Meta launched Muse in early September, and it changes how consumers relate to AI. Muse does more than answer questions. It sends emails, books travel, fills out forms and checks out purchases, and it keeps working after the user closes the app. For consumers, it means they have access to a personal assistant to handle tasks and automate aspects of their life. For FIs, that means an agent may log in, move money and dispute the outcome on a customer’s behalf. The fraud frameworks FIs rely on were built for a different kind of user.
(Figure 1)
Consumer Agents Begin to Scale
Meta’s distribution gave Muse a rapid start. TechCrunch reported an estimated 3.4 million downloads by late September 2026, based on Sensor Tower and other estimates. The Information reported internal figures showing more than 3 million weekly users prompting Muse for tasks.
These figures measure curiosity and repeat use. They do not measure financial usage of the platform. Account linking is available through Plaid and Stripe Link, but no public data shows how many users have connected bank accounts or authorized consequential financial actions. The data pathway exists, but the scale of its use is not yet clear.
Checkout runs through Stripe Link, which issues one-time-use cards so real card numbers stay hidden. Meta says Muse is the first AI agent covered by Link’s purchase protections. A separate system called Sentinel reviews the agent’s actions before they reach the internet, and an audit trail records what the agent has done, according to Meta.
Agents Break the Human Authentication Model
Datos Insights’ September 2026 report, Agents Are Here; Standards Aren’t: Closing the Agentic AI Gap, starts with the core problem. Every FI’s fraud system asks one question: “Is this the right person?” Fraud systems answer it by monitoring spending habits, device preferences and geographic footprints. Agents, the report says, “shatter this foundation” because they operate consistently without the behavioral deviations those models were trained to catch.
FIs lack confidence they can handle this. In a survey of 155 global fraud executives conducted in Q2 and Q3 2026, 18% said they were very confident they could distinguish a customer-authorized AI agent from malicious automation in real time. Sixty percent were somewhat confident, with gaps. Another 18% were not confident.
The report also identifies four questions every agentic transaction must answer:
- Is this the right agent?
- Does it have appropriate scope?
- Is it properly delegated?
- Is revocation still in place?
The last question is the newest. The core issue is that traditional systems assume permissions stay stable once granted. A consumer can revoke an agent at any moment, and that revocation must reach every system, platform and provider involved within seconds.
The Blind Spot Sits Outside the Bank
Most agent activity will happen on merchant sites, and FIs often cannot see it. Card schemes can flag an agentic transaction only when the agent is enrolled with them. Non-enrolled agents may fall back to browser interactions that look human. Those paths add friction and cost, but they still work often enough to matter.
Peer discussions at an industry exchange this month echoed this picture. Most participants said they could not reliably identify Muse traffic, and few had received any indicator from merchants or payment providers that a transaction was agent-initiated. The industry has not yet agreed on what that payload should contain or how much context an issuer should receive.
Liability and Evidence Remain Unresolved
When a consumer disputes an agentic transaction, the institution must prove the consumer authorized it. Most FIs lack systems to capture that evidence, and 83% of surveyed FIs expect their inability to produce adequate authorization evidence for customer disputes to rise.
Asked how they expect liability to fall under current Regulations E and Z frameworks, 39% of respondents said the institution bears liability and current rules protect the consumer. Another 32% said liability is genuinely unclear. The report notes that Regulations E and Z do not explicitly address agentic transactions, and that this vacuum prevents institutions from confidently investing in protective infrastructure.
Credentialing responsibility is also undecided. In the same survey, 44% said responsibility should be shared across the FI, the technology provider and the consumer. Another 26% said the FI should bear it, 19% pointed to the technology provider, and 9% pointed to the consumer.
The “Break the Glass” Playbook
Waiting for regulators or the first major dispute will force FIs to respond on someone else’s timeline. The “Break the Glass” playbook gives FIs five steps they can take now to be better-prepared. The first three build immediate visibility and control. The last two set up a longer-term approach.
(Table A): The Risk Playbook
Muse is the signal, and consumer adoption is the warning. FIs that do not help shape these frameworks over the next 6 to 12 months will face costly redesigns after the fact. Waiting for regulators or significant dispute volume means responding on someone else’s timeline. The institutions that move now will help write the rules rather than adapt to them.
