actors. As agentic commerce becomes more common, suspicious activity reports will likely include richer narratives describing AI-initiated payment activity, delegated authority, decision paths, evidence reviewed, and known limitations.
Rather than replacing existing SAR processes, agentic payments will expand how investigators document complex financial crime investigations and support AML compliance.
Key takeaways
- Good governance is still good fraud prevention. Strong documentation, authority management, fraud controls, transaction monitoring, and governance remain the foundation of effective fraud prevention.
- We don’t need every answer before we begin preparing. Start with three: Who authorized the action? What authority was granted? Did the activity remain within those boundaries?
- Those three questions will matter whether you’re conducting fraud investigations, reviewing payment fraud, filing suspicious activity reports, supporting AML investigations, or simply trying to understand what happened.
Final takeaway
Agentic payments are not replacing fraud investigators. They're changing what we investigate.
Identity still matters. Customer relationships still matter. But as software begins participating in financial decisions, institutions that invest in better documentation, stronger audit trails, thoughtful governance, and modern fraud controls will be better prepared than those waiting for regulations to catch up.
Innovation has always moved faster than the rulebook. Our job as fraud fighters is not to predict every answer. It's to start asking better questions.
Episode resources & links:
Connect with Hailey Windham, CFCS | LinkedIn
Host of the Fraud Forward Podcast
Banking Community Lead at Sardine
Certified Financial Crimes Specialist (CFCS)
2023 Credit Union Rockstar, CU Magazine
Continuous Improvement Award, SAFE Federal Credit Union, 2023
Top 20 Professionals Under 40, The Sumter Item, 2022
Episode transcript
Hailey Windham
00:05
What's up, Fraud Fighters? Welcome back to Fraud Forward. I will first address the elephant in the room. Yes, I am not in my normal podcast studio, am I? No, this week I am in Austin, Texas with Marketing Team with Sardine. So we are just having a great week of strategizing and having great conversations for what's to come. Very exciting time there. But obviously, it's still important to bring you an episode. So I'm very excited to have this conversation alone with myself in a room I'm not familiar with. But glad you guys are here. So thank you so much for showing up. Okay, over the last few months, I've probably said the words agentic payments more than any other topic. You know, talk about them in conferences. I've spoken about them on webinars. I've debated them with some of the smartest people in payments and compliance. And I recently had the opportunity to sit down with Matt Vega during an ACAMS webinar alongside Mary Ann Miller to discuss what agentic commerce means for fraud investigations and SAR reporting. Then I had one of my all-time favorite conversations ever on Fraud Forward with Matt Janiga from Modern Treasury. We started talking about, you know, the payment infrastructure, but somehow ended up talking about where payment or fraud operations are headed over the next decade. And here's what I've realized from that, right? Most conversations about agentic payments, I think, are asking the wrong questions. You know, everyone wants to know, will AI be moving the money? I think the more important question is, how do fraud teams investigate transactions when software starts making decisions? Because that's the world that we're headed towards. And frankly, I don't think we're as far away from that as many people believe. So for decades, we built fraud programs around one very simple assumption that a human initiates the payment. You know, someone logged in, someone clicked submit, someone approved the wire, someone entered the the routing number.
Hailey Windham
02:08
You know, everything from fraud monitoring to dispute investigations to SAR reporting starts from that assumption. Even our investigations reflected, right? We reconstruct what the customer did, what device they used, where they logged in from, whether they authenticated, whether they changed information beforehand. But agentic commerce challenges that entire investigative model. Because now the customer may not be the one clicking anything. Instead, they've authorized software to act on their behalf, which is a completely different world. So one thing that Matt Vega emphasized during our webinar was something, I think, that gets confused all the time. And it's that automation isn't new. So we've had those reoccurring ACH payments. Autopay, schedule of wires, payroll, you know, the standing instructions. Those aren't agentic. Those are automated. The customer made the decision once. The system repeats it. Agentic systems are different. So they're making decisions. They are comparing prices, negotiating purchases, choosing the merchants, determining timing, moving funds based on goals instead of fixed instructions. That's a massive shift. Because now the software isn't just executing instructions. It's exercising judgment. So the investigation changes. And again, this is the part that fascinates me. Today, if I investigate fraud, I'm asking who logged in? Who clicked the button? Was the customer manipulated? Was the device compromised? Tomorrow, though, my investigation looks different. Now I'm asking who authorized the agent? What permissions did it have? What information was available when it made that decision? Did it stay within its authority? Has its behavior changed? Notice anything? Like, did something change, right? I'm no longer just investigating a customer. I'm investigating the customer and the software acting on their behalf. That's a completely different investigative framework. And one concern, though, that I hear constantly is, so who's responsible? Honestly, identity doesn't disappear. The customer still owns the account. The customer still granted authority. But attribution gets much harder. Marry Ann Miller framed this perfectly during our webinar when she said that, you know, the challenge isn't proving who owns the account. It's reconstructing the decision path. That's why auditability becomes incredibly important. Investigators may soon need, you know, agent logs, permission history, decision history, data endpoints, input, excuse me, authority changes. Think about it. You know, today's investigators rely heavily on that transaction history. But tomorrow's investigations may rely just as much on software history. [Ad Break (5:03): Finally, I'm so happy to share with you all that the Saturday Fraud Strategist is now a podcast. What? Yeah. On top of my weekly newsletter, you could now listen to and watch me talk about my, and hopefully your, favorite topic, fraud strategy. And from time to time, I'll be hosting operators and founders to discuss where the industry is headed and what we, fraud fighters, should pay attention to. I must say, I'm super excited. And if I'm being honest, a bit nervous about all of this. I've been debating with myself whether to start a podcast for ages, but kept putting it off. But now, this teaser is out, so I guess there's no turning back. So, if you want to join me for the ride, head over to Sardinia's website and subscribe now. Are you ready? Am I ready? We'll find out next Saturday.]
