With the advance of digital transactions, which dispense banknotes, coins, or physical cards, the mobile phone has become central to most daily activities. In Brazil, the popularization of Pix has driven this transformation, opening up space for payment methods that occur without immediate consumer intervention.
This evolution transcends the mere exchange of physical money. With the support of Artificial Intelligence (AI), autonomous agents are capable of researching products, comparing prices, and making purchases. Simultaneously, modalities such as Automatic Pix have emerged, allowing recurring debits to be scheduled without requiring new authorization for each transaction.
Although the promise is to simplify financial routines, there is a crucial change: the less direct the consumer's participation in each payment, the more rigorous the control must be exercised through pre-established rules, permissions, and security mechanisms.
The central issue in this new scenario lies in the limit of this autonomy: in case of failure in an automatic operation, who will be responsible?
Data released by the Central Bank indicates that the volume moved through Pix exceeded R$ 35.3 trillion in 2025, surpassing the mark of 80 billion transactions in one year. The rate of use in retail and daily transfers is already more than four times higher than the total operations performed with credit cards.
The next phase of this evolution aims to remove certain actions from the consumer that currently require validation in every payment. Instead of accessing the application, checking values, and authorizing transactions individually, some operations may be executed based on previously granted permissions.
This automation occurs through different channels. In Automatic Pix, periodic expenses, such as monthly fees, subscriptions, and service bills, can be debited directly from the account after prior customer authorization. AI systems operate at a different level, functioning as personal assistants in e-commerce, researching items, monitoring costs, selecting offers, and making purchases within the parameters defined by the user.
Recently, BCB Resolution No. 587 enabled an even broader structural change by allowing the use of Automatic Pix in salary accounts, scheduled for July 1, 2027. This determination means that the account where the worker receives their salary can also concentrate programmed recurring payments.
Both technologies share the characteristic that the payment no longer depends exclusively on a decision made at the moment the money leaves the account. Thus, control is established before the transaction.
For Kleber Couto, Technology Director at Pagar, a Brazilian fintech focused on financial infrastructure with solutions based on Open Finance and AI, the ease of invisible payment derives from well-structured consent. According to him, consent in Open Finance is not equivalent to a 'blank check,' as it defines clear parameters, such as maximum value per transaction, limit per period, authorized beneficiaries, and validity period.
In practice, these limits function as a safeguard. The agent may have the autonomy to perform a task, but it must not exceed the conditions previously agreed upon by the client. The expert emphasizes that AI does not make the final decision: 'Each payment is validated by the institution where the client's money is held, against the consent limits, before being settled. If the request goes outside what was agreed, it is rejected or returned to the user for extra confirmation.'
Additionally, he mentions that the technology uses limited-scope tokens so that the agent never stores bank passwords or credentials, ensuring the user's ability to consult or revoke permissions at any time in the banking application.
The logic, therefore, is to transfer part of the control to the rules defined in advance. The user does not need to approve every movement, but must clearly establish what the system is authorized to do. While in traditional Pix the user checks the amount, recipient, and authenticates the operation, in automated payment these decisions are made beforehand, based on defined rules and permissions.
Therefore, security must ensure that the transaction remains within these limits before being completed. Couto highlights that the primary protection of the system does not lie only in AI models, but rather in external deterministic rules, which prevents the payment decision from being susceptible to algorithmic failures or manipulations. He warns: 'An agent can be misled or even manipulated by malicious instructions hidden on a website or in a message. Therefore, the decision to execute a payment can never depend solely on what the agent 'understood.''
Such rules act as a barrier independent of the agent's interpretation. Even if the AI is tricked, the transaction must respect the limits imposed by the financial system. Above these barriers operate the banks' and payment initiators' real-time risk engines, analyzing spending profiles, time, location, frequency, and cross-referencing fraud data with the Central Bank.
If the system detects atypical behavior, such as an immediate payment to an unknown person, the operation may be suspended for biometric confirmation. Another advancement under development is equipping the AI agent itself with a traceable digital identity, allowing the system to monitor and block anomalous movements originating from the automation.
Security, thus, operates in multiple layers: first, the permissions defined by the client; second, the rules restricting the agent's action; and finally, the risk detection mechanisms capable of interrupting a suspicious operation.
Even with security mechanisms, errors and fraud are possible, such as duplicate charges, incorrect transaction processing, or deception of the AI agent by third parties. In these cases, it is essential to define who will bear the loss. According to the Consumer Defense Code and the understanding of the Superior Court of Justice (STJ), the objective responsibility for service security rests with the financial institution or the platform that enables the technology.
Couto clarifies that Open Finance regulation delimits functions: the payment initiator must transmit the transaction exactly as authorized, while the account holder institution is responsible for authenticating and validating the consent. If the AI agent is provided by an unregulated technology company, it will be contractually liable to the contracting financial institution. He adds that double charging is classified as operational failure and must be automatically refunded through the Pix return flow, at no cost to the user. The client, however, remains responsible only for what they actually authorized and for the secure custody of their biometric credentials and devices.
The scenario becomes complicated when the operation complies with the registered parameters, but the agent is manipulated by third parties. In this case, it is not enough to check only whether the payment was within the limits; it is necessary to reconstruct the path that led to that decision. However, Couto points out that the sector is still discussing more complex situations, such as payments within limits but induced by an agent compromised by third parties.
To resolve such dilemmas without creating long impasses, total traceability of operations becomes essential. 'It is precisely here that the audit trail makes a difference. If every step is recorded (what was consented to, what the agent requested, what was validated and by whom), it is possible to reconstruct what happened and assign responsibility accurately, instead of turning every incident into a dispute of versions.'
This trail allows identifying not only what was paid, but also which permission was active, which request came from the agent, and which mechanisms validated the operation.
Pix norms continue to be updated by the Central Bank as new forms of billing enter the market. The regulation establishes the operational and security criteria that banks and platforms are obliged to follow. Such measures constitute a broader layer of protection for the ecosystem. For the consumer, however, the deepest change occurs elsewhere: as payments become automatic, the moment to exercise control is no longer necessarily when the money moves.
In the balance between convenience and control, the most drastic change is that money begins to circulate without needing to be the central focus of the experience. A purchase can occur, a subscription can be renewed, and an account can be settled while the user performs other activities. This brings payments closer to the logic that already governs much of digital life: services that run in the background and only appear when something unexpected happens. The difference is that, in this case, what operates behind the scenes is not just information—it is your money.