Payments Shift From Who You Are to What You’re Trying to Do

Artificial intelligence is altering the mechanics of digital identity, forcing financial institutions to reconsider long-standing assumptions about how a customer proves that a transaction is legitimate.

Tools capable of replicating voices, images and behavioral patterns are increasingly accessible. As a result, identity verification systems built to distinguish between humans and automated activity are encountering a more complicated reality.

In a “What’s Next in Payments” interview, Christine Hurtubise, vice president of artificial intelligence and machine learning at FIS, said the industry is moving toward more contextual approaches that analyze intent and behavior across the full customer journey.

Wallet Payments and the Role of Intent

The pressure on identity systems has intensified as consumers conduct a growing share of transactions through digital wallets. These payments environments frequently combine biometric authentication with device-based security measures, creating a layered model that depends on recognizing the user as well as the device used to initiate a purchase.

“As it relates to payments, a lot of consumers are using their digital wallets, and the authorization is coming from a combination of biometrics and device authentication,” Hurtubise said. “Tokens that are assigned for Apple Pay wallets, for example, require authorization that recognize your face.”

That structure works effectively when the biometric signal reflects a real person. However, as generative tools advance, the possibility that artificial agents could imitate facial recognition or other identity indicators becomes more plausible.

For that reason, Hurtubise said financial institutions are beginning to analyze the purpose and consistency of an interaction rather than relying solely on traditional identity signals.

“At FIS, we’re looking to create a user journey and follow intention more holistically, end to end, as we start to think about fraud,” she said.

Tracking intention across an entire transaction sequence allows institutions to evaluate whether activity fits the behavioral patterns of a genuine consumer.

Identity Checks Are Evolving

Historically, many security controls attempted to determine whether an interaction originated from a human user or from automated software. This distinction is becoming less useful as advanced software agents acquire the ability to replicate typical human behaviors, Hurtubise said.

“Checks have been centered around determining if activity is machine-driven or human-driven,” she said. “That paradigm is shifting as agents are able to replicate human activities.”

Automated programs can now solve tasks that once served as proof of humanity. Hurtubise cited CAPTCHA challenges as one example of a verification method that no longer provides the assurance it once did.

The emergence of agent-driven commerce introduces an additional complication. Artificial assistants may increasingly perform transactions on behalf of customers, which means payments systems must determine whether the agent is acting with legitimate authority.

That shift introduces the need to authenticate not only the consumer but also the digital intermediary conducting the transaction.

Tokenization and Agent Authentication

To limit the exposure of sensitive information, tokenization is likely to play a more central role in the next generation of identity architecture, Hurtubise said.

“I think we should try to tokenize as much personally identifiable information as possible,” she said. “PANs, names, any information that could be reused.”

Tokenization replaces sensitive data with randomized identifiers that can be used for authorization without transmitting the underlying information. By reducing the amount of personal data moving through payments systems, the approach can lower the potential value of stolen credentials.

At the same time, the rise of autonomous software agents requires new authentication frameworks designed specifically for machine-to-machine interactions.

“This is where we’re looking to use authentication mechanisms that are native to agents,” Hurtubise said. “There are standard protocols that we can enable that agents use within the industry.”

Under such a model, the agent itself would present verifiable credentials confirming that it has been authorized to perform a purchase or account action.

A System Built for AI-Driven Commerce

Financial institutions are already applying layered verification models that combine several forms of identity checks, Hurtubise said. Some FIS onboarding systems analyze multiple external data sources, using AI to determine whether the information associated with an application appears reliable.

If the system cannot establish a sufficient level of confidence, additional verification steps may be triggered, or the activity may be flagged for potential fraud.

That multisource approach reflects a broader industry movement toward identity systems capable of adapting to a more complex environment where humans and intelligent software participate in transactions.

Looking ahead, the next significant development would be a standardized framework that allows authorized agents to operate within payments systems securely and transparently, Hurtubise said.

“I think it would be creating a systematic way to authorize agents proactively before they begin to start making purchases,” she said. “Pushing forward the ability for authorized agents to securely interact with payments and some of our end systems would be a big opening in the industry.”