Hailey Windham
06:02
One of my favorite parts of the ACAM's discussion was talking about SARS. You know, current SAR guidance assumes human actors. So, what happens when software becomes part of the story? I don't necessarily think that we, you know, need brand new SAR forms, but I do think that the narratives will evolve. So, imagine writing a SAR that includes an AI agent initiated payment activity, authority granted, scope of permissions, decision path, human review performed, evidence reviewed, known limitations. There's a much richer story there for law enforcement. And honestly, it becomes, you know, it may become necessary because another question emerges then is, who's the suspect? Who's the customer, the fraudster, the person that's manipulating the customer? Or did the agent simply operate exactly as instructed? Those aren't theoretical questions anymore. They are operational questions. So, I will say, though, that Matt Janiga changed the way I think about this. When he came on to Fraud Forward, we actually weren't planning to spend much time talking about AI. We, you know, we started talking about payment infrastructure, modern treasury, APIs, cloud-native banking. Then he said something that I just truly, I can't stop thinking about.
Hailey Windham
07:17
He reminded me that, you know, Dodd-Frank was written in a world of fax machines, corded telephones and human-staffed call centers. Think about that. You know, our regulatory frameworks, our investigative assumptions, our operational playbooks were built for an entirely different payments ecosystem. Today, money moves instantly. Infrastructure lives in the cloud. Fraud happens in milliseconds. And increasingly, software participates in financial decisions. The infrastructure changed. Now investigations have to also. There's one thing that I appreciated hearing from both Matt Vega and Matt Janiga, the two Matts, and it's that regulators aren't asking, how do we stop innovation? Increasingly, you know, they're asking, how do we enable it safely? Which is encouraging because fraud teams shouldn't wait for that perfect guidance. We already know what good governance looks like. You know, it's documentation, it's explainability, audit trails, authority, management, monitoring. Those principles don't change, right? Only the technology does. So, for those of you that are taking away anything from this or would want to know, like, where to start, I'd begin with three questions. Who authorized the action? What authority was granted? And did the activity remain within those boundaries? Those three questions will matter, whether you're filing a SAR, investigating fraud, answering an examiner, or simply just trying to understand what happened. I honestly think that those three questions become the foundation of fraud investigations over the next decade. So, in closing, right, for this short episode, solo episode, where I just kind of reiterate what I've learned over the last couple of weeks with agentic payments, is that agentic payments aren't replacing, you know, the fraud investigators and how we do things. They're changing what fraud investigators investigate. It's a very important distinction. The customer relationships still exist. Identity still matters. Fraudsters aren't disappearing, but the story behind every transaction is becoming more complex. And institutions that prepare now by, you know, improving documentation, thinking about attribution, and building those stronger audit trails, these are going to be the ones that are in a much better position than the ones waiting for regulators to hand them a playbook of, show me how to do it. And, you know, that's because if there's one thing that we've learned throughout the history of payments, innovation always arrives before the rulebook. Our job isn't to predict every answer. It's to start asking better questions. So, that's it in a nutshell for this week and my thoughts on that. I really just, I felt like it was an important conversation that if I was a newbie fraud person and you started talking to me about agentic payments, I would look at you and say, that's not going to happen anytime soon. But it is. We need to be ready for it and we need to make sure that our institutions are as well. So, that's my food for thought. I am again, sorry for my boring background. Don't worry, we'll get back to our regularly scheduled episodes, right, where I'm in the office. And actually, next week I will be at the ACFE Boston. So, if you're hearing this on Wednesday, come find me and love to have a conversation with you, love to get a picture, love to, you know, just have a nice chit-chat. Excited for that opportunity again for my first ever time at the ACFE Global Conference. I've attended virtually before but never in person. So, this is a real treat for me. Super, super thankful for starting, for setting this up. So, that's it for today. Thanks for joining me for another riveting episode of Fraud Forward. Oh, and please, if you love me, why don't you hit that subscribe button, like the video, do all the things on YouTube that all the podcasters normally say that I'm supposed to say. So, hit that subscribe button because you want to and you want to support me and the show and the efforts. So, anyways, stay vigilant, stay informed, keep moving Fraud Forward. Thanks for listening to Fraud Forward.
Hailey Windham
11:51
Remember, every conversation, every connection and every insight moves our industry one step closer to stronger fraud defenses. If today's episode sparked an idea, share it with your team or tag me on LinkedIn. I love hearing how you're moving Fraud Forward in your own organization. Until next time, stay curious, stay resilient, keep moving Fraud Forward.
View full transcript
