"Giving cards to AI assistants"… Visa and Mastercard's 'AI Identity Verification (KYA)' and how to keep my wallet safe

▲ Photo: AI-generated image

A life where you don't need to stop by a convenience store on your way home; instead, you just leave a message on your smartphone saying, "Order and pay for dinner salad and mineral water to be delivered by the time I get home," and your AI assistant automatically finds the cheapest store and completes the payment.

This convenient daily life, where even the hassle of biometric authentication or checking card numbers on the payment screen disappears, is now entering the actual card payment network. This is because credit cards and mobile wallets, which previously required users to manually press the payment approval button, have begun to build a new financial infrastructure that directly grants payment execution authority to 'AI agents'.

According to recent announcements from major global payment networks and foreign media reports such as Reuters, the two largest global card companies, Visa and Mastercard, along with Ant International, which operates Alipay+, have officially announced their cooperation on 'KYA (Know Your Agent)', a joint framework for identifying and verifying autonomous payment AI agents.

Just as financial institutions thoroughly verify customer identities ('KYC - Know Your Customer') to prevent crime and financial fraud, the purpose now is to cryptographically verify at the payment network level whether the entity requesting payment is a legitimate AI approved by the actual user, or a fake, forged hacking bot. This partnership includes leading domestic mobile wallets such as Kakao Pay and Toss, as well as major Southeast Asian fintech platforms as initial partners.

This change in payment infrastructure fundamentally transforms consumer lifestyles. Global market research firms such as McKinsey predict that the e-commerce market directly led by AI will reach up to $5 trillion by 2030. It means that the 'era of autonomous consumption' will become a reality, where AI goes beyond merely recommending product links to independently processing orders and payments in a one-stop manner within a user-specified budget when flight tickets become available or daily necessities run out.

In particular, the blockchain and Web3 industries are also paying attention to the possibility of realizing a Machine-to-Machine (M2M) economy by combining stablecoin-based micro-payments (ultra-small payments) with the KYA standard, where AI settles fees in real-time whenever it uses content or data APIs.

However, as much as we are entrusting the key to our wallets to AI, the risks consumers must bear are also clear. The biggest problem is 'AI malfunction and purchase disputes'. While the KYA framework guarantees the identity of the AI on the network, it does not automatically refund business losses incurred when the AI chooses incorrect product options or hastily pays for non-refundable airline tickets.

If payment limits are set too broadly, or if the validity period for the AI agent's delegated authority is neglected, there is a risk that unintended large sums could be paid through account hacking or prompt manipulation attacks, which cannot be entirely ruled out.

Therefore, the safest consumption principle for entering the era of 'AI payment delegation' is 'strict pre-budget control'. When granting payment authority to AI, 'single payment limits' and 'monthly cumulative limits' must always be set to the minimum amount. Additionally, categories should be restricted so that they are used only for specific purposes, and multi-layered safety measures should be maintained, such as receiving final signature push notifications on the user's smartphone for expenditures above a certain amount or for recurring payments.