DEFS

DEFS Learn · AI agents and online banking

How do you verify an AI agent? Visa TAP, Mastercard Agent Pay, Web Bot Auth and AP2 explained

Last updated · DEFS Agent Defense (defs.ai)

Short answer

You verify an AI agent by checking a cryptographic credential it sends with each request, not by trusting its name, user agent or IP address. Most agent credentials today are signed HTTP requests (Cloudflare Web Bot Auth, which Visa's Trusted Agent Protocol and Mastercard Agent Pay build on) or signed payment mandates (Google AP2). Verification tells you which agent you are dealing with; you still need to check what the member allowed it to do.

Two questions, not one

Every agent request raises two separate questions:

  1. Who is this agent? Is it really the assistant it claims to be, and is the request unchanged and fresh?
  2. What is it allowed to do? Did this member authorize this agent to make this payment, to this payee, for this amount?

Agent credentials answer the first question well. The second is answered by the member's and the institution's rules, which is why verification and scopes work together.

The main agent credentials, explained

CredentialWhat it isWhat it proves
Cloudflare Web Bot AuthSigned HTTP requests based on IETF drafts. The agent publishes its public keys in a directory at a well-known address and signs each request (Cloudflare Docs).The request came from the holder of that key and was signed within a time window.
Visa Trusted Agent Protocol (TAP)Introduced in October 2025, developed with Cloudflare, built on HTTP Message Signatures and aligned with Web Bot Auth. Available in the Visa Developer Center and on GitHub (Visa).A Visa-recognized agent with commerce intent, plus optional consumer-recognition and payment data.
Mastercard Agent PayRegisters and verifies agents before they transact, uses agentic tokens, and uses Web Bot Auth for agent verification (Mastercard). In 2026 Mastercard described an Agent Pay Trust Framework that adds a probability score for issuers and Know Your Agent tokens with Skyfire (Mastercard).A Mastercard-registered agent, with tokenized payment credentials and spending controls.
Google AP2 (Agent Payments Protocol)An open protocol that uses signed "mandates" capturing the user's intent and payment authorization. Version 0.2 was donated to the FIDO Alliance. The first version supports card-style "pull" payments, with real-time bank transfers on the roadmap (AP2).The user authorized a specific checkout or payment, within stated constraints.
Know Your Agent (KYA) providersProve's agentic suite delivers proof of humanity, consent and authorization in one token (Prove). World's AgentKit (beta) shows an agent is backed by a unique verified human (World). Baselayer mints short-lived, site-specific credentials naming who is behind an agent (Baselayer). Trulioo issues a Digital Agent Profile, currently in alpha (Trulioo).A verified person or business stands behind the agent.

Visa and Mastercard each host a directory of their registered agents' keys, and both add a tag that says whether the agent is browsing or paying, plus a nonce to prevent replays (Cloudflare Blog).

Why banks have to do their own checking

Most of these programs were designed first for merchants accepting card payments at checkout. When an agent asks your online banking to pay a bill or send an ACH transfer, there is no merchant and no card network in the middle. Your institution, or a checkpoint working for it, has to verify the credential itself.

Verification steps any institution can apply

  1. Fetch the issuer's public keys from its published directory and cache them, refreshing on a schedule.
  2. Check the signature against those keys, over the parts of the request that matter: host, path and body.
  3. Check freshness. Reject expired signatures and any nonce already used.
  4. Check the body digest so an amount or account number cannot be changed after signing.
  5. Check the intent tag or mandate: a browsing credential should not be able to pay.
  6. Check revocation and blocklists before going further.
  7. Then apply scopes: which operations, which payees, what amount, and whether the member must approve.

How DEFS handles it

DEFS never asks agents for a new passport. It verifies the credentials agents already carry and then applies your rules and the member's rules to every request.

  • One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
  • Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
  • Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
  • Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
  • Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
  • Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.

The demo results

We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.

  • 1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
  • 0 of 807legitimate requests wrongly blocked: zero false positives.
  • 3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.

"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.

Attack type in the testResult
Forged credentials93 of 93 stopped
Replayed credentials124 of 124 stopped
Tampered requests (body changed after signing)119 of 119 stopped
Expired credentials108 of 108 stopped
Requests with no agent credential86 of 86 stopped

See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.

See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.

Book a demo

Frequently asked questions

Does a verified agent mean a safe agent?

No. Verification tells you who the agent is and who stands behind it. It does not tell you whether this payment is what the member wanted. Trulioo's own KYA page makes the same point: a credential is evidence of identity and authorization, not a guarantee of future behavior. You still need limits and member approval for new payees.

Which agent credentials should a credit union accept?

Accept as many as you can verify properly. Members will use agents from different companies, and each agent maker chooses its own credential. Accepting only one leaves most members either blocked or sharing passwords.

Do we need to join the Visa or Mastercard agent programs?

Those programs are aimed mainly at card transactions with merchants. For bill pay, transfers and ACH in your own online banking, what matters is that you can check the credentials those programs issue, using their published keys.

What is Know Your Agent (KYA)?

Know Your Agent is the agent equivalent of Know Your Customer: confirming which agent you are dealing with and which person or business is accountable for it. Prove, Baselayer, Trulioo and Skyfire offer KYA credentials, and World offers proof that a unique, verified person stands behind an agent.

Sources

  1. Cloudflare Docs: Web Bot Auth
  2. Visa: Visa Introduces Trusted Agent Protocol (Oct 14, 2025)
  3. Mastercard: Agent Pay Acceptance Framework (Oct 14, 2025)
  4. Mastercard: Agent Pay Trust Framework and Know Your Agent (Oct 8, 2026)
  5. AP2: Agent Payments Protocol documentation
  6. Prove: Prove launches Identity Platform as the trust layer for an agentic world (Apr 22, 2026)
  7. World Developer Docs: Integrate AgentKit
  8. Baselayer Docs: Know Your Agent basics
  9. Trulioo: Know Your Agent (KYA)
  10. Cloudflare Blog: Securing agentic commerce with Visa and Mastercard (Oct 24, 2025)
  11. DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).